WS-Security 정책을 사용하여 웹 서비스 보안 설정

IBM® WebSphere® Application Server Liberty에서 WS-Security 정책을 사용하여 XML 웹 서비스(JAX-WS) 웹 서비스에 대한 Java™ API를 개발하고 보안 설정할 수 있습니다. Liberty에서 웹 서비스 개발 및 보안 설정에 포함되는 일반 단계를 설명하기 위해 예제가 학습서로 제공됩니다. 프로덕션 환경에서는 예제를 사용하지 마십시오. 웹 서비스 애플리케이션을 보호하기 위해 WSDL(Web Services Description Language) 계약과 WS-Security 정책을 개발하기 위해 사용자 고유 보안 요구사항을 검토하십시오.

이 태스크 정보

이 태스크는 WS-Security 정책을 사용하여 단순한 JAX-WS 웹 서비스 애플리케이션을 개발하고 애플리케이션의 보안을 설정하는 방법을 설명합니다.

이 태스크는 두 개의 키 저장소(enc-sender.jceksenc-receiver.jceks)를 사용합니다. 이러한 키 저장소는 WebSphere Application Server Traditional에서 제공되는 WS-Security 샘플 키 저장소입니다. 일반적인 설치에 대한 액세스 권한이 있는 경우에는 다음 디렉토리 중 하나에서 샘플 키 저장소를 얻을 수 있습니다.

