您可以配置用戶端憑證鑑別,供用戶端應用程式存取 Web 服務。
開始之前
在啟用用戶端憑證鑑別來存取 Web 服務之前,您必須先完成下列必要條件:
- 產生提供者的一組自簽公開和私密金鑰。
keytool -genkey -alias default -keystore serverKey.jks -dname "CN=myServer, O=IBM, C=CN" -storepass passw0rd -keypass passw0rd -storetype jks -validity 1000 -keyalg RSA
- 匯出預設的憑證,將憑證匯入信任儲存庫中。
keytool -export -alias default -file myserver.cer -keystore serverKey.jks -storepass passw0rd -storetype jks
keytool -import -file myserver.cer -alias default -keystore clientTrust.jks -storepass passw0rd -keypass passw0rd -storetype jks
- 產生用戶端的兩組自簽公開和私密金鑰。
keytool -genkey -alias user0 -keystore clientKey.jks -dname "CN=employee0, O=IBM, C=CN" -storepass passw0rd -keypass passw0rd -storetype jks -validity 1000 -keyalg RSA
keytool -genkey -alias admin0 -keystore clientKey.jks -dname "CN=manager0, O=IBM, C=CN" -storepass passw0rd -keypass passw0rd -storetype jks -validity 1000 -keyalg RSA
- 匯出兩個別名的憑證,將憑證匯入信任儲存庫中。
keytool -export -alias user0 -file user0.cer -keystore clientKey.jks -storepass passw0rd -storetype jks
keytool -export -alias admin0 -file admin0.cer -keystore clientKey.jks -storepass passw0rd -storetype jks
keytool -import -file user0.cer -alias user0 -keystore serverTrust.jks -storepass passw0rd -keypass passw0rd -storetype jks
keytool -import -file admin0.cer -alias admin0 -keystore serverTrust.jks -storepass passw0rd -keypass passw0rd -storetype jks
- 將 serverKey.jks、serverTrust.jks、clientKey.jks 和 clientTrust.jks 檔複製到 ${server.config.dir}/resources/security 目錄中。
註: 您可以在 Java™ 安裝目錄中找到 keytool 公用程式。
關於這項作業
如果您需要使用具有「用戶端憑證鑑別」的 Web 服務用戶端應用程式,來存取受保護的 Web 服務資源,用戶端必須在要求中提供有效憑證,且必須利用 HTTPS 與服務提供者通訊。
程序
- 在 server.xml 檔中啟用 jaxws-2.2、servlet-3.0(或 servlet-3.1)和 appSecurity-2.0 特性。
<featureManager>
<feature>jaxws-2.2</feature>
<feature>servlet-3.0</feature>
<feature>appSecurity-2.0</feature>
</featureManager>
- 在 server.xml 檔中,配置 SSL 元素及用戶端自訂的 SSL 元素。
<!-- Server SSL configuration -->
<ssl id="defaultSSLConfig" keyStoreRef="serverKeyStore" trustStoreRef="serverTrustStore"
clientAuthenticationSupported="true"/>
<keyStore id="serverKeyStore" location="serverKey.jks" type="JKS" password="passw0rd" />
<keyStore id="serverTrustStore" location="serverTrust.jks" type="JKS" password="passw0rd" />
<!-- customize SSL configuration -->
<ssl id="customizeSSLConfig" keyStoreRef="clientKeyStore" trustStoreRef="clientTrustStore" />
<keyStore id="clientKeyStore" location="clientKey.jks" type="JKS" password="passw0rd" />
<keyStore id="clientTrustStore" location="clientTrust.jks" type="JKS" password="passw0rd" />
- 在 server.xml 檔中配置登入網域範圍,將網域範圍連結至服務提供者。
<application id="TransportSecurityProvider" name="TransportSecurityProvider"
location="TransportSecurityProvider.war" type="ear">
<application-bnd>
<security-role name="Employee">
<user name="employee0" />
<group name="employeeGroup" />
</security-role>
<security-role name="Manager">
<user name="manager0" />
</security-role>
<security-role name="AllAuthenticated">
<special-subject type="ALL_AUTHENTICATED_USERS" />
</security-role>
</application-bnd>
</application>
<basicRegistry id="basic" realm="BasicRealm">
<user name="employee0" password="emp0pwd" />
<user name="employee1" password="emp1pwd" />
<user name="manager0" password="mgr0pwd" />
<group name="employeeGroup">
<member name="employee0" />
<member name="employee1" />
</group>
</basicRegistry>
- 配置服務提供者。
- 建立 Web 服務。
@WebService(serviceName = "SayHelloPojoService",
portName = "SayHelloPojoPort")
public class SayHelloPojoService implements SayHelloService {
...
