從Apache CXF（MTOM + WS-Security）訪問WCF Web服務

我一直在努力解決這個問題很長一段時間，並且還沒有能夠解決它，儘管環顧四周。從Apache CXF（MTOM + WS-Security）訪問WCF Web服務

方案的細節（代碼，配置和其他的東西在端部張貼）：

WCF Web服務（.NET 4），露出兩個端點：一個不安全的和一個固定使用Message Security and用戶名認證（使用成員資格基礎設施） - 無傳輸安全。
兩個終端都使用MTOM編碼;由WSDL引用的所有分類都標記有MessageContract屬性，並且具有MessageBodyMember屬性的成員。
WCF綁定上的配置將'establishSecurityContext'和'negotiateServiceCredential'設置爲false。
WCF服務受自我簽名證書保護以用於加密目的。
嘗試使用Apache CXF 2.5.1從Java客戶端進行訪問。我已將證書安裝到可從類路徑訪問的KeyStore中。

結果：

從.NET客戶端訪問Web服務工作正常
訪問不安全的端點Apache的CXF工作正常使用和不使用MTOM編碼。
從Apache CXF訪問安全端點（無MTOM）可以正常工作。 CXF跟蹤表示加密/解密過程正常進行。
一旦在WCF中激活了MTOM，就會出現問題。我們能夠確定在WCF方面，消息的接收，處理和響應的生成/加密正常發生。
正在接收CXF中的消息時發生問題。在嘗試解密消息之前，CXF並未正確反序列化MTOM附件，因此，解密邏輯發現該消息在響應中仍然有一個要解密的元素，但找到了一個空元素來解密並失敗。我們嘗試添加一個RECEIVE階段攔截器來初始化附件，但無濟於事（嘗試在多部分響應中查找邊界標記）。
使用招，我們發現，所述響應看起來很好地形成，帶有附件稱爲

CODE/CONFIG/STUFF：

的Web.Config（縮短爲清楚起見）：

<system.serviceModel> 
    <!-- Services --> 
    <services> 
     <service name="TestServices.Services.TestService" behaviorConfiguration="TestService.Basic"> 
     <!-- Plain (unsecured) endpoint --> 
     <endpoint address="" binding="wsHttpBinding" bindingConfiguration="TestService.Basic" name="TestService.Basic" 
        contract="TestServices.Interfaces.ITestService" bindingNamespace="http://searchtechnologies.com/cpa/wcfinterop"/> 
     <!-- Secure endpoint --> 
     <endpoint address="/secure" binding="wsHttpBinding" bindingConfiguration="TestService.Secure" name="TestService.Secure" 
        contract="TestServices.Interfaces.ITestService" bindingNamespace="http://searchtechnologies.com/cpa/wcfinterop"/> 
     </service> 
    </services> 
    <!-- Bindings --> 
    <bindings> 
     <wsHttpBinding> 
     <binding name="TestService.Basic" messageEncoding="Mtom"> 
      <security mode="None"> 
      <message clientCredentialType="None"/> 
      <transport clientCredentialType="None"/> 
      </security> 
     </binding> 
     <binding name="TestService.Secure" messageEncoding="Mtom"> 
      <security mode="Message"> 
      <message clientCredentialType="UserName" establishSecurityContext="false" negotiateServiceCredential="false"/> 
      <transport clientCredentialType="None"/> 
      </security> 
     </binding> 
     </wsHttpBinding> 
    </bindings> 
    <!-- Behaviors --> 
    <behaviors> 
     <serviceBehaviors> 
     <behavior name="TestService.Basic"> 
      <serviceMetadata httpGetEnabled="true"/> 
      <serviceDebug includeExceptionDetailInFaults="true"/> 
      <serviceCredentials> 
      <serviceCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="equiros-PC2.search.local"/> 
      <userNameAuthentication userNamePasswordValidationMode="MembershipProvider" membershipProviderName="SqlProvider"/> 
      </serviceCredentials> 
     </behavior> 
     </serviceBehaviors> 
    </behaviors>

