JAX-WS使用Handler实现简单的WebService权限验证

　　WebService如果涉及到安全保密或者使用权限的时候，WS-Security通常是最优选择。WS-Security (Web服务安全)
包含了关于如何在WebService消息上保证完整性和机密性的规约，如何将签名和加密头加入SOAP消息。
不过WS-Security也有一些性能上的损耗，在信息保密要求不是很高的情况下，可以通过在SOAPHeader中添加简单的校验信息实现。
具体思路是客户端调用需要认证的服务时，在SOAPHeader中添加授权信息（如用户名、密码或者序列号等）。
服务端收到请求，在SOAPHeader中校验授权信息，校验通过则执行请求，校验不通过则返回错误提示。

客户端发起请求在SOAPHeader中添加的授权数据格式如下

<auth xmlns="http://schemas.xmlsoap.org/soap/actor/next">
    <username>admin</username>
    <password>admin</password>
</auth>

服务端

服务端授权校验 Handler

import java.util.Iterator;
import java.util.Set;

import javax.xml.namespace.QName;
import javax.xml.soap.SOAPBody;
import javax.xml.soap.SOAPConstants;
import javax.xml.soap.SOAPElement;
import javax.xml.soap.SOAPEnvelope;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPFault;
import javax.xml.soap.SOAPHeader;
import javax.xml.soap.SOAPMessage;
import javax.xml.ws.handler.MessageContext;
import javax.xml.ws.handler.soap.SOAPHandler;
import javax.xml.ws.handler.soap.SOAPMessageContext;

import org.apache.cxf.interceptor.Fault;
import org.w3c.dom.NodeList;

/**
 *
 * @author
 */
public class JaxServerAuthValidateHeader implements SOAPHandler<SOAPMessageContext> {

    @Override
    public void close(MessageContext context) {
    }

    @Override
    public boolean handleFault(SOAPMessageContext context) {
        return true;
    }

    @Override
    public boolean handleMessage(SOAPMessageContext context) {

        // 判断消息是输入还是输出
        boolean isRequest = (Boolean) context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);
        SOAPMessage soapMessage = context.getMessage();

        if (!isRequest) {

            SOAPHeader soapHeader = null;

            try {
                SOAPEnvelope soapEnv = soapMessage.getSOAPPart().getEnvelope();
                soapHeader = soapEnv.getHeader();
            } catch (SOAPException e) {
                throw new Fault(new Exception("服务器异常！"));
            }

            if (soapHeader == null) {
                validateFail(soapMessage, "无   Soap Header 头信息！");
                return false;
            }

            // add an node named "auth"
            QName qname = new QName(SOAPConstants.URI_SOAP_ACTOR_NEXT, "auth");
            Iterator<?> iterator = soapHeader.getChildElements(qname);
            SOAPElement auth = null;
            if (iterator.hasNext()) {
                // 获取auth
                auth = (SOAPElement) iterator.next();
            }

            // 如果授权信息元素不存在，提示错误
            if (auth == null) {
                validateFail(soapMessage, "无授权信息！");
                return false;
            }

            NodeList nameList = auth.getElementsByTagName("username");
            NodeList pwdList = auth.getElementsByTagName("password");
            if (nameList == null || nameList.getLength() <= 0 || pwdList == null || pwdList.getLength() <= 0) {
                validateFail(soapMessage, "授权信息格式错误！");
                return false;
            }

            String username = nameList.item(0).getTextContent();
            String password = pwdList.item(0).getTextContent();
            if (!"admin".equals(username) || !"admin".equals(password)) {
                validateFail(soapMessage, "授权信息格式错误！");
                return false;
            }

        }

        System.out.println(isRequest ? "服务端响应：" : "服务端接收：");
        System.out.println("\r\n");

        return true;

    }

    @Override
    public Set<QName> getHeaders() {
        return null;
    }

    /**
     * 授权校验失败，在SOAPBody中添加SOAPFault
     *
     * @param message
     */
    private void validateFail(SOAPMessage soapMessage, String faultString) {
        try {

            SOAPEnvelope envelop = soapMessage.getSOAPPart().getEnvelope();

            envelop.getHeader().detachNode();
            envelop.addHeader();

            envelop.getBody().detachNode();
            SOAPBody body = envelop.addBody();

            SOAPFault fault = body.getFault();

            if (fault == null) {
                fault = body.addFault();
            }

            fault.setFaultString(faultString);

            soapMessage.saveChanges();

        } catch (SOAPException e) {
            e.printStackTrace();
        }
    }

}

服务端Handler配置文件handler-chain.xml 

<?xml version="1.0" encoding="UTF-8"?>
<javaee:handler-chains xmlns:javaee="http://java.sun.com/xml/ns/javaee"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <javaee:handler-chain>
        <javaee:handler>
            <javaee:handler-class>com.server.handler.JaxServerAuthValidateHeader</javaee:handler-class>
        </javaee:handler>
    </javaee:handler-chain>
</javaee:handler-chains>  

