java - securitypolicy 策略不是 element

Question

我有这个安全错误:

Exception in thread "main" java.lang.IllegalArgumentException: {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}Policy is not a <wsp:Policy> element.
    at org.apache.neethi.PolicyBuilder.getPolicyOperator(PolicyBuilder.java:176)
    at org.apache.neethi.PolicyBuilder.getPolicy(PolicyBuilder.java:124)
    at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:100)
    at org.apache.ws.secpolicy11.builders.WSS10Builder.build(WSS10Builder.java:40)
    at org.apache.ws.secpolicy11.builders.WSS10Builder.build(WSS10Builder.java:33)
    at org.apache.neethi.AssertionBuilderFactoryImpl.invokeBuilder(AssertionBuilderFactoryImpl.java:138)
    at org.apache.neethi.AssertionBuilderFactoryImpl.build(AssertionBuilderFactoryImpl.java:117)
    at org.apache.neethi.PolicyBuilder.processOperationElement(PolicyBuilder.java:224)
    at org.apache.neethi.PolicyBuilder.getPolicyOperator(PolicyBuilder.java:174)
    at org.apache.neethi.PolicyBuilder.getPolicy(PolicyBuilder.java:124)
    at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:100)
    at org.apache.ws.secpolicy11.builders.SecureConversationTokenBuilder.build(SecureConversationTokenBuilder.java:70)
    at org.apache.ws.secpolicy11.builders.SecureConversationTokenBuilder.build(SecureConversationTokenBuilder.java:31)
    at org.apache.neethi.AssertionBuilderFactoryImpl.invokeBuilder(AssertionBuilderFactoryImpl.java:138)
    at org.apache.neethi.AssertionBuilderFactoryImpl.build(AssertionBuilderFactoryImpl.java:117)
    at org.apache.neethi.PolicyBuilder.processOperationElement(PolicyBuilder.java:224)
    at org.apache.neethi.PolicyBuilder.getPolicyOperator(PolicyBuilder.java:174)
    at org.apache.neethi.PolicyBuilder.getPolicy(PolicyBuilder.java:124)
    at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:100)
    at org.apache.ws.secpolicy11.builders.ProtectionTokenBuilder.build(ProtectionTokenBuilder.java:39)
    at org.apache.ws.secpolicy11.builders.ProtectionTokenBuilder.build(ProtectionTokenBuilder.java:34)
    at org.apache.neethi.AssertionBuilderFactoryImpl.invokeBuilder(AssertionBuilderFactoryImpl.java:138)
    at org.apache.neethi.AssertionBuilderFactoryImpl.build(AssertionBuilderFactoryImpl.java:117)
    at org.apache.neethi.PolicyBuilder.processOperationElement(PolicyBuilder.java:224)
    at org.apache.neethi.PolicyBuilder.getPolicyOperator(PolicyBuilder.java:174)
    at org.apache.neethi.PolicyBuilder.getPolicy(PolicyBuilder.java:124)
    at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:100)
    at org.apache.ws.secpolicy11.builders.SymmetricBindingBuilder.build(SymmetricBindingBuilder.java:41)
    at org.apache.ws.secpolicy11.builders.SymmetricBindingBuilder.build(SymmetricBindingBuilder.java:36)
    at org.apache.neethi.AssertionBuilderFactoryImpl.invokeBuilder(AssertionBuilderFactoryImpl.java:138)
    at org.apache.neethi.AssertionBuilderFactoryImpl.build(AssertionBuilderFactoryImpl.java:117)
    at org.apache.neethi.PolicyBuilder.processOperationElement(PolicyBuilder.java:224)
    at org.apache.neethi.PolicyBuilder.getAllOperator(PolicyBuilder.java:184)
    at org.apache.neethi.PolicyBuilder.processOperationElement(PolicyBuilder.java:217)
    at org.apache.neethi.PolicyBuilder.getExactlyOneOperator(PolicyBuilder.java:180)
    at org.apache.neethi.PolicyBuilder.processOperationElement(PolicyBuilder.java:215)
    at org.apache.neethi.PolicyBuilder.getPolicyOperator(PolicyBuilder.java:174)
    at org.apache.neethi.PolicyBuilder.getPolicy(PolicyBuilder.java:124)
    at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:100)

当我尝试评估我的网络服务安全策略中的此元素时:

<sp:Policy xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                                                        <sp:MustSupportRefKeyIdentifier />
                                                        <sp:MustSupportRefIssuerSerial />
                                                        <sp:MustSupportRefThumbprint />
                                                        <sp:RequireSignatureConfirmation />
                                                    </sp:Policy>

在此方法中:

private Policy getPolicyOperator(Object element) {
    QName qn = factory.getConverterRegistry().findQName(element);

    if (Constants.isPolicyElement(qn)) {
        String ns = qn.getNamespaceURI();
        return (Policy) processOperationElement(element, new Policy(defaultPolicyRegistry, ns));
    }
    throw new IllegalArgumentException(qn + " is not a <wsp:Policy> element."); 
}

在neethi 3.0.2依赖项的类PolicyBuilder中。

我看到这个方法有错误:

public static boolean isPolicyNS(String ns) {
    return URI_POLICY_13_NS.equals(ns)
        || URI_POLICY_15_DEPRECATED_NS.equals(ns)
        || URI_POLICY_15_NS.equals(ns);
}

因为这个命名空间http://schemas.xmlsoap.org/ws/2005/07/securitypolicy它不是一个PolicyNS。

我在我的项目中使用这个 Maven 依赖项:

  <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>3.8.1</version>
      <scope>test</scope>
    </dependency>
      <dependency>
          <groupId>org.apache.rampart</groupId>
          <artifactId>rampart-trust</artifactId>
          <version>1.6.2</version>
      </dependency>
      <dependency>
          <groupId>org.apache.rampart</groupId>
          <artifactId>rampart-core</artifactId>
          <version>1.6.2</version>
      </dependency>
      <dependency>
          <groupId>org.opensaml</groupId>
          <artifactId>opensaml1</artifactId>
          <version>1.1</version>
      </dependency>
      <dependency>
          <groupId>org.apache.axis2.wso2</groupId>
          <artifactId>axis2</artifactId>
          <version>1.6.1.wso2v10</version>
      </dependency>
  </dependencies>

有什么想法吗？

Answer 1

本例中的问题在于服务器端策略的生成。例如:

        <sp:Wss11 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
            <sp:Policy>
                <sp:MustSupportRefKeyIdentifier/>
                <sp:MustSupportRefIssuerSerial/>
                <sp:MustSupportRefThumbprint/>
                <sp:RequireSignatureConfirmation/>
            </sp:Policy>
        </sp:Wss11>

它必须是:

        <sp:Wss11 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
            <wsp:Policy>
                <sp:MustSupportRefKeyIdentifier/>
                <sp:MustSupportRefIssuerSerial/>
                <sp:MustSupportRefThumbprint/>
                <sp:RequireSignatureConfirmation/>
            </wsp:Policy>
        </sp:Wss11>

这个小小的改变就解决了问题。看看这个:http://mail-archives.apache.org/mod_mbox/axis-java-dev/201110.mbox/%3CCAJW3xdrg=iUrpLGE+AOjayin_Jkxjv-0A7xOZRV1y08961zsWQ@mail.gmail.com%3E