java - Axis 2 和 Rampart 如何在 policy.xml 中仅指定传出安全性

Question

我正在使用 Rampart 生成请求。 我有一个用于应用安全性的policy.xml。

我在响应中遇到异常，因为 Rampart 正在寻找安全 header ，但安全 header 不存在。

我仍然可以使用我的policy.xml 并指定我不需要入站安全性这一事实，还是我需要做其他事情？

政策:

 <wsp:Policy wsu:Id="SigOnly"  
        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"  
        xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">  
<wsp:ExactlyOne>  
    <wsp:All>  
        <sp:AsymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">  
            <wsp:Policy>  
                <sp:InitiatorToken>  
                    <wsp:Policy>  
                        <sp:X509Token  
                                sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">  
                            <wsp:Policy>  
                                <sp:RequireThumbprintReference/>  
                                <sp:WssX509V3Token10/>  
                            </wsp:Policy>  
                        </sp:X509Token>  
                    </wsp:Policy>  
                </sp:InitiatorToken>  
                <sp:RecipientToken>  
                    <wsp:Policy>  
                        <sp:X509Token  
                                sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never">  
                            <wsp:Policy>  
                                 <sp:RequireThumbprintReference/>  
                                <sp:WssX509V3Token10/>   
                            </wsp:Policy>  
                        </sp:X509Token>   
                    </wsp:Policy>  
                </sp:RecipientToken>  
                <sp:AlgorithmSuite>  
                    <wsp:Policy>  
                        <sp:TripleDesRsa15/>  
                    </wsp:Policy>  
                </sp:AlgorithmSuite>  
                <sp:Layout>  
                    <wsp:Policy>  
                        <sp:Strict/>  
                    </wsp:Policy>  
                </sp:Layout>  
               <!--   <sp:IncludeTimestamp/> -->  
                <sp:OnlySignEntireHeadersAndBody/>  
            </wsp:Policy>  
        </sp:AsymmetricBinding>  
        <sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">  
            <wsp:Policy>  
                <sp:MustSupportRefKeyIdentifier/>  
                <sp:MustSupportRefIssuerSerial/>  
            </wsp:Policy>  
        </sp:Wss10>  
        <sp:SignedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">  
            <sp:Body/>  
        </sp:SignedParts>  
        <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">  
            <ramp:user>ctr</ramp:user>  
            <ramp:encryptionUser>ctr</ramp:encryptionUser>  
            <ramp:passwordCallbackClass>com.gtnet.rampart.PWCBHandler  
            </ramp:passwordCallbackClass>  

            <ramp:signatureCrypto>  
                <ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin">  
                    <ramp:property name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>  
                    <ramp:property name="org.apache.ws.security.crypto.merlin.file">build\resources\qw.jks</ramp:property>  
                    <ramp:property name="org.apache.ws.security.crypto.merlin.keystore.password">123123</ramp:property>  
                </ramp:crypto>  
            </ramp:signatureCrypto>  
        </ramp:RampartConfig>  

    </wsp:All>  
</wsp:ExactlyOne>  

Answer 1

请看这里: http://blog.rampartfaq.com/2009/11/how-to-generate-non-secure-response-to.html

您可以通过更改 axis2.xml 和 OutFlow 在客户端执行等效操作。