}
@WebService(serviceName = "SayHelloStatelessService",
portName = "SayHelloStatelessPort",
endpointInterface = "com.ibm.ws.jaxws.transport.server.security.SayHelloService")
@Stateless(name = "SayHelloSessionBean")
public class SayHelloStatelessService implements SayHelloLocal {
...
}
- 配置服務提供者的 ibm-ws-bnd.xml 檔。
<?xml version="1.0" encoding="UTF-8"?>
<webservices-bnd xmlns="http://websphere.ibm.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-ws-bnd_1_0.xsd "
version="1.0">
<http-publishing>
<webservice-security>
<security-constraint>
<web-resource-collection>
<web-resource-name>Only Managers</web-resource-name>
<url-pattern>/manager/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint id="AuthConstraint_manager">
<role-name>Manager</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Employees</web-resource-name>
<url-pattern>/employee/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint id="AuthConstraint_employee">
<role-name>Employee</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- SECURITY ROLES -->
<security-role id="Staff">
<role-name>Employee</role-name>
<role-name>Manager</role-name>
</security-role>
<!-- AUTHENTICATION METHOD: client-cert authentication -->
<!-- login configuration -->
<login-config id="LoginConfig">
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Authentication</realm-name>
</login-config>
</webservice-security>
</http-publishing>
</webservices-bnd>
註: - ibm-ws-bnd.xml 檔必須在 Web 應用程式的 /WEB-INF 目錄中,或在 EJB 型 Web 服務應用程式(JAR 保存檔)的 /META-INF 目錄中。
- ibm-ws-bnd.xml 檔中的 login-config 元素只在 EJB 型 Web 服務應用程式(JAR 保存檔)中才有效。
對於 Web 應用程式,系統不會處理 login-config 元素,會使用 web.xml 檔中相同元素的值。
.
- 指定 Web 服務端點來配置服務用戶端。
例如,用戶端應用程式是一個名稱為 TransportSecurityClient.war 的 Web 應用程式。
- 在 server.xml 檔中配置用戶端應用程式。
<application id="TransportSecurityClient" name="TransportSecurityClient"
location="TransportSecurityClient.war"
context-root="TransportSecurityClient" type="war" />
- 配置用戶端應用程式的 ibm-ws-bnd.xml 檔。
<?xml version="1.0" encoding="UTF-8"?>
<webservices-bnd xmlns="http://websphere.ibm.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-ws-bnd_1_0.xsd "
version="1.0">
<!-- POJO service reference binding-->
<service-ref name="service/SayHelloPojoService">
<port name="SayHelloPojoPort"
namespace="http://ibm.com/ws/jaxws/transport/security/"
ssl-ref="customizeSSLConfig"
key-alias="user0"/>
<properties http.conduit.tlsClientParameters.disableCNCheck="true" />
</service-ref>
<!-- Stateless service reference binding-->
<service-ref name="service/SayHelloStatelessService">
<port name="SayHelloStatelessPort"
namespace="http://ibm.com/ws/jaxws/transport/security/"
ssl-ref="customizeSSLConfig"
key-alias="user0"/>
<properties http.conduit.tlsClientParameters.disableCNCheck="true" />
</service-ref>
</webservices-bnd>
- 透過 WSDL 位置來產生用戶端 Stub。
@WebServiceClient(name = "SayHelloPojoService",
targetNamespace = "http://ibm.com/ws/jaxws/transport/security/",
wsdlLocation = "https://localhost:8020/TransportSecurityProvider/unauthorized/employPojoService?wsdl")
public class SayHelloPojoService
extends Service
{...}
@WebServiceClient(name = "SayHelloStatelessService",
targetNamespace = "http://ibm.com/ws/jaxws/transport/security/",
wsdlLocation = "https://localhost:8020/TransportSecurityProvider/unauthorized/EmployStatelessService?wsdl")
public class SayHelloStatelessService
extends Service
{...}
- 利用 @WebServiceRef 註釋,將 Web 服務注入 Servlet 中。
例如,TestJaxWsTransportSecurityServlet。
@WebServiceRef(name = "service/SayHelloPojoService")
SayHelloPojoService pojoService;
@WebServiceRef(name = "service/SayHelloStatelessService")
SayHelloStatelessService statelessService;