可以配置客户机证书认证以便客户机应用程序访问 Web Service。
开始之前
在启用客户机证书认证以访问 Web Service 之前,您必须满足下列先决条件:
- 为提供者生成一对自签名的公用密钥和专用密钥。
keytool -genkey -alias default -keystore serverKey.jks -dname "CN=myServer, O=IBM, C=CN"
-storepass passw0rd -keypass passw0rd -storetype jks -validity 1000 -keyalg RSA
- 导出缺省证书,并将该证书导入到信任库。
keytool -export -alias default -file myserver.cer -keystore serverKey.jks
-storepass passw0rd -storetype jks
keytool -import -file myserver.cer -alias default -keystore clientTrust.jks
-storepass passw0rd -keypass passw0rd -storetype jks
- 为客户机生成两对自签名的公用密钥和专用密钥。
keytool -genkey -alias user0 -keystore clientKey.jks -dname "CN=employee0, O=IBM, C=CN"
-storepass passw0rd -keypass passw0rd -storetype jks -validity 1000 -keyalg RSA
keytool -genkey -alias admin0 -keystore clientKey.jks -dname "CN=manager0, O=IBM, C=CN"
-storepass passw0rd -keypass passw0rd -storetype jks -validity 1000 -keyalg RSA
- 导出两个别名的证书,然后将证书导入到信任库。
keytool -export -alias user0 -file user0.cer -keystore clientKey.jks -storepass passw0rd -storetype jks
keytool -export -alias admin0 -file admin0.cer -keystore clientKey.jks -storepass passw0rd -storetype jks
keytool -import -file user0.cer -alias user0 -keystore serverTrust.jks -storepass passw0rd -keypass passw0rd -storetype jks
keytool -import -file admin0.cer -alias admin0 -keystore serverTrust.jks -storepass passw0rd -keypass passw0rd -storetype jks
- 将 serverKey.jks、serverTrust.jks、clientKey.jks 和 clientTrust.jks 文件复制到 ${server.config.dir}/resources/security 目录中。
注: 可以在 Java™ 安装目录中找到 keytool 实用程序。
关于此任务
如果您需要将 Web Service 客户机应用程序与客户机证书认证一起使用,以访问受保护的 Web Service 资源,那么客户机必须在请求中提供有效证书,并且必须使用 HTTPS 与服务提供者进行通信。
过程
- 在 server.xml 文件中启用
jaxws-2.2、servlet-3.0(或 servlet-3.1)和 appSecurity-2.0 功能部件。
<featureManager>
<feature>jaxws-2.2</feature>
<feature>servlet-3.0</feature>
<feature>appSecurity-2.0</feature>
</featureManager>
- 在 server.xml 文件中配置 SSL 元素以及由客户机定制的 SSL 元素。
<!-- Server SSL configuration -->
<ssl id="defaultSSLConfig" keyStoreRef="serverKeyStore" trustStoreRef="serverTrustStore"
clientAuthenticationSupported="true"/>
<keyStore id="serverKeyStore" location="serverKey.jks" type="JKS" password="passw0rd" />
<keyStore id="serverTrustStore" location="serverTrust.jks" type="JKS" password="passw0rd" />
<!-- customize SSL configuration -->
<ssl id="customizeSSLConfig" keyStoreRef="clientKeyStore" trustStoreRef="clientTrustStore" />
<keyStore id="clientKeyStore" location="clientKey.jks" type="JKS" password="passw0rd" />
<keyStore id="clientTrustStore" location="clientTrust.jks" type="JKS" password="passw0rd" />
- 在 server.xml 文件中配置登录域,并将此域绑定至服务提供者。
<application id="TransportSecurityProvider" name="TransportSecurityProvider"
location="TransportSecurityProvider.war" type="ear">
<application-bnd>
<security-role name="Employee">
<user name="employee0" />
<group name="employeeGroup" />
</security-role>
<security-role name="Manager">
<user name="manager0" />
</security-role>
<security-role name="AllAuthenticated">
<special-subject type="ALL_AUTHENTICATED_USERS" />
</security-role>
</application-bnd>
</application>
<basicRegistry id="basic" realm="BasicRealm">
<user name="employee0" password="emp0pwd" />
<user name="employee1" password="emp1pwd" />
<user name="manager0" password="mgr0pwd" />
<group name="employeeGroup">
<member name="employee0" />
<member name="employee1" />
</group>
</basicRegistry>
- 配置服务提供程序。
- 创建 Web Service。
@WebService(serviceName = "SayHelloPojoService",
portName = "SayHelloPojoPort")
public class SayHelloPojoService implements SayHelloService {
...
