基于Xfire SOAP Header的WebService安全验证（xfire服务端，jax-

WebSerice是一种开放的web服务，任何人都可以访问，但我们有时候需要考虑只有付费用户才能使用WS,所以，我们就需要对WS加入安全验证机制，当然，可以利用防火墙的IP过滤，web应用的配置从最外层去隔离非法用户，但在内层，我们也可以使用SOAP Header的方式，由客户端发送验证数据，服务端验通过后基WS访问权限

首先根据我的这篇Blog

配置WS Server和WS Client，其中Client端的测试代码类名由Client改为ClientTest,因为我们要用到Xfire的一个名为Client的类?

?

首先我们编写服务端验证类继承AbstractHandler

?

?

xfire客户端实现身份

?

为ClientTest.java加入以下代码

???????public static void main(String[] args) {
?? ??? ?WebsiteAuthentClient Website = new WebsiteAuthentClient();
?? ???? WebsiteAuthentPortType service = Website.getWebsiteAuthentHttpPort();
?? ????XFireProxy proxy = (XFireProxy)Proxy.getInvocationHandler(service);
????? Client client = proxy.getClient();
????? client.addOutHandler(new ClientAuthenticationHandler("abcd1","1234"));
?? ??? ?service.test("sdf");
?? ?}

等等，还没有完，修改Services.xm为WS绑定Handler

??

这样我们就完成了编码，下面启动tomcat，运行客户端代码，本文为abcd@1234位授权用户，使用abcd@1234,可以正常访问WS,如果用错误帐号，则会有以下异常

?

?

如果不在CientTest加以下增加Heade则会有以下异常

?XFireProxy proxy = (XFireProxy)Proxy.getInvocationHandler(service);
Client client = proxy.getClient();
?client.addOutHandler(new ClientAuthenticationHandler("abcd1","1234"));

jax-ws客户端实现身份

import java.util.ArrayList;
import java.util.List;
import java.util.Set;
import java.util.TreeSet;

import javax.xml.namespace.QName;
import javax.xml.soap.SOAPElement;
import javax.xml.soap.SOAPEnvelope;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPFactory;
import javax.xml.soap.SOAPHeader;
import javax.xml.soap.SOAPMessage;
import javax.xml.ws.handler.Handler;
import javax.xml.ws.handler.HandlerResolver;
import javax.xml.ws.handler.MessageContext;
import javax.xml.ws.handler.PortInfo;
import javax.xml.ws.handler.soap.SOAPHandler;
import javax.xml.ws.handler.soap.SOAPMessageContext;

public class ClientMain {

	@SuppressWarnings("unchecked")
	public static void main(String[] args) {
		WebsiteAuthent wa = new WebsiteAuthent();
                wa .setHandlerResolver(new HandlerResolver() {
			public List<Handler> getHandlerChain(PortInfo portInfo) {
				List<Handler> list = new ArrayList<Handler>();
				list.add(new MySOAPHandler());
				return list;
			}
		});
		WebsiteAuthentPortType service = wa.getWebsiteAuthentHttpPort();
		System.out.println(service.test("sdf"));
	}
}

class MySOAPHandler implements SOAPHandler<SOAPMessageContext> {public Set<QName> getHeaders() { return null;}public void close(MessageContext context) {}public boolean handleFault(SOAPMessageContext context) {throw new UnsupportedOperationException("Not supported yet.");}public boolean handleMessage(SOAPMessageContext context) {Boolean outboundProperty = (Boolean) context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);if (outboundProperty.booleanValue()) {SOAPMessage message = context.getMessage();try {SOAPEnvelope envelope = message.getSOAPPart().getEnvelope();SOAPFactory factory = SOAPFactory.newInstance();SOAPElement authenticationToken = factory.createElement("AuthenticationToken");SOAPElement userName = factory.createElement("userName");userName.setValue("abcd");SOAPElement password = factory.createElement("password");password.setValue("1234");authenticationToken.addChildElement(userName);authenticationToken.addChildElement(password);SOAPHeader header = envelope.addHeader();header.addChildElement(authenticationToken);} catch (SOAPException e) {e.printStackTrace();}}return true;}}