Apache CXF實戰之九 發佈使用SSL的Web Service

在使用Web Service的時候，在很多情況下會要求我們發佈ssl的web service，此時如果web service是作爲一個war包部署在tomcat之類的web容器中的時候，我們可以通過修改tomcat的配置來比較容易的部署發佈成ssl的web service的，當對於獨立運行的程序來書，此時發佈web service是需要一些操作的，下面看看在CXF中怎樣發佈並調用SSL的Web Service。

1. 首先是一個pojo的實體類

package com.googlecode.garbagecan.cxfstudy.ssl;

public class User {
    private String id;
    private String name;
    private String password;
    public String getId() {
        return id;
    }
    public void setId(String id) {
        this.id = id;
    }
    public String getName() {
        return name;
    }
    public void setName(String name) {
        this.name = name;
    }
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }
}

package com.googlecode.garbagecan.cxfstudy.ssl;

public class User {
	private String id;
	private String name;
	private String password;
	public String getId() {
		return id;
	}
	public void setId(String id) {
		this.id = id;
	}
	public String getName() {
		return name;
	}
	public void setName(String name) {
		this.name = name;
	}
	public String getPassword() {
		return password;
	}
	public void setPassword(String password) {
		this.password = password;
	}
}

2. 下面是Web Service的接口和實現類，這兩個類和前面文章中介紹的沒什麼區別

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.util.List;

import javax.jws.WebMethod;
import javax.jws.WebResult;
import javax.jws.WebService;

@WebService
public interface UserService {
    @WebMethod
    @WebResult List<User> list();

}

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.util.ArrayList;
import java.util.List;

public class UserServiceImpl
implements UserService {

    public List<User> list() {
        List<User> users = new ArrayList<User>();
        for (int i =
0; i < 10; i++) {
            User user = new User();
            user.setId("" + i);
            user.setName("user_" + i);
            user.setPassword("password_" + i);
            users.add(user);
        }
        return users;
    }

}

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.util.List;

import javax.jws.WebMethod;
import javax.jws.WebResult;
import javax.jws.WebService;

@WebService
public interface UserService {
	@WebMethod
	@WebResult List<User> list();

}

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.util.ArrayList;
import java.util.List;

public class UserServiceImpl implements UserService {

	public List<User> list() {
		List<User> users = new ArrayList<User>();
		for (int i = 0; i < 10; i++) {
			User user = new User();
			user.setId("" + i);
			user.setName("user_" + i);
			user.setPassword("password_" + i);
			users.add(user);
		}
		return users;
	}

}

3. 下面看看Server端代碼

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.io.File;
import java.io.FileInputStream;
import java.security.KeyStore;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import org.apache.cxf.configuration.jsse.TLSServerParameters;
import org.apache.cxf.configuration.security.ClientAuthentication;
import org.apache.cxf.configuration.security.FiltersType;
import org.apache.cxf.endpoint.Server;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.transport.http_jetty.JettyHTTPServerEngineFactory;

public class MyServer {

    private static
final int port =
12345;

    private static
final String address = "https://0.0.0.0:"+port+"/ws/ssl/userService";

    public static
void main(String[] args) throws Exception {
        System.out.println("Starting Server");

        configureSSLOnTheServer();

        JaxWsServerFactoryBean factoryBean = new JaxWsServerFactoryBean();
        factoryBean.setServiceClass(UserServiceImpl.class);
        factoryBean.setAddress(address);

        Server server = factoryBean.create();
        String endpoint = server.getEndpoint().getEndpointInfo().getAddress();

        System.out.println("Server started at " + endpoint);
    }

    public static
void configureSSLOnTheServer() {
        File file = new File(MyServer.class.getResource("/com/googlecode/garbagecan/cxfstudy/ssl/test.jks").getFile());

        try {
            TLSServerParameters tlsParams = new TLSServerParameters();
            KeyStore keyStore = KeyStore.getInstance("JKS");
            String password = "mypassword";
            String storePassword = "mypassword";

            keyStore.load(new FileInputStream(file), storePassword.toCharArray());
            KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyFactory.init(keyStore, password.toCharArray());
            KeyManager[] keyManagers = keyFactory.getKeyManagers();
            tlsParams.setKeyManagers(keyManagers);

            keyStore.load(new FileInputStream(file), storePassword.toCharArray());
            TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustFactory.init(keyStore);
            TrustManager[] trustManagers = trustFactory.getTrustManagers();
            tlsParams.setTrustManagers(trustManagers);

