在SpringSide实现XFire Webservice认证

在SpringSide中实现XFire Webservice认证，可以按照以下步骤进行：

在pom.xml文件中添加XFire和SpringSecurity的依赖：

<dependency><groupId>org.codehaus.xfire</groupId><artifactId>xfire-all</artifactId><version>1.2.6</version></dependency><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-web</artifactId><version>5.1.4.RELEASE</version></dependency><dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-config</artifactId><version>5.1.4.RELEASE</version></dependency>

创建一个实现了org.springframework.security.core.userdetails.UserDetailsService接口的类，用于获取用户信息。可以根据实际业务需求自行实现。

@Servicepublic class UserDetailsServiceImpl implements UserDetailsService {@Autowiredprivate UserRepository userRepository;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {User user = userRepository.findByUsername(username);if (user == null) {throw new UsernameNotFoundException("User not found");}return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(),Arrays.asList(new SimpleGrantedAuthority(user.getRole())));}}

创建一个实现了org.springframework.ws.soap.security.xwss.XwsSecurityInterceptor接口的类，用于配置Webservice的安全拦截器。

@Componentpublic class XFireSecurityInterceptor extends XwsSecurityInterceptor {@Autowiredprivate UserDetailsService userDetailsService;@Overridepublic void afterPropertiesSet() throws Exception {Wss4jSecurityInterceptor securityInterceptor = new Wss4jSecurityInterceptor();securityInterceptor.setValidationActions("UsernameToken");securityInterceptor.setSecurementActions("UsernameToken");securityInterceptor.setSecurementUsernameTokenNoPassword(true);securityInterceptor.setSecurementUsernameTokenDigestPassword(true);securityInterceptor.setSecurementPasswordType(WSConstants.PASSWORD_DIGEST);securityInterceptor.setValidationCallbackHandler(callbackHandler());securityInterceptor.setValidationActions("UsernameToken");securityInterceptor.setValidationSignatureCrypto(getCrypto());securityInterceptor.setValidationDecryptionCrypto(getCrypto());this.setInterceptors(new ClientInterceptor[]{securityInterceptor});}private CallbackHandler callbackHandler() {return new PasswordCallbackHandler(userDetailsService);}private Crypto getCrypto() throws WSSecurityException {Properties properties = new Properties();properties.setProperty("org.apache.ws.security.crypto.provider","org.apache.ws.security.components.crypto.Merlin");properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.password", "keystorePassword");properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.alias", "alias");properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.file", "keystorePath");Crypto crypto = CryptoFactory.getInstance(properties);return crypto;}}

创建一个实现了org.springframework.ws.soap.security.callback.CallbackHandler接口的类，用于处理Webservice请求中的用户名和密码。

public class PasswordCallbackHandler implements CallbackHandler {private UserDetailsService userDetailsService;public PasswordCallbackHandler(UserDetailsService userDetailsService) {this.userDetailsService = userDetailsService;}@Overridepublic void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {for (Callback callback : callbacks) {if (callback instanceof UsernameCallback) {UsernameCallback usernameCallback = (UsernameCallback) callback;String username = usernameCallback.getUsername();UserDetails userDetails = userDetailsService.loadUserByUsername(username);if (userDetails == null) {throw new IOException("User not found");}usernameCallback.setPassword(userDetails.getPassword());} else {throw new UnsupportedCallbackException(callback);}}}}

在Spring配置文件中配置XFireSecurityInterceptor和PayloadRootAnnotationMethodEndpointMapping。

<bean id="xfire" class="org.springframework.remoting.xfire.XFireFactoryBean"><property name="inInterceptors"><list><ref bean="xfireSecurityInterceptor"/></list></property></bean><bean id="xfireSecurityInterceptor" class="com.example.XFireSecurityInterceptor"init-method="afterPropertiesSet"><property name="userDetailsService" ref="userDetailsService"/></bean><bean class="org.springframework.ws.server.endpoint.mapping.PayloadRootAnnotationMethodEndpointMapping"><property name="interceptors" ref="xfire"/></bean>

以上