profile_root/etc/ws-security/samples

WASHOME/profileTemplates/defaultdocuments/etc/ws-security/samples

프로시저

  1. WSDL 계약 및 WS-Security 정책을 작성하십시오. 이 샘플에서 JAX-WS 웹 서비스 제공자 애플리케이션에 대한 WS-Security 정책과의 WSDL 계약이 작성됩니다. X509Token 비대칭 메시지 보호(상호 인증)가 있는 UsernameToken이라는 WS-Security 정책 템플리트가 사용됩니다. 클라이언트가 SOAP 본문에 서명하고 암호화하며 요청 메시지의 UsernameToken에 서명하고 암호화합니다. 응답 메시지에서 제공자는 SOAP 본문에 서명하고 암호화합니다. 이 예제에서 보안 제한조건에 대한 완전한 설명은 X509Token 비대칭 메시지 보호(상호 인증)가 있는 UsernameToken을 참조하십시오.
    1. 서비스를 위한 WSDL 계약을 작성하십시오. 다음 예제에서는 샘플 WSDL 계약을 보여줍니다.
      <?xml version="1.0" encoding="UTF-8"?>
      <wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
                        xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
                        xmlns:tns="http://com/ibm/was/wssample/sei/echo/"
                        xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="WSSampleSei"
                        targetNamespace="http://com/ibm/was/wssample/sei/echo/">
        <wsdl:types>
          <xsd:schema targetNamespace="http://com/ibm/was/wssample/sei/echo/"
                      xmlns:xsd="http://www.w3.org/2001/XMLSchema">
            <xsd:element name="echoStringResponse">
              <xsd:complexType>
                <xsd:sequence>
                  <xsd:element name="echoResponse" type="xsd:string" />
                </xsd:sequence>
              </xsd:complexType>
            </xsd:element>
            <xsd:element name="echoStringInput">
              <xsd:complexType>
                <xsd:sequence>
                  <xsd:element name="echoInput" type="xsd:string" />
                </xsd:sequence>
              </xsd:complexType>
            </xsd:element>
          </xsd:schema>
        </wsdl:types> 
        <wsdl:message name="echoOperationRequest">
          <wsdl:part element="tns:echoStringInput" name="parameter" />
        </wsdl:message>
        <wsdl:message name="echoOperationResponse">
          <wsdl:part element="tns:echoStringResponse" name="parameter" />
        </wsdl:message>
        <wsdl:portType name="EchoServicePortType">
          <wsdl:operation name="echoOperation">
            <wsdl:input message="tns:echoOperationRequest" />
            <wsdl:output message="tns:echoOperationResponse" />
          </wsdl:operation>
        </wsdl:portType>
        <wsdl:binding name="Echo1SOAP" type="tns:EchoServicePortType">
          <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http" />
          <wsdl:operation name="echoOperation">
            <soap:operation soapAction="echoOperation" style="document" />
            <wsdl:input>
              <soap:body use="literal" />
            </wsdl:input>
            <wsdl:output>
              <soap:body use="literal" />
            </wsdl:output>
          </wsdl:operation>
        </wsdl:binding> 
        <wsdl:service name="Echo1Service">
          <wsdl:port binding="tns:Echo1SOAP" name="Echo1ServicePort">
            <soap:address location="http://localhost:8010/WSSampleSei/Echo1Service" />
          </wsdl:port>
        </wsdl:service>
      </wsdl:definitions>
    2. 보안 정책을 지원하는 데 필요한 네임스페이스를 wsdl:definitions 요소로 WSDL에 추가하십시오. 다음 예제에서는 추가된 네임스페이스를 보여줍니다.
      xmlns:wsp="http://www.w3.org/ns/ws-policy"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
      xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"
      xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802"
      xmlns:wsaws="http://www.w3.org/2005/08/addressing"
    3. wsdl:binding 요소 바로 앞에서 WS-Security 정책 프레임을 WSDL에 추가하십시오. 이 예제에서 X509Token 비대칭 메시지 보호(상호 인증)가 있는 UsernameToken의 정책 템플리트가 사용됩니다.
    4. 보안 정책의 wsp:PolicyReference를 wsdl:binding element 요소에 추가하십시오. 다음 예제에서는 wsp:PolicyReference를 보여줍니다.
      <wsp:PolicyReference URI="#AsymmetricX509MutualAuthenticationWithUnt" />
    5. 최종 WSDL이 예제와 유사한지 확인하십시오. 다음 예제에서는 최종 WSDL을 보여줍니다.
      <?xml version="1.0" encoding="UTF-8"?>
      <wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
                        xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
                        xmlns:tns="http://com/ibm/was/wssample/sei/echo/"
                        xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="WSSampleSei"
                        xmlns:wsp="http://www.w3.org/ns/ws-policy"
                        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                        xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"
                        xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802"
                        xmlns:wsaws="http://www.w3.org/2005/08/addressing"
                        targetNamespace="http://com/ibm/was/wssample/sei/echo/">
        <wsdl:types>
          <xsd:schema targetNamespace="http://com/ibm/was/wssample/sei/echo/"
                      xmlns:xsd="http://www.w3.org/2001/XMLSchema">
            <xsd:element name="echoStringResponse">
              <xsd:complexType>
                <xsd:sequence>
                  <xsd:element name="echoResponse" type="xsd:string" />
                </xsd:sequence>
              </xsd:complexType>
            </xsd:element>
