java - WS-Security:无法断言 HttpsToken

Question

我的 WSDL 中有以下 ws 策略:

    <wsp:Policy wssutil:Id="Wssp1.2-2007-Https-UsernameToken-Plain.xml">
    <ns1:TransportBinding xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
        <wsp:Policy>
            <ns1:TransportToken>
                <wsp:Policy>
                    <ns1:HttpsToken/>
                </wsp:Policy>
            </ns1:TransportToken>
            <ns1:AlgorithmSuite>
                <wsp:Policy>
                    <ns1:Basic256/>
                </wsp:Policy>
            </ns1:AlgorithmSuite>
            <ns1:Layout>
                <wsp:Policy>
                    <ns1:Lax/>
                </wsp:Policy>
            </ns1:Layout>
            <ns1:IncludeTimestamp/>
        </wsp:Policy>
    </ns1:TransportBinding>
    <ns2:SupportingTokens xmlns:ns2="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
        <wsp:Policy>
            <ns2:UsernameToken
                ns2:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                <wsp:Policy>
                    <ns2:WssUsernameToken10/>
                    <ns2:HashPassword/>
                </wsp:Policy>
            </ns2:UsernameToken>
        </wsp:Policy>
    </ns2:SupportingTokens>
</wsp:Policy>

为了支持我的客户端内部的 WS 安全性，我已经实现了:

        ((BindingProvider) port ).getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, this.URL);

        AddressingProperties maps = new AddressingPropertiesImpl();
        ((BindingProvider) port).getRequestContext().put("javax.xml.ws.addressing.context", maps);

        Map<String, Object> ctx = ((BindingProvider) port).getRequestContext();

        ctx.put("ws-security.callback-handler", UsernamePasswordCallback.class.getName());

        UsernamePasswordCallback.user = this.USER;
        UsernamePasswordCallback.pass = this.PASS;

        ctx.put("ws-security.username", UsernamePasswordCallback.user);
        ctx.put("ws-security.callback-handler", UsernamePasswordCallback.class.getName());

        Client client = ClientProxy.getClient(port);
        client.getOutInterceptors().add(new LoggingOutInterceptor());
        client.getInInterceptors().add(new LoggingInInterceptor());

据我了解，当您拥有 WssUsernameToken10 和 HashPassword 时，通常就是这样做的。问题似乎出在 TransportBinding 上:

HttpsToken could not be asserted: HttpURLConnection is not a HttpsURLConnection

过去有人遇到过这个问题，不幸的是，似乎没有解决方案，也没有单一的答复。

如果有任何想法，我将不胜感激。

Answer 1

如果有人遇到类似问题，我建议查看 cxf 库版本:服务器端和客户端的不同版本可能会导致此问题。