java - 尝试向 Web 服务发送 SOAP 请求时出现 WS 安全错误

Question

这是我使用肥皂 UI 发送的 SOAP 请求，但收到一条错误消息，指出“消息不符合配置的策略”

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:csw="http://www.cargospot.com/crystal/cswebservice">
   <soapenv:Header>

     <xwss:SecurityConfiguration dumpMessages="false" xmlns:xwss="http://java.sun.com/xml/ns/xwss/config">
            <xwss:RequireUsernameToken passwordDigestRequired="true" nonceRequired="true"/>
        <xwss:UsernameToken name="somename" password="somepassword" useNonce="true" digestPassword="true"/>
    </xwss:SecurityConfiguration>   
   </soapenv:Header>
   <soapenv:Body>

      <csw:cargoImpMessageRequest>
         <csw:content>test</csw:content>
      </csw:cargoImpMessageRequest>
   </soapenv:Body>
</soapenv:Envelope>

我收到的回复如下，

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
   <SOAP-ENV:Header/>
   <SOAP-ENV:Body>
      <SOAP-ENV:Fault>
         <faultcode>SOAP-ENV:Client</faultcode>
         <faultstring xml:lang="en">com.sun.xml.wss.XWSSecurityException: Message does not conform to configured policy [ AuthenticationTokenPolicy(S) ]:  No Security Header found; nested exception is com.sun.xml.wss.XWSSecurityException: com.sun.xml.wss.XWSSecurityException: Message does not conform to configured policy [ AuthenticationTokenPolicy(S) ]:  No Security Header found</faultstring>
      </SOAP-ENV:Fault>
   </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

下面是Web服务安全配置，

<!-- Web Service Security Configuration -->
    <bean id="xwssSecurityInterceptor" class="org.springframework.ws.soap.security.xwss.XwsSecurityInterceptor">
        <description>
            This interceptor validates incoming messages according to the policy defined in 'securityPolicy.xml'.
            The policy defines that all incoming requests must have a UsernameToken with a password digest in it.
            The actual authentication is performed by the Acegi callback handler.
        </description>
        <property name="policyConfiguration" value="/WEB-INF/securityPolicy.xml"/>
        <property name="callbackHandler" ref="digestPasswordCallback" />
    </bean>

    <bean id="digestPasswordCallback" class="org.springframework.ws.soap.security.xwss.callback.acegi.AcegiDigestPasswordValidationCallbackHandler">
        <property name="userDetailsService" ref="userDetailsService"/>       
    </bean>

    <bean id="userDetailsService" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
        <property name="userProperties">
            <bean class="org.springframework.beans.factory.config.PropertiesFactoryBean">
                <property name="location" value="/WEB-INF/csws-users.properties" />
            </bean>
        </property>
    </bean>

下面是安全策略

<xwss:SecurityConfiguration dumpMessages="false" xmlns:xwss="http://java.sun.com/xml/ns/xwss/config">
    <xwss:RequireUsernameToken passwordDigestRequired="true" nonceRequired="true"/>
    <xwss:UsernameToken name="somename" password="somepassword" useNonce="true" digestPassword="true"/>-->
</xwss:SecurityConfiguration>

我不确定 SOAP 请求中遗漏了什么，请帮助我找到 SOAP 请求的问题。

谢谢

Answer 1

尝试在 SOAP 请求中添加以下 header :

<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" wsse:mustUnderstand="1">
  <wsse:UsernameToken>
     <wsse:Username>userName</wsse:Username>
     <wsse:Password>password</wsse:Password>
  </wsse:UsernameToken>
</wsse:Security>