            <xsd:element name="echoStringInput">
              <xsd:complexType>
                <xsd:sequence>
                  <xsd:element name="echoInput" type="xsd:string" />
                </xsd:sequence>
              </xsd:complexType>
            </xsd:element>
          </xsd:schema>
        </wsdl:types> 
        <wsdl:message name="echoOperationRequest">
          <wsdl:part element="tns:echoStringInput" name="parameter" />
        </wsdl:message>
        <wsdl:message name="echoOperationResponse">
          <wsdl:part element="tns:echoStringResponse" name="parameter" />
        </wsdl:message>
        <wsdl:portType name="EchoServicePortType">
          <wsdl:operation name="echoOperation">
            <wsdl:input message="tns:echoOperationRequest" />
            <wsdl:output message="tns:echoOperationResponse" />
          </wsdl:operation>
        </wsdl:portType>
        <wsp:Policy wsu:Id="AsymmetricX509MutualAuthenticationWithUnt">
          <wsp:ExactlyOne>
            <wsp:All>
              <sp:SignedEncryptedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
                <wsp:Policy>
                  <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                    <wsp:Policy>
                      <sp:WssUsernameToken10 />
                    </wsp:Policy>
                  </sp:UsernameToken>
                </wsp:Policy>
              </sp:SignedEncryptedSupportingTokens>
              <sp:AsymmetricBinding>
                <wsp:Policy>
                  <sp:InitiatorToken>
                    <wsp:Policy>
                      <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                        <wsp:Policy>
                          <sp:WssX509V3Token10 />
                          <sp:RequireIssuerSerialReference />
                        </wsp:Policy>
                      </sp:X509Token>
                    </wsp:Policy>
                  </sp:InitiatorToken>
                  <sp:RecipientToken>
                    <wsp:Policy>
                      <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
                        <wsp:Policy>
                          <sp:WssX509V3Token10 />
                          <sp:RequireIssuerSerialReference />
                        </wsp:Policy>
                      </sp:X509Token>
                    </wsp:Policy>
                  </sp:RecipientToken>
                  <sp:Layout>
                    <wsp:Policy>
                      <sp:Strict />
                    </wsp:Policy>
                  </sp:Layout>
                  <sp:IncludeTimestamp />
                  <sp:OnlySignEntireHeadersAndBody />
                  <sp:EncryptSignature />
                  <sp:AlgorithmSuite>
                    <wsp:Policy>
                      <sp:Basic128 />
                    </wsp:Policy>
                  </sp:AlgorithmSuite>
                </wsp:Policy>
              </sp:AsymmetricBinding>
              <sp:Wss11>
                <wsp:Policy>
                  <sp:MustSupportRefKeyIdentifier />
                  <sp:MustSupportRefIssuerSerial />
                  <sp:MustSupportRefThumbprint />
                  <sp:MustSupportRefEncryptedKey />
                  <sp:RequireSignatureConfirmation />
                </wsp:Policy>
              </sp:Wss11>
              <sp:SignedParts>
                <sp:Body />
              </sp:SignedParts>
              <sp:EncryptedParts>
                <sp:Body />
              </sp:EncryptedParts>
            </wsp:All>
          </wsp:ExactlyOne>
        </wsp:Policy>
        <wsdl:binding name="Echo1SOAP" type="tns:EchoServicePortType">
          <wsp:PolicyReference URI="#AsymmetricX509MutualAuthenticationWithUnt" />
          <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http" />
          <wsdl:operation name="echoOperation">
            <soap:operation soapAction="echoOperation" style="document" />
            <wsdl:input>
              <soap:body use="literal" />
            </wsdl:input>
            <wsdl:output>
              <soap:body use="literal" />
            </wsdl:output>
          </wsdl:operation>
        </wsdl:binding> 
        <wsdl:service name="Echo1Service">
          <wsdl:port binding="tns:Echo1SOAP" name="Echo1ServicePort">
            <soap:address location="http://localhost:8010/WSSampleSei/Echo1Service" />
          </wsdl:port>
        </wsdl:service>
      </wsdl:definitions>
  2. WSDL을 사용하여 웹 서비스 애플리케이션을 작성하십시오. 이 단계는 WS-Security 정책을 WSDL에 추가하기 전후에 수행할 수 있습니다. 이전 절에서 개발된 WSDL로부터 JAX-WS 웹 서비스 애플리케이션을 작성하기 위해 지원되는 도구를 사용할 수 있습니다.
    다음 예는 RAD(Rational® Application Developer) 도구를 사용하여 WSDL에서 개발되는 웹 서비스 애플리케이션을 보여줍니다.
    @javax.jws.WebService (endpointInterface="com.ibm.was.wssample.sei.echo.EchoServicePortType",
                           targetNamespace="http://com/ibm/was/wssample/sei/echo/", 
                           serviceName="Echo1Service", 
                           wsdlLocation = "WEB-INF/wsdl/Echo.wsdl",
                           portName="Echo1ServicePort")
    public class Echo1SOAPImpl {
    
