JAVA-CXF WS-安全 "A security error was encountered when verifying the message"

Question

很抱歉这个问题，它可能会因为我完全被屏蔽而反复出现。我试图在 CXF 框架之上实现一个 Web 服务服务器。 Jax-ws 对处理网络服务很有帮助，很容易实现。但是，当您想引入安全性时，问题就来了。

要在实现以下源代码中处理安全性:

EndpointImpl jaxWsEndpoint = (EndpointImpl) Endpoint.publish(endPointAddress, httpWebService);
inProps.put("action", "UsernameToken Timestamp");
inProps.put("passwordType", "PasswordText");
inProps.put("passwordCallbackClass", "com.company.webService.PasswordListener");
jaxWsEndpoint.getInInterceptors().add(new WSS4JInInterceptor(inProps));

我向此 Web 服务推送以下 SOAP 请求:

...
<soapenv:Header>
   <wsse:Security soapenv:mustunderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <wsse:Usernametoken wsu:id="UsernameToken-27777511" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wsse:Username>admin</wsse:Username>
        <wsse:Password type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">pass</wsse:Password>
     </wsse:Usernametoken>
   </wsse:Security>
</soapenv:Header>
...

CXF 框架收到我的请求尝试处理安全部分并向我抛出以下异常:

Jun 08, 2016 10:48:24 AM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor checkActions
WARNING: Security processing failed (actions mismatch)
Jun 08, 2016 10:48:24 AM org.apache.cxf.phase.PhaseInterceptorChain doDefaultLogging
WARNING: Interceptor for {http://httpAbstractHandlerImplementation.webService.company.co /}HttpWebServiceService has thrown exception, unwinding now
org.apache.cxf.binding.soap.SoapFault: A security error was encountered when verifying the message at org.apache.cxf.ws.security.wss4j.WSS4JUtils.createSoapFault(WSS4JUtils.java:218)
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:316)

如果有人知道我在哪里做错了。

谢谢

Answer 1

您有 inProps.put("action", "UsernameToken Timestamp"); 但您的安全 header 中没有时间戳。从您的操作中删除“时间戳”或添加匹配的安全 header 。

编辑消息很清楚“安全处理失败(操作不匹配)”所以查看您的请求会发现另一个错误:它应该是wsse:UsernameToken 而不是wsse:截至 official spec 的 Usernametoken .