            FiltersType filtersTypes = 
new FiltersType();
            filtersTypes.getInclude().add(".*_EXPORT_.*");
            filtersTypes.getInclude().add(".*_EXPORT1024_.*");
            filtersTypes.getInclude().add(".*_WITH_DES_.*");
            filtersTypes.getInclude().add(".*_WITH_NULL_.*");
            filtersTypes.getExclude().add(".*_DH_anon_.*");
            tlsParams.setCipherSuitesFilter(filtersTypes);

            ClientAuthentication ca = 
new ClientAuthentication();
            ca.setRequired(true);
            ca.setWant(true);
            tlsParams.setClientAuthentication(ca);

            JettyHTTPServerEngineFactory factory = 
new JettyHTTPServerEngineFactory();
            factory.setTLSServerParametersForPort(port, tlsParams);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.io.File;
import java.io.FileInputStream;
import java.security.KeyStore;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import org.apache.cxf.configuration.jsse.TLSServerParameters;
import org.apache.cxf.configuration.security.ClientAuthentication;
import org.apache.cxf.configuration.security.FiltersType;
import org.apache.cxf.endpoint.Server;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.transport.http_jetty.JettyHTTPServerEngineFactory;

public class MyServer {

	private static final int port = 12345;
	
	private static final String address = "https://0.0.0.0:"+port+"/ws/ssl/userService";

	public static void main(String[] args) throws Exception {
		System.out.println("Starting Server");
		
		configureSSLOnTheServer();
		
		JaxWsServerFactoryBean factoryBean = new JaxWsServerFactoryBean();
		factoryBean.setServiceClass(UserServiceImpl.class);
		factoryBean.setAddress(address);
		
		Server server = factoryBean.create();
		String endpoint = server.getEndpoint().getEndpointInfo().getAddress();

		System.out.println("Server started at " + endpoint);
	}

	public static void configureSSLOnTheServer() {
		File file = new File(MyServer.class.getResource("/com/googlecode/garbagecan/cxfstudy/ssl/test.jks").getFile());
		
		try {
			TLSServerParameters tlsParams = new TLSServerParameters();
			KeyStore keyStore = KeyStore.getInstance("JKS");
			String password = "mypassword";
			String storePassword = "mypassword";
			
			keyStore.load(new FileInputStream(file), storePassword.toCharArray());
			KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
			keyFactory.init(keyStore, password.toCharArray());
			KeyManager[] keyManagers = keyFactory.getKeyManagers();
			tlsParams.setKeyManagers(keyManagers);

			keyStore.load(new FileInputStream(file), storePassword.toCharArray());
			TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
			trustFactory.init(keyStore);
			TrustManager[] trustManagers = trustFactory.getTrustManagers();
			tlsParams.setTrustManagers(trustManagers);
			
			FiltersType filtersTypes = new FiltersType();
			filtersTypes.getInclude().add(".*_EXPORT_.*");
			filtersTypes.getInclude().add(".*_EXPORT1024_.*");
			filtersTypes.getInclude().add(".*_WITH_DES_.*");
			filtersTypes.getInclude().add(".*_WITH_NULL_.*");
			filtersTypes.getExclude().add(".*_DH_anon_.*");
			tlsParams.setCipherSuitesFilter(filtersTypes);
			
			ClientAuthentication ca = new ClientAuthentication();
			ca.setRequired(true);
			ca.setWant(true);
			tlsParams.setClientAuthentication(ca);
			
			JettyHTTPServerEngineFactory factory = new JettyHTTPServerEngineFactory();
			factory.setTLSServerParametersForPort(port, tlsParams);
		} catch (Exception e) {
			e.printStackTrace();
		}
	}

}

4. 下面看看Client端代碼

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.io.File;
import java.io.FileInputStream;
import java.security.KeyStore;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.configuration.security.FiltersType;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.transport.http.HTTPConduit;

public class MyClient {

    private static
final String address = "https://localhost:12345/ws/ssl/userService";

    public static
void main(String[] args) throws Exception {
        JaxWsProxyFactoryBean factoryBean = new JaxWsProxyFactoryBean();
        factoryBean.setAddress(address);
        factoryBean.setServiceClass(UserService.class);
        Object obj = factoryBean.create();
        UserService userService = (UserService) obj;

        configureSSLOnTheClient(userService);

        System.out.println(userService.list());
    }

    private static
void configureSSLOnTheClient(Object obj) {
        File file = new File(MyServer.class.getResource("/com/googlecode/garbagecan/cxfstudy/ssl/test.jks").getFile());