      public EchoStringResponse echoOperation(EchoStringInput parameter) {
        String strInput = (parameter == null ? "input_is_null" : parameter.getEchoInput() );
        try {
          com.ibm.was.wssample.sei.echo.EchoStringResponse strOutput = new EchoStringResponse();
          strOutput.setEchoResponse( "Echo1SOAPImpl>>" + strInput );
          return strOutput;
        } catch (java.lang.Exception ex) {
          ex.printStackTrace();
        }
      }
    
    @WebService (name = "EchoServicePortType", 
                 targetNamespace = "http://com/ibm/was/wssample/sei/echo/")
    @SOAPBinding (parameterStyle = SOAPBinding.ParameterStyle.BARE)
    @XmlSeeAlso ({
        ObjectFactory.class
    })
    
    public interface EchoServicePortType {
    
      @WebMethod (action = "echoOperation")
      @WebResult (name = "echoStringResponse", targetNamespace = "http://com/ibm/was/wssample/sei/echo/", partName = "parameter")
      public  EchoStringResponse echoOperation(
        @WebParam (name = "echoStringInput", targetNamespace = "http://com/ibm/was/wssample/sei/echo/", partName = "parameter")
        EchoStringInput parameter);
    
    }
    다음 코드에서는 웹 서비스 제공자 애플리케이션을 호출하는 관리 대상 웹 서비스 클라이언트를 보여줍니다.
    @WebServlet("ClientServlet")
    public class ClientServlet extends HttpServlet {
    
      @WebServiceRef (value=Echo1Service.class, wsdlLocation="Echo.wsdl")
      Echo1Service echo1Service;
    
      public  ClientServlet() {
        super();
      }
    
      protected void doGet(HttpServletRequest request,
                           HttpServletResponse response) throws ServletException, IOException {
        processRequest(request, response);
      } 
    
      protected void doPost(HttpServletRequest request,
                            HttpServletResponse response) throws ServletException, IOException {
        processRequest(request, response);
      }
    
      private void processRequest(HttpServletRequest req,
                                  HttpServletResponse resp) throws ServletException, IOException {
    
        String endpointURL = "http://localhost:8010/WSSampleSei/Echo1Service";
    
        Echo1ServicePortProxy proxy = new Echo1ServicePortProxy(echo1Service);
        proxy._getDescriptor().setEndpoint(endpointURL);
    
        echoParm = new ObjectFactory().createEchoStringInput();
        echoParm.setEchoInput("Hello");
    
        String retval = proxy.echoOperation(echoParm).getEchoResponse();
    
      }
    }
    다음 예제에서는 웹 서비스 제공자 애플리케이션 war 파일의 파일 구조를 보여줍니다.
    WEB-INF/web.xmlWEB-INF/wsdl/Echo.wsdl
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/Echo1SOAPImpl.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/EchoServicePortType.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/EchoStringInput.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/EchoStringResponse.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/ObjectFactory.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/package-info.class
    다음 예제에서는 웹 서비스 클라이언트 애플리케이션 war 파일의 파일 구조를 보여줍니다.
    WEB-INF/web.xmlWEB-INF/wsdl/Echo.wsdl
    WEB-INF/classes/com/ibm/was/wssample/client/ClientServlet.class
    WEB-INF/classes/com/ibm/was/wssample/client/SampleClient.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/Echo1Service.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/Echo1ServicePortProxy.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/EchoStringInput.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/EchoStringResponse.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/ObjectFactory.class
    WEB-INF/classes/com/ibm/was/wssample/sei/echo/package-info.class     
  3. 콜백 핸들러를 개발하십시오. 사용자 이름과 키 저장소 키 비밀번호를 검색하기 위해 콜백 핸들러를 개발해야 합니다. 사용자 이름 비밀번호는 UsernameTokens를 생성할 때 사용됩니다. 키 저장소 비밀번호는 키 저장소에서 개인 키에 액세스하기 위해 사용됩니다. 콜백 핸들러는 일반 텍스트 비밀번호를 리턴해야 하고 패키지되어 Liberty 사용자 기능으로 설치되어야 합니다.
    다음 샘플 코드는 콜백 핸들러를 보여줍니다.
    package com.ibm.ws.wssecurity.example.cbh;
    
    import java.util.HashMap;
    import java.util.Map;
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.CallbackHandler;
    import org.apache.ws.security.WSPasswordCallback;
    