Java客戶端代碼（部分爲了清晰起見省略）：

private static void secureTest() { 
    try { 
     logger.debug("Secure test starting. Instatiating service"); 
     // service instantiation 
     TestService service = new TestService(); 
     ITestService port = service.getTestServiceSecure(); 
     // request creation 
     BasicRequest request = objectFactory.createBasicRequest(); 
     request.setStringData("String data"); 
     request.setIntegerData("Integer data"); 
     // setup logging 
     setupInterceptors(port); 
     // setup security & binding 
     setupBinding(port); 
     // service call 
     logger.debug("Attempting service call"); 
     BasicResponse response = port.simpleOperation(request); 
     logger.debug("Call success!!!"); 
     logger.debug(String.format("Response data: str: %1$s; int: %2$s", 
      response.getStringData(), response.getIntegerData())); 
    } catch (Exception e) { 
     logger.error("Error during service invocation", e); 
    } 
    } 

    private static void setupInterceptors(ITestService port) { 
    Client proxy = JaxWsClientProxy.getClient(port); 
    proxy.getInInterceptors().add(new LoggingInInterceptor()); 
    proxy.getOutInterceptors().add(new LoggingOutInterceptor()); 
    } 

    private static void setupBinding(ITestService port) { 
    javax.xml.ws.BindingProvider bp = (javax.xml.ws.BindingProvider) port; 
    SOAPBinding binding = (SOAPBinding) bp.getBinding(); 
    binding.setMTOMEnabled(true); 
    Map<String, Object> context = bp.getRequestContext(); 
    context.put("ws-security.username", "systemadmin"); 
    context.put("ws-security.password", "[email protected]"); 
    context.put("ws-security.encryption.properties", 
     "clientKeystore.properties"); 
    context.put("ws-security.encryption.username", "serviceKey"); 
    }

的錯誤跟蹤記錄（僅解密階段）：

[main] DEBUG org.apache.ws.security.components.crypto.CryptoFactory - Using Crypto Engine [class org.apache.ws.security.components.crypto.Merlin] 
[main] DEBUG org.apache.ws.security.util.Loader - Trying to find [clientKeystore.jks] using [email protected] class loader. 
[main] DEBUG org.apache.ws.security.components.crypto.Merlin - The KeyStore clientKeystore.jks of type jks has been loaded 
[main] DEBUG org.apache.ws.security.processor.TimestampProcessor - Found Timestamp list element 
[main] DEBUG org.apache.ws.security.message.token.Timestamp - Current time: 2012-02-07T22:52:22.852Z 
[main] DEBUG org.apache.ws.security.message.token.Timestamp - Timestamp created: 2012-02-07T22:52:22.641Z 
[main] DEBUG org.apache.ws.security.message.token.Timestamp - Timestamp expires: 2012-02-07T22:57:22.641Z 
[main] DEBUG org.apache.ws.security.message.token.Timestamp - Validation of Timestamp: Everything is ok 
[main] DEBUG org.apache.ws.security.message.token.DerivedKeyToken - DerivedKeyToken: created : element constructor 
[main] DEBUG org.apache.ws.security.message.token.DerivedKeyToken - DerivedKeyToken: created : element constructor 
[main] DEBUG org.apache.ws.security.processor.ReferenceListProcessor - Found reference list element 
[main] DEBUG org.apache.ws.security.processor.ReferenceListProcessor - Found data reference: _3 
[main] DEBUG org.apache.ws.security.processor.X509Util - Sym Enc Algo: http://www.w3.org/2001/04/xmlenc#aes256-cbc 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Getting XMLCipher with transformation 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Constructing XMLCipher... 
[main] DEBUG org.apache.xml.security.algorithms.JCEMapper - Request for URI http://www.w3.org/2001/04/xmlenc#aes256-cbc 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - cipher._algorithm = AES/CBC/ISO10126Padding 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Initializing XMLCipher... 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - opmode = DECRYPT_MODE 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Processing source element... 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Decrypting element... 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Decrypting to ByteArray... 
[main] DEBUG org.apache.xml.security.utils.ElementProxy - setElement("KeyInfo", "null") 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Encrypted octets: 
x1eLqhngbuRTq2XJIkcTdzyu1UFb4eV0kwno04/w4yW0HiY6RyYa7OHqniV63aaxgZPxm0NOK2ZUgjggtkM0O9myJ6ZJOFxCLmqREjQMD+mFW+WuTSEZ5cgc3SFule3MmryqoStNLsmzM8t5yaT3drF1ctT7DJQnV6W858WwpD+Dw+WYmO0RaUlgsfbTnWiBvCZ8yyCzvgmZTMGr8y9LXnwaw+FsspReuMpcIOsqU9LE5u5uW5ZJglgn5cv/8XWikD3TwNzqL+7qAVN8R6WnXgUmb1DuX5lx4cyxlwcLnkfOQKbGrwGvKJUY47ohAgKH 
[main] DEBUG org.apache.xml.security.algorithms.JCEMapper - Request for URI http://www.w3.org/2001/04/xmlenc#aes256-cbc 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - JCE Algorithm = AES/CBC/ISO10126Padding 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Decrypted octets: 
<BasicResponse xmlns="http://searchtechnologies.com/cpa/wcfinterop/data"><DateTimeData>0001-01-02T00:00:00</DateTimeData><IntegerData>Integer data</IntegerData><StringData>String data</StringData></BasicResponse> 
[main] DEBUG org.apache.ws.security.processor.ReferenceListProcessor - Found data reference: _6 
[main] DEBUG org.apache.ws.security.processor.X509Util - Sym Enc Algo: http://www.w3.org/2001/04/xmlenc#aes256-cbc 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Getting XMLCipher with transformation 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Constructing XMLCipher... 
[main] DEBUG org.apache.xml.security.algorithms.JCEMapper - Request for URI http://www.w3.org/2001/04/xmlenc#aes256-cbc 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - cipher._algorithm = AES/CBC/ISO10126Padding 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Initializing XMLCipher... 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - opmode = DECRYPT_MODE 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Processing source element... 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Decrypting element... 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Decrypting to ByteArray... 
[main] DEBUG org.apache.xml.security.utils.ElementProxy - setElement("KeyInfo", "null") 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - Encrypted octets: 