        Client client = ClientProxy.getClient(obj);
        HTTPConduit httpConduit = (HTTPConduit) client.getConduit();

        try {
            TLSClientParameters tlsParams = new TLSClientParameters();
            tlsParams.setDisableCNCheck(true);

            KeyStore keyStore = KeyStore.getInstance("JKS");
            String password = "mypassword";
            String storePassword = "mypassword";

            keyStore.load(new FileInputStream(file), storePassword.toCharArray());
            TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustFactory.init(keyStore);
            TrustManager[] trustManagers = trustFactory.getTrustManagers();
            tlsParams.setTrustManagers(trustManagers);

            keyStore.load(new FileInputStream(file), storePassword.toCharArray());
            KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyFactory.init(keyStore, password.toCharArray());
            KeyManager[] keyManagers = keyFactory.getKeyManagers();
            tlsParams.setKeyManagers(keyManagers);

            FiltersType filtersTypes = 
new FiltersType();
            filtersTypes.getInclude().add(".*_EXPORT_.*");
            filtersTypes.getInclude().add(".*_EXPORT1024_.*");
            filtersTypes.getInclude().add(".*_WITH_DES_.*");
            filtersTypes.getInclude().add(".*_WITH_NULL_.*");
            filtersTypes.getExclude().add(".*_DH_anon_.*");
            tlsParams.setCipherSuitesFilter(filtersTypes);

            httpConduit.setTlsClientParameters(tlsParams);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

package com.googlecode.garbagecan.cxfstudy.ssl;

import java.io.File;
import java.io.FileInputStream;
import java.security.KeyStore;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.configuration.security.FiltersType;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.transport.http.HTTPConduit;

public class MyClient {

	private static final String address = "https://localhost:12345/ws/ssl/userService";

	public static void main(String[] args) throws Exception {
		JaxWsProxyFactoryBean factoryBean = new JaxWsProxyFactoryBean();
		factoryBean.setAddress(address);
		factoryBean.setServiceClass(UserService.class);
		Object obj = factoryBean.create();
		UserService userService = (UserService) obj;
		
		configureSSLOnTheClient(userService);

		System.out.println(userService.list());
	}

	private static void configureSSLOnTheClient(Object obj) {
		File file = new File(MyServer.class.getResource("/com/googlecode/garbagecan/cxfstudy/ssl/test.jks").getFile());
		
		Client client = ClientProxy.getClient(obj);
		HTTPConduit httpConduit = (HTTPConduit) client.getConduit();

		try {
			TLSClientParameters tlsParams = new TLSClientParameters();
			tlsParams.setDisableCNCheck(true);

			KeyStore keyStore = KeyStore.getInstance("JKS");
			String password = "mypassword";
			String storePassword = "mypassword";
			
			keyStore.load(new FileInputStream(file), storePassword.toCharArray());
			TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
			trustFactory.init(keyStore);
			TrustManager[] trustManagers = trustFactory.getTrustManagers();
			tlsParams.setTrustManagers(trustManagers);

			keyStore.load(new FileInputStream(file), storePassword.toCharArray());
			KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
			keyFactory.init(keyStore, password.toCharArray());
			KeyManager[] keyManagers = keyFactory.getKeyManagers();
			tlsParams.setKeyManagers(keyManagers);
			
			FiltersType filtersTypes = new FiltersType();
			filtersTypes.getInclude().add(".*_EXPORT_.*");
			filtersTypes.getInclude().add(".*_EXPORT1024_.*");
			filtersTypes.getInclude().add(".*_WITH_DES_.*");
			filtersTypes.getInclude().add(".*_WITH_NULL_.*");
			filtersTypes.getExclude().add(".*_DH_anon_.*");
			tlsParams.setCipherSuitesFilter(filtersTypes);

			httpConduit.setTlsClientParameters(tlsParams);
		} catch (Exception e) {
			e.printStackTrace();
		}
	}
}

5. 我們需要手動生成jks文件，並將其放在maven工程resources的/com/googlecode/garbagecan/cxfstudy/ssl/目錄下，下面是手動生成時使用的命令

keytool -genkey -alias test -keyalg RSA -keypass mypassword -storepass mypassword -dname "CN=, OU=, O=, L=, ST=, C=" -validity 3650 -keystore test.jks

keytool -genkey -alias test -keyalg RSA -keypass mypassword -storepass mypassword -dname "CN=, OU=, O=, L=, ST=, C=" -validity 3650 -keystore test.jks

6. 最後我們可以通過啓動MyServer和MyClient來驗證我們的測試。