    public class SamplePasswordCallback implements CallbackHandler {
      private Map<String, String> userPasswords = new HashMap<String, String>();
      private Map<String, String> keyPasswords = new HashMap<String, String>();
      public SamplePasswordCallback() {
        // some example user passwords
        userPasswords.put("user1", "user1pswd");
        userPasswords.put("admin", "adminpswd");
        // some example key passwords
        keyPasswords.put("alice", "keypwsd");
        keyPasswords.put("bob", "keypswd");
      }
      public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
        for (int i = 0; i < callbacks.length; i++) {
          WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
          String id = pwcb.getIdentifier();
          String pass = null;
          switch (pwcb.getUsage()) {
            case WSPasswordCallback.USERNAME_TOKEN_UNKNOWN:
            case WSPasswordCallback.USERNAME_TOKEN:
              pass = userPasswords.get(id);
              pwcb.setPassword(pass);
              break;                                                      
            case WSPasswordCallback.SIGNATURE:
            case WSPasswordCallback.DECRYPT:
              pass = keyPasswords.get(id);
              pwcb.setPassword(pass);
              break;                                                      
          }
        }
      }
    }
    다음 예제는 콜백 핸들러와 함께 패키징되는 MANIFEST.MF 파일을 보여줍니다.
    Manifest-Version: 1.0
    Bnd-LastModified: 1359415594428
    Build-Identifier: SNAPSHOT-Mon Jan 28 17:26:34 CST 2013
    Bundle-Copyright: The Program materials contained in this file are IBM
    copyright materials. 5724-I63, 5724-J08, 5724-H89, 5724-H88, 5655-W65
    Copyright International Business Machines Corp. 1999, 2012 All Rights
    Reserved * Licensed Materials - Property of IBM US Government Users
    Restricted Rights - Use, duplication or disclosure restricted by GSA ADP
    Schedule Contract with IBM Corp.
    Bundle-Description: An PasswordCallbackHandler; version=1.0.0
    Bundle-ManifestVersion: 2
    Bundle-Name: wssecuritycbh
    Bundle-SymbolicName: com.ibm.ws.wssecurity.example.cbh
    Bundle-Vendor: IBM
    Bundle-Version: 1.0.0
    Created-By: 1.6.0 (IBM Corporation)
    Export-Package: com.ibm.ws.wssecurity.example.cbh;uses:="com.ibm.websphe
    re.ras.annotation,javax.security.auth.callback";version="1.0.0"
    Import-Package: com.ibm.websphere.ras,com.ibm.websphere.ras.annotation,c
    om.ibm.ws.ffdc,javax.security.auth.callback,org.apache.ws.security;version="[1.6,2)"
    Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version>=1.6))"
    Tool: Bnd-2.1.0.20120920-170235
    WS-TraceGroup: WSSecurity
    1. 콜백 핸들러와 기능 Manifest 파일 wsseccbh-1.0.mf로 JAR 파일을 작성하십시오. 다음 컨텐츠를 사용하여 SampleCbh.jar이라고 하는 JAR 파일을 작성하십시오.
      META-INF/MANIFEST.MF
      com/ibm/ws/wssecurity/example/cbh/SamplePasswordCallback.class
      다음 예제는 wsseccbh-1.0.mf 파일을 보여줍니다.
      Subsystem-ManifestVersion: 1
      Subsystem-SymbolicName: wsseccbh-1.0; visibility:=public
      Subsystem-Version: 1.0.0 
      Subsystem-Content: com.ibm.ws.wssecurity.example.cbh; version="[1,1.0.100)";
          location:="lib/"; type="osgi.bundle"; start-phase:=APPLICATION_EARLY
      