[main] DEBUG org.apache.xml.security.algorithms.JCEMapper - Request for URI http://www.w3.org/2001/04/xmlenc#aes256-cbc 
[main] DEBUG org.apache.xml.security.encryption.XMLCipher - JCE Algorithm = AES/CBC/ISO10126Padding 
Feb 07, 2012 4:52:22 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor handleMessage 
WARNING: 
org.apache.ws.security.WSSecurityException: The signature or decryption was invalid 
    at org.apache.ws.security.processor.ReferenceListProcessor.decryptEncryptedData(ReferenceListProcessor.java:298) 
    at org.apache.ws.security.processor.ReferenceListProcessor.decryptDataRefEmbedded(ReferenceListProcessor.java:159) 
    at org.apache.ws.security.processor.ReferenceListProcessor.handleReferenceList(ReferenceListProcessor.java:93) 
    at org.apache.ws.security.processor.ReferenceListProcessor.handleToken(ReferenceListProcessor.java:60) 
    at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396) 
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:249) 
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:85) 
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263) 
    at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:799) 
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1627) 
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1494) 
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1402) 
    at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47) 
    at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:195) 
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) 
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:649) 
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62) 
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263) 
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:533) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:463) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:366) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:319) 
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:88) 
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134) 
    at $Proxy33.simpleOperation(Unknown Source) 
    at com.searchtechnologies.wcfinterop.TestServiceClient.secureTest(TestServiceClient.java:74) 
    at com.searchtechnologies.wcfinterop.TestServiceClient.main(TestServiceClient.java:32) 
Caused by: java.lang.ArrayIndexOutOfBoundsException 
    at java.lang.System.arraycopy(Native Method) 
    at org.apache.xml.security.encryption.XMLCipher.decryptToByteArray(Unknown Source) 
    at org.apache.xml.security.encryption.XMLCipher.decryptElement(Unknown Source) 
    at org.apache.xml.security.encryption.XMLCipher.doFinal(Unknown Source) 
    at org.apache.ws.security.processor.ReferenceListProcessor.decryptEncryptedData(ReferenceListProcessor.java:296) 
    ... 26 more 