服务端的Service中添加Handler配置文件

import javax.jws.WebMethod;
import javax.jws.WebParam;
import javax.jws.WebResult;
import javax.jws.WebService;
import javax.xml.bind.annotation.XmlSeeAlso;
import javax.xml.ws.RequestWrapper;
import javax.xml.ws.ResponseWrapper;

/**
 * This class was generated by Apache CXF 3.2.1
 * 2017-12-01T14:12:00.085+08:00
 * Generated source version: 3.2.1
 *
 */
@WebService(targetNamespace = "http://tempuri.org/", name = "AExampleDemoWebService")
@HandlerChain(file="handler-chain.xml")
public interface AExampleDemoWebService {

    @WebMethod
    @WebResult(name = "single", targetNamespace = "")
    public java.lang.String querySingle(
        @WebParam(name = "single", targetNamespace = "http://tempuri.org/")
        java.lang.String single
    );

}

服务端的Service 实现类

import java.util.ArrayList;
import java.util.List;

import cn.evun.iwm.receive.soap.service.AExampleDemoWebService;
import cn.evun.iwm.receive.soap.struc.sample.InputParam;
import cn.evun.iwm.receive.soap.struc.sample.OutputParam;

@javax.jws.WebService(serviceName = "aexampleDemoWebService", portName = "Sample",
    targetNamespace = "http://tempuri.org/", endpointInterface = "cn.soap.service.AExampleDemoWebService")
public class AExampleDemoWebServiceImpl implements AExampleDemoWebService {

    @Override
    public String querySingle(String input) {
        return "success";
    }

}

客户端

客户端添加授权Handler

import java.io.IOException;
import java.util.Set;

import javax.xml.namespace.QName;
import javax.xml.soap.SOAPConstants;
import javax.xml.soap.SOAPElement;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPHeader;
import javax.xml.soap.SOAPMessage;
import javax.xml.ws.handler.MessageContext;
import javax.xml.ws.handler.soap.SOAPHandler;
import javax.xml.ws.handler.soap.SOAPMessageContext;

public class JaxWsClientHandler implements SOAPHandler<SOAPMessageContext> {

    @Override
    public boolean handleMessage(SOAPMessageContext context) {

        // 判断消息是请求还是响应
        Boolean isRequest = (Boolean) context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);
        SOAPMessage soapMessage = context.getMessage();

        if (isRequest) {

            try {

                SOAPHeader soapHeader = soapMessage.getSOAPHeader();
                if (soapHeader == null) {
                    soapHeader = soapMessage.getSOAPPart().getEnvelope().addHeader();
                }  

                // add an node named "auth"
                QName qname = new QName(SOAPConstants.URI_SOAP_ACTOR_NEXT, "auth");
                SOAPElement auth = soapHeader.addChildElement(qname);

                SOAPElement name = auth.addChildElement("username");
                name.addTextNode("admin");

                SOAPElement password = auth.addChildElement("password");
                password.addTextNode("admin");

                soapMessage.saveChanges();

                // tracking
                soapMessage.writeTo(System.out);

            } catch (SOAPException e) {
                System.err.println(e);
            } catch (IOException e) {
                System.err.println(e);
            }

        }

        return true;

    }

    @Override
    public boolean handleFault(SOAPMessageContext context) {
        return false;
    }

    @Override
    public void close(MessageContext context) {

    }

    @Override
    public Set<QName> getHeaders() {
        return null;
    }

}

客户端Handler配置文件handler-chain.xml

<?xml version="1.0" encoding="UTF-8"?>
<javaee:handler-chains xmlns:javaee="http://java.sun.com/xml/ns/javaee"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <javaee:handler-chain>
        <javaee:handler>
            <javaee:handler-class>com.client.handler.JaxWsClientHandler</javaee:handler-class>
        </javaee:handler>
    </javaee:handler-chain>
</javaee:handler-chains>  

客户端的Service中添加Handler配置文件

import java.net.MalformedURLException;
import java.net.URL;
import javax.xml.namespace.QName;
import javax.xml.ws.WebEndpoint;
import javax.xml.ws.WebServiceClient;
import javax.xml.ws.WebServiceFeature;

import javax.xml.ws.Service;

/**
 * This class was generated by Apache CXF 3.2.1
 * 2017-12-01T14:12:00.117+08:00
 * Generated source version: 3.2.1
 *
 */
@WebServiceClient(name = "aexampleDemoWebService",
                  wsdlLocation = "http://localhost:8090/service/Sample?wsdl",
                  targetNamespace = "http://tempuri.org/")
@HandlerChain(file="handler-chain.xml")
public class AexampleDemoWebServiceSoap extends Service {

    public final static URL WSDL_LOCATION;

    public final static QName SERVICE = new QName("http://tempuri.org/", "aexampleDemoWebService");
    public final static QName Sample = new QName("http://tempuri.org/", "Sample");
    static {
        URL url = null;
        try {
            url = new URL("http://localhost:8090/service/Sample?wsdl");
        } catch (MalformedURLException e) {
            java.util.logging.Logger.getLogger(AexampleDemoWebServiceSoap.class.getName())
                .log(java.util.logging.Level.INFO,
                     "Can not initialize the default wsdl from {0}", "http://localhost:8090/service/Sample?wsdl");
        }
        WSDL_LOCATION = url;
    }