      Subsystem-Type: osgi.subsystem.feature
      IBM-Feature-Version: 2
      
      IBM-API-Package: com.ibm.ws.wssecurity.example.cbh; version="1.0"; type="internal"
    2. Liberty 사용자 디렉토리에 콜백 핸들러 JAR 파일 및 기능 Manifest 파일을 복사하십시오. 다음 예제는 콜백 핸들러 JAR 파일 및 기능 Manifest 파일이 복사되는 위치를 보여줍니다.
      build.image/wlp/usr/extension/lib/SampleCbh.jar
      build.image/wlp/usr/extension/lib/features/wsseccbh-1.0.mf
  4. Liberty 서버에서 WS-Security를 구성하십시오. Liberty 서버 구성 파일 server.xml에서 WS-Security 기능을 사용으로 설정하고 이전 절에서 개발한 샘플 웹 서비스 클라이언트와 제공자 애플리케이션에 대해 WS-Security를 구성하십시오.
    다음 예제는 WS-Security를 구성하는 방법을 보여줍니다.
    <server>
      <featureManager>
        <feature>usr:wsseccbh-1.0</feature>
        <feature>servlet-3.0</feature>
        <feature>appSecurity-2.0</feature>
        		<feature>jsp-2.2</feature>
        <feature>jaxws-2.2</feature>
        <feature>wsSecurity-1.1</feature>
      </featureManager>
      <basicRegistry id="basic" realm="customRealm">
        <user name="user1" password="user1pswd" />
        <user name="user2" password="user2pswd" />
      </basicRegistry>
      <wsSecurityProvider id="default"
        ws-security.callback-handler="com.ibm.ws.wssecurity.example.cbh.SamplePasswordCallback"
        ws-security.signature.username="bob">
        <signatureProperties org.apache.ws.security.crypto.merlin.keystore.type="jceks"
          org.apache.ws.security.crypto.merlin.keystore.password="storepswd"
          org.apache.ws.security.crypto.merlin.keystore.alias="bob"
          org.apache.ws.security.crypto.merlin.file="${server.config.dir}/enc-receiver.jceks" />
        <encryptionProperties org.apache.ws.security.crypto.merlin.keystore.type="jceks"
          org.apache.ws.security.crypto.merlin.keystore.password="storepswd"
          org.apache.ws.security.crypto.merlin.keystore.alias="alice"
          org.apache.ws.security.crypto.merlin.file="${server.config.dir}/enc-receiver.jceks" />
      </wsSecurityProvider>
      <wsSecurityClient id="default"
        ws-security.password="security"
        ws-security.username="user1"
        ws-security.callback-handler="com.ibm.ws.wssecurity.example.cbh.SamplePasswordCallback"
        ws-security.encryption.username="alice">
        <signatureProperties org.apache.ws.security.crypto.merlin.keystore.type="jceks"
          org.apache.ws.security.crypto.merlin.keystore.password="storepswd"
          org.apache.ws.security.crypto.merlin.keystore.alias="alice"
          org.apache.ws.security.crypto.merlin.file="${server.config.dir}/enc-sender.jceks"/>
        <encryptionProperties org.apache.ws.security.crypto.merlin.keystore.type="jceks"
          org.apache.ws.security.crypto.merlin.keystore.password="storepswd"
          org.apache.ws.security.crypto.merlin.keystore.alias="bob"
          org.apache.ws.security.crypto.merlin.file="${server.config.dir}/enc-sender.jceks" />
      </wsSecurityClient>
    </server>

결과

WS-Security 정책을 사용하여 웹 서비스 보안을 설정했습니다.

