2.4 WEBSPHERE IICE WEB SERVICE SOAP消息安全实现细节
A. 配置
WebSphere IICE Web Services安全机制的配置工作是由客户端和服务器端两部分组成的。就如下面的配置文件实例说描述的一样，SOAP消息会在它被发送到目标服务器之前分别被不同的句柄签名和加密。相对应的，它也会在服务器端被验证和解密。
列表2:AXIS客户端配置文件示例
<globalConfiguration>
<requestFlow>
<handler
type="java:com.venetica.vbr.webservices.handler.X509SignHandler"/>
<handler
type="java:com.venetica.vbr.webservices.handler.EncryptHandler"/>
</requestFlow>
<responseFlow>
<handler
type="java:com.venetica.vbr.webservices.handler.X509SignHandler"/>
<handler
type="java:com.venetica.vbr.webservices.handler.DecryptHandler"/>
</responseFlow>
</globalConfiguration>
|
服务器端的配置文件和客户端的配置文件非常相像。
B. 签名和加密/解密过程:
SOAP消息的签名和加密/解密过程如图2所示:
图2:SOAP消息的签名和加密/解密过程
列表3: XML签名示例代码
public Message signSOAPEnvelope(SOAPEnvelope unsignedEnvelope) throws Exception
{ // WSSignEnvelope signs a SOAP envelope according to the
// WS Specification (X509 profile) and adds the signature data
// to the envelope.
WSSignEnvelope signer = new WSSignEnvelope();
String alias = "username";
String password = "password";
signer.setUserInfo(alias, password);
Document doc = unsignedEnvelope.getAsDocument();
Document signedDoc = signer.build(doc, crypto);
// Convert the signed document into a SOAP message.
Message signedSOAPMsg = (org.apache.axis.Message)AxisUtil.toSOAPMessage(signedDoc);
return signedSOAPMsg;
}
|
列表3显示了XML签名的过程:首先得到SOAP信封，接下来是获得用户证书信息、产生签名对象，然后是用此签名对象对信封进行签名，最后是从被签名的信封中产生新的SOAP消息。
列表4:XML加密示例代码
public Message encryptSOAPEnvelope(
SOAPEnvelope unsignedEnvelope, Message axisMessage)
throws Exception
{
WSEncryptBody encrypt = new WSEncryptBody();
// build the encrypted SOAP part
Document doc = unsignedEnvelope.getAsDocument();
Document encryptedDoc = encrypt.build(doc, crypto);
// Convert the document into a SOAP message
Message encryptedMsg =
(Message)AxisUtil.toSOAPMessage(encryptedDoc);
// Retrieve the desired SOAP part
String soapPart = encryptedMsg.getSOAPPartAsString();
((SOAPPart)axisMessage.getSOAPPart()). setCurrentMessage(soapPart, SOAPPart.FORM_STRING);
encryptedDoc =axisMessage.getSOAPEnvelope().getAsDocument();
// Convert the document into a SOAP message
Message encryptedSOAPMsg = Message)AxisUtil.toSOAPMessage(encryptedDoc);
return encryptedSOAPMsg;
}
|