java - 针对数据库的 JAX-WS 身份验证

Question

我正在实现一个将由外部 Java 和 PHP 客户端使用的 JAX-WS 网络服务。

客户端必须使用存储在每个客户端数据库中的用户名和密码进行身份验证。

最好使用哪种身份验证机制来确保其他客户端可以使用它？

Answer 1

对于我们的 Web 服务身份验证，我们采用双重方法，以确保具有不同先决条件的客户端能够进行身份验证。

• 使用 HTTP 请求 header 中的用户名和密码参数进行身份验证
• 使用 HTTP 基本身份验证进行身份验证。

请注意，我们网络服务的所有流量都通过 SSL 安全连接进行路由。因此，嗅探密码是不可能的。当然也可以选择带摘要的 HTTP 身份验证 - 参见 this interesting site有关这方面的更多信息。

但是回到我们的例子:

//First, try authenticating against two predefined parameters in the HTTP 
//Request Header: 'Username' and 'Password'.

public static String authenticate(MessageContext mctx) {

     String s = "Login failed. Please provide a valid 'Username' and 'Password' in the HTTP header.";

    // Get username and password from the HTTP Header
    Map httpHeaders = (Map) mctx.get(MessageContext.HTTP_REQUEST_HEADERS);
    String username = null;
    String password = null;

    List userList = (List) httpHeaders.get("Username");
    List passList = (List) httpHeaders.get("Password");

    // first try our username/password header authentication
    if (CollectionUtils.isNotEmpty(userList)
            && CollectionUtils.isNotEmpty(passList)) {
        username = userList.get(0).toString();
        password = passList.get(0).toString();
    }

    // No username found - try HTTP basic authentication
    if (username == null) {
        List auth = (List) httpHeaders.get("Authorization");
        if (CollectionUtils.isNotEmpty(auth)) {
            String[] authArray = authorizeBasic(auth.get(0).toString());
            if (authArray != null) {
                username = authArray[0];
                password = authArray[1];
            }
        }
    }

    if (username != null && password != null) {

        try {
            // Perform the authentication - e.g. against credentials from a DB, Realm or other
            return authenticate(username, password);
        } catch (Exception e) {
            LOG.error(e);
            return s;
        }

    }
    return s;
}


/**
 * return username and password for basic authentication
 * 
 * @param authorizeString
 * @return
 */
public static String[] authorizeBasic(String authorizeString) {

    if (authorizeString != null) {
        StringTokenizer st = new StringTokenizer(authorizeString);
        if (st.hasMoreTokens()) {
            String basic = st.nextToken();
            if (basic.equalsIgnoreCase("Basic")) {
                String credentials = st.nextToken();
                String userPass = new String(
                        Base64.decodeBase64(credentials.getBytes()));
                String[] userPassArray = userPass.split(":");
                if (userPassArray != null && userPassArray.length == 2) {
                    String userId = userPassArray[0];
                    String userPassword = userPassArray[1];
                    return new String[] { userId, userPassword };
                }

            }
        }
    }

    return null;

}

使用我们预定义的“用户名”和“密码”参数的第一次身份验证对我们的集成测试人员特别有用，他们使用 SOAP-UI (虽然我不完全确定是否也不能使用 HTTP 基本身份验证来使用 SOAP-UI)。然后第二次身份验证尝试使用 HTTP 基本身份验证提供的参数。

为了拦截对 Web 服务的每次调用，我们在每个端点上定义一个处理程序:

@HandlerChain(file = "../../../../../handlers.xml")
@SchemaValidation(handler = SchemaValidationErrorHandler.class)
public class DeliveryEndpointImpl implements DeliveryEndpoint {

handler.xml 看起来像:

<handler-chains xmlns="http://java.sun.com/xml/ns/javaee" 
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                xsi:schemaLocation="http://java.sun.com/xml/ns/javaee">

     <handler-chain>
        <handler>
            <handler-name>AuthenticationHandler</handler-name>
            <handler-class>mywebservice.handler.AuthenticationHandler</handler-class>
        </handler>
    </handler-chain>
</handler-chains>

如您所见，处理程序指向 AuthenticationHandler，它拦截对 Web 服务端点的每个调用。这是身份验证处理程序:

public class AuthenticationHandler implements SOAPHandler<SOAPMessageContext> {

    /**
     * Logger
     */
    public static final Log log = LogFactory
            .getLog(AuthenticationHandler.class);

    /**
     * The method is used to handle all incoming messages and to authenticate
     * the user
     * 
     * @param context
     *            The message context which is used to retrieve the username and
     *            the password
     * @return True if the method was successfully handled and if the request
     *         may be forwarded to the respective handling methods. False if the
     *         request may not be further processed.
     */
    @Override
    public boolean handleMessage(SOAPMessageContext context) {

        // Only inbound messages must be authenticated
        boolean isOutbound = (Boolean) context
                .get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);

        if (!isOutbound) {
            // Authenticate the call
            String s = EbsUtils.authenticate(context);
            if (s != null) {
                log.info("Call to Web Service operation failed due to wrong user credentials. Error details: "
                        + s);

                // Return a fault with an access denied error code (101)
                generateSOAPErrMessage(
                        context.getMessage(),
                        ServiceErrorCodes.ACCESS_DENIED,
                        ServiceErrorCodes
                                .getErrorCodeDescription(ServiceErrorCodes.ACCESS_DENIED),
                        s);

                return false;
            }

        }

        return true;
    }

    /**
     * Generate a SOAP error message
     * 
     * @param msg
     *            The SOAP message
     * @param code
     *            The error code
     * @param reason
     *            The reason for the error
     */
    private void generateSOAPErrMessage(SOAPMessage msg, String code,
            String reason, String detail) {
        try {
            SOAPBody soapBody = msg.getSOAPPart().getEnvelope().getBody();
            SOAPFault soapFault = soapBody.addFault();
            soapFault.setFaultCode(code);
            soapFault.setFaultString(reason);

            // Manually crate a failure element in order to guarentee that this
            // authentication handler returns the same type of soap fault as the
            // rest
            // of the application
            QName failureElement = new QName(
                    "http://yournamespacehere.com", "Failure", "ns3");
            QName codeElement = new QName("Code");
            QName reasonElement = new QName("Reason");
            QName detailElement = new QName("Detail");

            soapFault.addDetail().addDetailEntry(failureElement)
                    .addChildElement(codeElement).addTextNode(code)
                    .getParentElement().addChildElement(reasonElement)
                    .addTextNode(reason).getParentElement()
                    .addChildElement(detailElement).addTextNode(detail);

            throw new SOAPFaultException(soapFault);
        } catch (SOAPException e) {
        }
    }

    /**
     * Handles faults
     */
    @Override
    public boolean handleFault(SOAPMessageContext context) {
        // do nothing
        return false;
    }

    /**
     * Close - not used
     */
    @Override
    public void close(MessageContext context) {
        // do nothing

    }

    /**
     * Get headers - not used
     */
    @Override
    public Set<QName> getHeaders() {
        return null;
    }

}

在 AuthenticationHandler 中，我们调用上面进一步定义的 authenticate() 方法。请注意，我们创建了一个名为“Failure”的手动 SOAP 故障，以防身份验证出现问题。