첫 번째 단계에서 작성된 샘플 WS-Security 정책은 다음과 같은 메시지와 유사한 SOAP 요청과 응답 메시지를 생성합니다.
다음 예제는 SOAP 요청 메시지를 보여줍니다.
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Header xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   soap:mustUnderstand="1">
      <wsse:BinarySecurityToken
        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
        wsu:Id="X509-B1165B2A578AFFC7D613649595665924">...
      </wsse:BinarySecurityToken>
      <wsu:Timestamp wsu:Id="TS-1">
        <wsu:Created>2013-04-03T03:26:06.549Z</wsu:Created>
        <wsu:Expires>2013-04-03T03:31:06.549Z</wsu:Expires>
      </wsu:Timestamp>
      <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="EK-B1165B2A578AFFC7D613649595666705">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"></xenc:EncryptionMethod>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference>
            <ds:X509Data>
              <ds:X509IssuerSerial>
                <ds:X509IssuerName>CN=Bob,O=IBM,C=US</ds:X509IssuerName>
                <ds:X509SerialNumber>24054675667389</ds:X509SerialNumber>
              </ds:X509IssuerSerial>
            </ds:X509Data>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
        </xenc:CipherData>
        <xenc:ReferenceList>
          <xenc:DataReference URI="#ED-4"></xenc:DataReference>
          <xenc:DataReference URI="#ED-5"></xenc:DataReference>
          <xenc:DataReference URI="#ED-6"></xenc:DataReference>
        </xenc:ReferenceList>
      </xenc:EncryptedKey>
      <xenc:EncryptedData
        xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="ED-6" Type="http://www.w3.org/2001/04/xmlenc#Element">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></xenc:EncryptionMethod>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference
            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
            xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
            wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
            <wsse:Reference URI="#EK-B1165B2A578AFFC7D613649595666705"></wsse:Reference>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
        </xenc:CipherData>
      </xenc:EncryptedData>
      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                          Id="ED-5"
                          Type="http://www.w3.org/2001/04/xmlenc#Element">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></xenc:EncryptionMethod>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference
            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
            xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
            wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
            <wsse:Reference URI="#EK-B1165B2A578AFFC7D613649595666705"></wsse:Reference>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
        </xenc:CipherData>
      </xenc:EncryptedData>
    </wsse:Security>
  </SOAP-ENV:Header>
  <soap:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
             wsu:Id="Id-1788936596">
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                        Id="ED-4"
                        Type="http://www.w3.org/2001/04/xmlenc#Content">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></xenc:EncryptionMethod>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <wsse:SecurityTokenReference
          xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
          xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
          wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
          <wsse:Reference URI="#EK-B1165B2A578AFFC7D613649595666705"></wsse:Reference>
        </wsse:SecurityTokenReference>
      </ds:KeyInfo>
      <xenc:CipherData>
        <xenc:CipherValue>...</xenc:CipherValue>
      </xenc:CipherData>
    </xenc:EncryptedData>
  </soap:Body>
</soap:Envelope>
다음 예제는 SOAP 응답 메시지를 보여줍니다.
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Header xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   soap:mustUnderstand="1">
      <wsu:Timestamp wsu:Id="TS-7">
        <wsu:Created>2013-04-03T03:26:07.286Z</wsu:Created>
        <wsu:Expires>2013-04-03T03:31:07.286Z</wsu:Expires>
      </wsu:Timestamp>
      <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="EK-B1165B2A578AFFC7D613649595673129">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"></xenc:EncryptionMethod>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference>
            <ds:X509Data>
              <ds:X509IssuerSerial>
                <ds:X509IssuerName>CN=Alice,O=IBM,C=US</ds:X509IssuerName>
                <ds:X509SerialNumber>24054530212598</ds:X509SerialNumber>
              </ds:X509IssuerSerial>
            </ds:X509Data>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
        </xenc:CipherData>
        <xenc:ReferenceList>
          <xenc:DataReference URI="#ED-10"></xenc:DataReference>
          <xenc:DataReference URI="#ED-11"></xenc:DataReference>
          <xenc:DataReference URI="#ED-12"></xenc:DataReference>
        </xenc:ReferenceList>
      </xenc:EncryptedKey>
      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                          Id="ED-12"
                          Type="http://www.w3.org/2001/04/xmlenc#Element">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></xenc:EncryptionMethod>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference
            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
            xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
            wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
            <wsse:Reference URI="#EK-B1165B2A578AFFC7D613649595673129"></wsse:Reference>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
        </xenc:CipherData>
      </xenc:EncryptedData>
      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                          Id="ED-11"
                          Type="http://www.w3.org/2001/04/xmlenc#Element">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></xenc:EncryptionMethod>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference
            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
            xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
            wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
            <wsse:Reference URI="#EK-B1165B2A578AFFC7D613649595673129"></wsse:Reference>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
        </xenc:CipherData>
      </xenc:EncryptedData>
    </wsse:Security>
  </SOAP-ENV:Header>
  <soap:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
             wsu:Id="Id-2035943749">
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                        Id="ED-10"
                        Type="http://www.w3.org/2001/04/xmlenc#Content">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></xenc:EncryptionMethod>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <wsse:SecurityTokenReference
          xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
          xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
          wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
          <wsse:Reference URI="#EK-B1165B2A578AFFC7D613649595673129"></wsse:Reference>
        </wsse:SecurityTokenReference>
      </ds:KeyInfo>
      <xenc:CipherData>
        <xenc:CipherValue>...</xenc:CipherValue>
      </xenc:CipherData>
    </xenc:EncryptedData>
  </soap:Body>
</soap:Envelope>

다음에 수행할 작업

이제 보안 요구사항과 일치하는 WS-Security 정책을 사용하여 사용자 자신의 WSDL 파일을 개발하고 웹 서비스 애플리케이션을 보호할 수 있습니다.

주제의 유형을 표시하는 아이콘 태스크 주제



시간소인 아이콘 마지막 업데이트 날짜: Tuesday, 6 December 2016
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-nd-mp&topic=twlp_wssec_securing
파일 이름: twlp_wssec_securing.html