[es] - Spring ws sa wss4j-om, problem

Hatori_henzo
Yves Al Gadafi
Studentarija
Beograd

Član broj: 185220
Poruke: 17
*.dynamic.sbb.rs.

Profil

^{14.07.2011. u 10:15 - pre 155 meseci}

Ako moze pomoc od nekoga ko je radio sa springom tj. spring web servisima, da budem konkretniji. Vec par dana pokusavam da da ubacim neke bezbednosne procedure, al nece da moze....Web servis je web aplikacija deploy-ovana na glassfish-u, na kojem se nalazi i aplikacija sa formom kojom se poziva servis.

Validacija timestamp-a i digitalnog potpisa funkcionise, ali kad podesim da se koristi enkripcija/dekripcija, desava se sledece(na web servis delu):
...
DEBUG [org.springframework.ws.transport.http.WebServiceMessageReceiverHandlerAdapter] - Accepting incoming [org.springframework.ws.transport.http.HttpServletConnection@2f8eb79f] at [http://localhost:8080/person/services]
DEBUG [org.springframework.ws.server.MessageTracing.received] - Received request [SaajSoapMessage {http://www.w3.org/2001/04/xmlenc#}EncryptedData]
DEBUG [org.springframework.ws.server.endpoint.mapping.PayloadRootAnnotationMethodEndpointMapping] - Looking up endpoint for [{http://www.w3.org/2001/04/xmlenc#}EncryptedData]
...
i na kraju ne nadje endpoint mapping, izbaci gresku WebServiceTransportException: Not Found [404] i to je to. Znaci kao da ne desifruje poruku pre nego sto pocne da trazi endpoint za nju. Evo delova podesavanja:
klijent(appContext.xml):

Code:
<bean id="webServiceTemplate" class="org.springframework.ws.client.core.WebServiceTemplate"
        p:marshaller-ref="jaxbMarshaller"
        p:unmarshaller-ref="jaxbMarshaller"
        p:defaultUri="http://localhost:15555/person/services"
        p:messageSender-ref="messageSender">
        <constructor-arg ref="messageFactory"/>
          <property name="interceptors">
                   <list>
                <ref local="wss4jSecurityInterceptor"/>
                </list>
          </property>
    </bean>
    ..
    <bean id="messageSender" class="org.springframework.ws.transport.http.CommonsHttpMessageSender"/>
    <bean id="messageFactory" class="org.springframework.ws.soap.saaj.SaajSoapMessageFactory"/>
    ..
    <bean id="wss4jSecurityInterceptor" class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor">
    
    <property name="validationActions" value="Timestamp Signature Encrypt"/>
    <property name="enableSignatureConfirmation" value="true"/>
    <property name="validationSignatureCrypto">
        <ref bean="keystore"/>
    </property>
    <property name="validationDecryptionCrypto">
        <ref bean="keystore"/>
    </property>
    <property name="validationCallbackHandler">
        <bean class="org.springframework.ws.soap.security.wss4j.callback.KeyStoreCallbackHandler">
            <property name="privateKeyPassword" value="password"/>
        </bean>
    </property>
    
    <property name="timestampStrict" value="true"/>
    <property name="timeToLive" value="30"/>
    <property name="timestampPrecisionInMilliseconds" value="true"/>
    
    <property name="securementActions" value="Timestamp Signature Encrypt"/>
    <property name="securementSignatureKeyIdentifier" value="DirectReference"/>
    <property name="securementUsername" value="wsclient"/>
    <property name="securementPassword" value="password"/>
    <property name="securementSignatureCrypto">
        <ref bean="keystore"/>
    </property>
    <property name="securementEncryptionUser" value="wsserver"/>
    <property name="securementEncryptionCrypto">
        <ref bean="keystore"/>
    </property>
</bean>
...
<bean id="keystore" class="org.springframework.ws.soap.security.wss4j.support.CryptoFactoryBean">
      <property name="keyStorePassword" value="password"/>
      <property name="keyStoreLocation" value="WEB-INF/Keystore.jks"/>
</bean>

Na servis strani je sve isto, samo se za enkripciju(securementEncryptionUser) koristi wsclient alias, a za potpis(securementUsername) wsserver alias.
Servis interceptor-i:

Code:

<sws:interceptors>
<ref bean="wss4jSecurityInterceptor"/>
<bean id="validatingInterceptor"
        class="org.springframework.ws.soap.server.endpoint.interceptor.PayloadValidatingInterceptor">
    <property name="schema" value="/WEB-INF/person.xsd"/>
    <property name="validateRequest" value="true"/>
    <property name="validateResponse" value="true"/>
</bean>
<bean id ="loggingInterceptor" class="org.springframework.ws.server.endpoint.interceptor.PayloadLoggingInterceptor"></bean>
</sws:interceptors>

Keystore.jks(koristi kljijent):
- Alias name wsserver, Entry Type : TrustedCertEntry
- Alias name wsclient, Entry Type : PrivateKeyEntry
- Alias name wsca, Entry Type : TrustedCertEntry(ovim sam potpisivao wsclient i wsserver sertifikate, znaci ima ulogu CA)
MyTruststore.jks(koristi je servis)
- Alias name wsserver, Entry Type : PrivateKeyEntry
- Alias name wsclient, Entry Type : TrustedCertEntry
- Alias name wsca, Entry Type : TrustedCertEntry
Slazu im se MD5 i SHA1 digesti....

Ako neko moze da pokaze kako na pravi nacin da podesim timestamp ubacivanje/validacija,signature(x509 cert) ubacivanje/validacija, enkripcija/dekripcija (opet x509), vec sam pokusavao i sa xwss-om, cini mi se da je i on pravio problem, ne secam se vise gde, doduse....

Odgovor na temu