}
@WebService(serviceName = "SayHelloStatelessService",
portName = "SayHelloStatelessPort",
endpointInterface = "com.ibm.ws.jaxws.transport.server.security.SayHelloService")
@Stateless(name = "SayHelloSessionBean")
public class SayHelloStatelessService implements SayHelloLocal {
...
}
- 为服务提供者配置 ibm-ws-bnd.xml 文件。
<?xml version="1.0" encoding="UTF-8"?>
<webservices-bnd xmlns="http://websphere.ibm.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-ws-bnd_1_0.xsd"
version="1.0">
<http-publishing>
<webservice-security>
<security-constraint>
<web-resource-collection>
<web-resource-name>Only Managers</web-resource-name>
<url-pattern>/manager/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint id="AuthConstraint_manager">
<role-name>Manager</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Employees</web-resource-name>
<url-pattern>/employee/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint id="AuthConstraint_employee">
<role-name>Employee</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- SECURITY ROLES -->
<security-role id="Staff">
<role-name>Employee</role-name>
<role-name>Manager</role-name>
</security-role>
<!-- AUTHENTICATION METHOD: client-cert authentication -->
<!-- login configuration -->
<login-config id="LoginConfig">
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Authentication</realm-name>
</login-config> </webservice-security>
</http-publishing>
</webservices-bnd>
注: - ibm-ws-bnd.xml 文件必须位于 Web 应用程序的 /WEB-INF 目录中,或者位于基于 EJB 的 Web Service 应用程序(JAR 归档)的 /META-INF 目录中。
- ibm-ws-bnd.xml 文件中的 login-config 元素仅在基于 EJB 的 Web Service 应用程序(JAR 归档)中生效。对于 Web 应用程序,将忽略 login-config 元素,将使用 web.xml 文件中的同一元素的值。
.
- 通过指定 Web Service 端点来配置服务客户机。例如,客户机应用程序是一个名为 TransportSecurityClient.war 的 Web 应用程序。
- 在 server.xml 文件中配置客户机应用程序。
<application id="TransportSecurityClient" name="TransportSecurityClient"
location="TransportSecurityClient.war"
context="TransportSecurityClient" type="war" />
- 配置客户机应用程序的 ibm-ws-bnd.xml 文件。
<?xml version="1.0" encoding="UTF-8"?>
<webservices-bnd xmlns="http://websphere.ibm.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-ws-bnd_1_0.xsd"
version="1.0">
<!-- POJO service reference binding-->
<service-ref name="service/SayHelloPojoService">
<port name="SayHelloPojoPort"
namespace="http://ibm.com/ws/jaxws/transport/security/"
ssl-ref="customizeSSLConfig"
key-alias="user0"/>
<properties http.conduit.tlsClientParameters.disableCNCheck="true" />
</service-ref>
<!-- Stateless service reference binding-->
<service-ref name="service/SayHelloStatelessService">
<port name="SayHelloStatelessPort"
namespace="http://ibm.com/ws/jaxws/transport/security/"
ssl-ref="customizeSSLConfig"
key-alias="user0"/>
<properties http.conduit.tlsClientParameters.disableCNCheck="true" />
</service-ref>
</webservices-bnd>
- 通过 WSDL 位置来生成客户机存根。
@WebServiceClient(name = "SayHelloPojoService",
targetNamespace = "http://ibm.com/ws/jaxws/transport/security/",
wsdlLocation = "https://localhost:8020/TransportSecurityProvider/unauthorized/employPojoService?wsdl")
public class SayHelloPojoService
extends Service
{...}
@WebServiceClient(name = "SayHelloStatelessService",
targetNamespace = "http://ibm.com/ws/jaxws/transport/security/",
wsdlLocation = "https://localhost:8020/TransportSecurityProvider/unauthorized/EmployStatelessService?wsdl")
public class SayHelloStatelessService
extends Service
{...}
- 使用 @WebServiceRef 注释将 Web Service 插入到 Servlet。例如,TestJaxWsTransportSecurityServlet。
@WebServiceRef(name = "service/SayHelloPojoService")
SayHelloPojoService pojoService;
@WebServiceRef(name = "service/SayHelloStatelessService")
SayHelloStatelessService statelessService;