轴Webservice报头安全密码文本

Question

我是新来的安全头，我需要你的帮助。我可以使用身份验证来调用axis but服务，这很容易，但与安全性有关。我有下面的安全标头，它不正确，而且我知道这是由于用户名令牌的缘故，因为我得到了异常: org.apache.ws.security.WSSecurityException:提供了一个无效的安全令牌(处理用户名令牌时发生了错误)。

这是来自soapui的工作请求

<wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <wsse:UsernameToken wsu:Id="UsernameToken-1"> <wsse:Username>tibco-admin</wsse:Username> <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">secret</wsse:Password> <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">d6zrRrsSdfulAUmTq6VFtQ==</wsse:Nonce> <wsu:Created>2014-01-07T15:55:58.816Z</wsu:Created> </wsse:UsernameToken> </wsse:Security>

--这是来自java:的请求失败了

<wsse:Security xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
 <wsse:UsernameToken wsu:Id="UsernameToken-2">
     <wsse:Username xsi:type="xsd:string" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">tibco-admin</wsse:Username>
     <wsse:Password EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText" xsi:type="xsd:string" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">secret</wsse:Password>
     <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xsi:type="xsd:string" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">XY7Kb6UcEhloWOlmcbDlGg==</wsse:Nonce>
     <wsse:Created xsi:type="xsd:string" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">2014-01-07T17:48:39Z</wsse:Created>
 </wsse:UsernameToken>

​

我的java代码是：

            //set header
            SOAPHeaderElement wsseSecurity =  new SOAPHeaderElement(new PrefixedQName("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd","Security", "wsse"));
            wsseSecurity.setMustUnderstand(true);
            wsseSecurity.setAttribute("xmlns:wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
            wsseSecurity.setActor(null);

            //set userNameToken
            SOAPElement userNameToken = wsseSecurity.addChildElement("UsernameToken", "wsse");
            userNameToken.setAttribute("wsu:Id", "UsernameToken-1");

            //set username
            SOAPElement userName = userNameToken.addChildElement("Username", "wsse");
            userName.setValue("tibco-admin");

            //set password
            SOAPElement password = userNameToken.addChildElement("Password", "wsse");
            password.setAttribute("EncodingType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText");
            password.setValue("secret");

            //set nonce
            SOAPElement nonce = userNameToken.addChildElement("Nonce", "wsse");
            nonce.setValue("XY7Kb6UcEhloWOlmcbDlGg==");
            nonce.setAttribute("EncodingType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary");

            //set created
            Calendar c = Calendar.getInstance();
            c.setTime(new Date());
    String timestamp = DatatypeConverter.printDateTime(c);
    timestamp = timestamp.substring(0, 19);
    timestamp = timestamp+"Z";
            SOAPElement created = userNameToken.addChildElement("Created", "wsse");
            created.setValue(timestamp);

            stub.setHeader(wsseSecurity);

            System.out.println(wsseSecurity);
    stub.setUsername("tibco-admin");
    stub.setPassword("secret");

我硬编码了nonce的值以供测试。

任何帮助或指示都将不胜感激。

Answer 1

我发现了问题，我在代码中做了一个愚蠢的错误，

我将以下属性名设置为失败的EncodingType。它应该是：

password.setAttribute("Type", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText");

Answer 2

错误在密码中，

试着

"password.setAttribute("Type"，"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText")；password.setValue(“秘密”)；

Answer 3

SOAPElement创建=userNameToken.addChildElement(“创建”、"wsu“、"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")；