    public AexampleDemoWebServiceSoap(URL wsdlLocation) {
        super(wsdlLocation, SERVICE);
    }

    public AexampleDemoWebServiceSoap(URL wsdlLocation, QName serviceName) {
        super(wsdlLocation, serviceName);
    }

    public AexampleDemoWebServiceSoap() {
        super(WSDL_LOCATION, SERVICE);
    }

    public AexampleDemoWebServiceSoap(WebServiceFeature ... features) {
        super(WSDL_LOCATION, SERVICE, features);
    }

    public AexampleDemoWebServiceSoap(URL wsdlLocation, WebServiceFeature ... features) {
        super(wsdlLocation, SERVICE, features);
    }

    public AexampleDemoWebServiceSoap(URL wsdlLocation, QName serviceName, WebServiceFeature ... features) {
        super(wsdlLocation, serviceName, features);
    }    

    /**
     *
     * @return
     *     returns AExampleDemoWebService
     */
    @WebEndpoint(name = "Sample")
    public AExampleDemoWebService getSample() {
        return super.getPort(Sample, AExampleDemoWebService.class);
    }

    /**
     *
     * @param features
     *     A list of {@link javax.xml.ws.WebServiceFeature} to configure on the proxy.  
　　　*　　　Supported features not in the <code>features</code> parameter will have their default values.
     * @return
     *     returns AExampleDemoWebService
     */
    @WebEndpoint(name = "Sample")
    public AExampleDemoWebService getSample(WebServiceFeature... features) {
        return super.getPort(Sample, AExampleDemoWebService.class, features);
    }

}

客户端发起请求

QName SERVICE_NAME = new QName("http://tempuri.org/", "aexampleDemoWebService");
URL url = new URL("http://localhost:8090/service/Sample?wsdl");
AexampleDemoWebServiceSoap ss = new AexampleDemoWebServiceSoap(wsdlURL, SERVICE_NAME);
AExampleDemoWebService port = ss.getSample();
port.querySingle("1111");

@HandlerChain 注解 替代方式

　　客户端  通过 HandlerReolver 代替 @HandlerChain 注解 导入 Handler 配置文件

　　handler-chain配置文件对所有的请求都添加授权验证信息，有些时候不是所有的请求都需要添加授权验证，HandlerResolver提供了在编程时添加Handler的方法，可以用HandlerResolver给需要授权的接口添加Handler。

QName SERVICE_NAME = new QName("http://tempuri.org/", "aexampleDemoWebService");
URL url = new URL("http://localhost:8090/service/Sample?wsdl");
AexampleDemoWebServiceSoap ss = new AexampleDemoWebServiceSoap(wsdlURL, SERVICE_NAME);
//通过HandlerResolver添加Handler
ss.setHandlerResolver(new HandlerResolver(){  

    @Override
    @SuppressWarnings("rawtypes")
    public List<Handler> getHandlerChain(PortInfo portInfo) {
        List<Handler> handlerChain = new ArrayList<Handler>();
        handlerChain.add(new JaxWsClientHandler());
        return handlerChain;
    }  

});
AExampleDemoWebService port = ss.getSample();
port.querySingle("2222");

服务端 @HandlerChain 注解替代 

　　服务发布时服务端通过继承至 Endpoint 实现类 EndpointImpl 的 setHandlers 方法添加头部信息 代替 @HandlerChain 注解 导入 Handler 配置文件

import java.util.ArrayList;
import java.util.List;

import javax.xml.ws.Endpoint;
import javax.xml.ws.handler.Handler;

import org.apache.cxf.Bus;
import org.apache.cxf.bus.spring.SpringBus;
import org.apache.cxf.interceptor.Interceptor;
import org.apache.cxf.jaxws.EndpointImpl;
import org.apache.cxf.message.Message;
import org.apache.cxf.transport.servlet.CXFServlet;
import org.springframework.boot.context.embedded.ServletRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class CXFConfig {

    @Bean
    public ServletRegistrationBean dispatcherServlet() {
        return new ServletRegistrationBean(new CXFServlet(), "/service/*");
    }

    @Bean(name = Bus.DEFAULT_BUS_ID)
    public SpringBus springBus() {
        return new SpringBus();
    }

    @Bean
    public AExampleDemoWebServiceImpl aExampleDemoWebServiceImpl() {
        return new AExampleDemoWebServiceImpl();
    }

    @Bean
    public Endpoint endpointWebServiceSampleImpl() {

        EndpointImpl endpoint = new EndpointImpl(springBus(), aExampleDemoWebServiceImpl());

        // SOAPHandler 方式
        @SuppressWarnings("rawtypes")
        List<Handler> handlers = new ArrayList<>();
        handlers.add(new JaxServerAuthValidateHeader());
        endpoint.setHandlers(handlers);

        endpoint.publish("/Sample");

        return endpoint;

    }

}

当使用替代方式添加头部信息的时候就不需要使用 @HandlerChain 注解