java - Groovy 摘要身份验证

Question

我正在尝试编写一个groovy脚本(也欢迎java代码；))它应该允许我执行摘要式身份验证。需要的是能够在 SOAPUI 中使用摘要式身份验证，因为 SOAP 不支持 native 这种身份验证。

为了测试我的脚本，我使用了 URL:https://postman-echo.com/digest-auth

首先，我通过 Web 浏览器访问该页面以获取 WWW-Authenticate header 。 摘要领域 =“用户”，随机数 =“81lEQmJGxRb3Us9jVJPYlDpjw11On7zW”，qop =“auth”

然后我输入正确的用户名+密码并检查由网络浏览器计算的授权 header 。结果如下:

Digest username="postman", realm="Users", nonce="81lEQmJGxRb3Us9jVJPYlDpjw11On7zW", uri="/digest-auth", response="82884fe7c55a19e80e8c8dea7ba1aece", qop=auth, nc=00000001, cnonce="89aa538367b9069a"

然后我使用相同的数据通过我的脚本执行响应数据的计算。结果如下:

Digest username="postman", realm="Users", nonce="81lEQmJGxRb3Us9jVJPYlDpjw11On7zW", uri="/digest-auth", response="a6767f0a78d17e0cab90df65ec2ace5c", qop=auth,nc="00000001",cnonce="03d476861afd384510f2cb80ccfa8511"

我的响应与网络浏览器计算的响应不同。

我做错了什么？

这是我的脚本:

import org.apache.commons.codec.digest.DigestUtils
import com.eviware.soapui.impl.wsdl.actions.teststep.RunFromTestStepAction


// URL: https://postman-echo.com/digest-auth

wwwAuthHeader = "Digest realm=\"Users\",    nonce=\"81lEQmJGxRb3Us9jVJPYlDpjw11On7zW\", qop=\"auth\""

def realmArray = wwwAuthHeader.split(",")

def realm = realmArray[0].split("=")[1]
def nonce = realmArray[1].split("=")[1]
def qop = realmArray[2].split("=")[1]

def uri = "/digest-auth"
def user = "postman"
def pass = "password"
def method ="GET"



def resp = md5(user,realm,pass,method,uri,nonce)

log.info "resp: "+resp

def cnonce = DigestUtils.md5Hex(user)

def authorizationString = "Digest username=\"$user\", realm=$realm,         nonce=$nonce, uri=\"$uri\", response=\"$resp\", qop=auth,nc=\"00000001\",cnonce=\"$cnonce\""

log.info "authorizationString: " + authorizationString

// methods

def md5(user, realm, pass, method, String uri, nonce) {

    def A1 = DigestUtils.md5Hex ("$user:$realm:$pass")
    def A2 = DigestUtils.md5Hex ("$method:$uri")

    return DigestUtils.md5Hex ("$A1:$nonce:$A2")
}

Answer 1

如果您只是想编写一个允许您执行摘要式身份验证的groovy脚本(也欢迎使用java代码，正如您的问题所示)，这里有一些内容供您引用:

@Grab(group='org.apache.httpcomponents', module='httpclient', version='4.5.3')

import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.apache.http.auth.AuthScope;
import org.apache.http.HttpResponse;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.util.EntityUtils;

CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(
        new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT),
        new UsernamePasswordCredentials("postman", "password"));

CloseableHttpClient httpClient = HttpClients.custom()
        .setDefaultCredentialsProvider(credsProvider)
        .build();

HttpGet httpGet = new HttpGet("https://postman-echo.com/digest-auth");
HttpResponse httpResponse = httpClient.execute(httpGet);
String content = EntityUtils.toString(httpResponse.getEntity());
println content;

运行它，输出如下所示:

{"authenticated":true}