Feb 07, 2012 4:52:22 PM org.apache.cxf.phase.PhaseInterceptorChain doDefaultLogging 
WARNING: Interceptor for {http://searchtechnologies.com/cpa/wcfinterop}TestService#{http://searchtechnologies.com/cpa/wcfinterop}SimpleOperation has thrown exception, unwinding now 
org.apache.cxf.binding.soap.SoapFault: The signature or decryption was invalid 
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.createSoapFault(WSS4JInInterceptor.java:643) 
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:308) 
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:85) 
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263) 
    at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:799) 
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1627) 
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1494) 
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1402) 
    at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47) 
    at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:195) 
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) 
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:649) 
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62) 
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263) 
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:533) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:463) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:366) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:319) 
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:88) 
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134) 
    at $Proxy33.simpleOperation(Unknown Source) 
    at com.searchtechnologies.wcfinterop.TestServiceClient.secureTest(TestServiceClient.java:74) 
    at com.searchtechnologies.wcfinterop.TestServiceClient.main(TestServiceClient.java:32) 
Caused by: org.apache.ws.security.WSSecurityException: The signature or decryption was invalid 
    at org.apache.ws.security.processor.ReferenceListProcessor.decryptEncryptedData(ReferenceListProcessor.java:298) 
    at org.apache.ws.security.processor.ReferenceListProcessor.decryptDataRefEmbedded(ReferenceListProcessor.java:159) 
    at org.apache.ws.security.processor.ReferenceListProcessor.handleReferenceList(ReferenceListProcessor.java:93) 
    at org.apache.ws.security.processor.ReferenceListProcessor.handleToken(ReferenceListProcessor.java:60) 
    at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396) 
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:249) 
    ... 21 more 
Caused by: java.lang.ArrayIndexOutOfBoundsException 
    at java.lang.System.arraycopy(Native Method) 
    at org.apache.xml.security.encryption.XMLCipher.decryptToByteArray(Unknown Source) 
    at org.apache.xml.security.encryption.XMLCipher.decryptElement(Unknown Source) 
    at org.apache.xml.security.encryption.XMLCipher.doFinal(Unknown Source) 
    at org.apache.ws.security.processor.ReferenceListProcessor.decryptEncryptedData(ReferenceListProcessor.java:296) 
    ... 26 more 

[main] ERROR com.searchtechnologies.wcfinterop.TestServiceClient - Error during service invocation 
java.lang.NullPointerException 
    at com.sun.xml.internal.messaging.saaj.soap.impl.ElementImpl.addTextNode(ElementImpl.java:439) 
    at com.sun.xml.internal.messaging.saaj.soap.ver1_2.Fault1_2Impl.setFaultRole(Fault1_2Impl.java:323) 
    at com.sun.xml.internal.messaging.saaj.soap.ver1_2.Fault1_2Impl.setFaultActor(Fault1_2Impl.java:559) 
    at org.apache.cxf.jaxws.JaxWsClientProxy.createSoapFault(JaxWsClientProxy.java:219) 
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:152) 
    at $Proxy33.simpleOperation(Unknown Source) 
    at com.searchtechnologies.wcfinterop.TestServiceClient.secureTest(TestServiceClient.java:74) 
    at com.searchtechnologies.wcfinterop.TestServiceClient.main(TestServiceClient.java:32)

正如你所看到的，它看起來像時的CxF嘗試它引用了附件的元素進行解碼，發現其內容爲空，而失敗。

任何幫助將深深讚賞。

由於大小限制，無法發佈WSDL。如有需要可應要求提供。

問候，

愛德華多·基羅斯 - 坎波斯

來源

2012-02-07 Eduardo Quirós-Campos

據我知道，CXF不支持完全MTOM時，簽名是允許的：它不簽名或加密的附件。由於WCF簽名或加密附件，它將無法工作。見http://cxf.547215.n5.nabble.com/Signature-digest-mismatch-when-NET-supplies-MTOM-attachment-td3270961.html和https://issues.apache.org/jira/browse/CXF-3687。

來源

2012-04-04 09:19:56 NicolasF

從Apache CXF（MTOM + WS-Security）訪問WCF Web服務

回答

相關問題