JAX-RPC 웹 서비스의 보안

<jeus-webservices-dd>
    <service>
        <webservice-description-name/>
        <port>
            <port-component-name/>
            <security>
                <request-receiver/>
                <response-sender/>
            </security>
        </port>
    </service>
</jeus-webservices-dd>

<jeus-web-dd>
    <service-ref>
        <service-client>
            <service-ref-name/>
            <port-info>
                <wsdl-port/>
                <security>
                    <request-sender/>
                    <response-receiver/>
                </security>
            </port-info>
            . . .
        </service-client>
        <service-client>
            . . .
        </service-client>
        . . .
    </service-ref>
</jeus-webservices-client-dd>

package jeustest.webservices.wssec.doall;

import com.tmax.ws.security.WSPasswordCallback;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import java.io.IOException;

public class PWCallback implements CallbackHandler {
    public void handle(Callback[] callbacks)
        throws IOException, UnsupportedCallbackException {
        for (int i = 0; i < callbacks.length; i++) {
            if (callbacks[i] instanceof WSPasswordCallback) {
                WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
                checkPassword(pc);
            } else {
                throw new UnsupportedCallbackException(
                    callbacks[i], "Unrecognized Callback");
            }
        }
    }

    public void checkPassword(WSPasswordCallback pc) {
        String userId = pc.getIdentifier();
        if (pc.getUsage() == WSPasswordCallback.USERNAME_TOKEN) {
            if (userId.equals("16c73ab6-b892-458f-abf5-2f875f74882e")) {
                pc.setPassword("security2");
            }
            if (userId.equals("key_tmax1")) {
                pc.setPassword("keypass_tmax1");
            }
        } else if (pc.getUsage() == WSPasswordCallback.DECRYPT) {
            if (userId.equals("16c73ab6-b892-458f-abf5-2f875f74882e")) {
                pc.setPassword("security");
            }
            if (userId.equals("key_tmax1")) {
                pc.setPassword("keypass_tmax1");
            }
        } else if(pc.getUsage() == WSPasswordCallback.SIGNATURE) {
            if (userId.equals("16c73ab6-b892-458f-abf5-2f875f74882e")) {
                pc.setPassword("security");
            }
            if (userId.equals("key_tmax1")) {
                pc.setPassword("keypass_tmax1");
            }
        }
    }
}

<%@ page language="java" %>
<%@ page import="javax.naming.*" %>
<%@ page import="javax.rmi.*" %>
<%@ page import="java.rmi.RemoteException" %>
<%@ page import="java.util.*" %>

<%@ page import="javax.naming.InitialContext" %>
<%@ page import="javax.xml.rpc.Service" %>
<%@ page import="javax.xml.namespace.QName" %>

<%@ page import="jeus.webservices.wssecurity.SecurityConfiguration"%>
<%@ page import="jeus.webservices.wssecurity.Keystore" %>

<%@ page import="ping.*" %>
<%@ page errorPage="/error.html" %>

<%! String msgToSend = "msg_sent_by_jspClient";
    String ret=null;
    String exceptionString="";
%>

<%
    try {

(1)     Keystore keystore = new Keystore ("JKS", "keystore_password",
                           "client-keystore.jks");
        Keystore truststore = new Keystore ("JKS","keystore_password",
                           "client-keystore.jks");

        InitialContext jndiContext = new InitialContext();

        Service service =
          (Service)jndiContext.lookup("java:comp/env/service/PingSecurityService");
        QName portName = new QName("urn:PingSecurityService", "PingPort");

(2)     SecurityConfiguration sconfig =
            new SecurityConfiguration(service, portName);
(3)     sconfig.setUsername("JEUS_CLIENT");
(4)     sconfig.setRequestPasswordCallbackClass("ping.PingPWCallback");

(5)     sconfig.addUTRequest(true, true);
(6)     sconfig.addSignRequest(null, "DirectReference", keystore);
(7)     sconfig.addEncryptRequest(null, "DirectReference",
            truststore, "JEUS_SERVER", null);

(4)     sconfig.setResponsePasswordCallbackClass("ping.PingPWCallback");
        sconfig.addUTResponse();
        sconfig.addSignResponse(truststore);
        sconfig.addDecryptResponse(keystore);

        java.rmi.Remote port = service.getPort(portName, Ping.class);
        Ping pingPort = (Ping)port;

        ((javax.xml.rpc.Stub)pingPort)._setProperty(
            javax.xml.rpc.Stub.ENDPOINT_ADDRESS_PROPERTY,
            "http://localhost:8088/PingSecurity" + "/PingSecurityService");

        System.out.println("Send : " + msgToSend);
        ret = pingPort.ping(msgToSend);
        System.out.println("You received : " + ret);
    } catch (Exception e) {
        exceptionString = e.toString();
        e.printStackTrace();
    }
%>
<%= "Result is " + ret + "......"
%>
<%= exceptionString
%>

JEUS_HOME/config/{NODE_NAME}/security/{SECURITY_DOMAIN_NAME}/accounts.xml

<accounts xmlns="http://www.tmaxsoft.com/xml/ns/jeus">
    <users>
        <user>
            <name>jeus</name>
            <password>{SHA}McbQlyhI3yiOG1HGTg8DQVWkyhg=</password>
        </user>
    </users>
</accounts>

<jeus-web-dd xmlns="http://www.tmaxsoft.com/xml/ns/jeus">
    <docbase>BA_DocLitEchoService</docbase>
    <role-mapping>
        <role-permission>
            <principal>jeus</principal>
            <role>Administrator</role>
        </role-permission>
    </role-mapping>
</jeus-web-dd>

<web-app…>
    . . .
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>MySecureBit</web-resource-name>
            <url-pattern>/BA_DocLitEchoService</url-pattern>
            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>Administrator</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>NONE</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>default</realm-name>
    </login-config>
</web-app>

JEUS_HOME/config/{NODE_NAME}/security/{SECURITY_DOMAIN_NAME}/accounts.xml

<accounts xmlns="http://www.tmaxsoft.com/xml/ns/jeus">
    <users>
        <user>
            <name>jeus</name>
            <password>{SHA}McbQlyhI3yiOG1HGTg8DQVWkyhg=</password>
        </user>
    </users>
</accounts>

<jeus-ejb-dd xmlns="http://www.tmaxsoft.com/xml/ns/jeus">
    <module-info>
        <role-permission>
            <principal>jeus</principal>
            <role>Administrator</role>
        </role-permission>
    </module-info>
    <beanlist>
        …
    </beanlist>
</jeus-ejb-dd>

<?xml version="1.0" encoding="UTF-8"?>
<ejb-jar …>
    <display-name>AddressEjb</display-name>
    <enterprise-beans>
        …
    </enterprise-beans>
    <assembly-descriptor>
        <security-role>
            <role-name>Administrator</role-name>
        </security-role>
        <method-permission>
            <role-name>Administrator</role-name>
            <method>
                <ejb-name>AddressEJB</ejb-name>
                <method-intf>ServiceEndpoint</method-intf>
                <method-name>listAll</method-name>
            </method>
        </method-permission>
    </assembly-descriptor>
</ejb-jar>

<jeus-webservices-dd xmlns="http://www.tmaxsoft.com/xml/ns/jeus">
    <ejb-context-path>webservice</ejb-context-path>
    <ejb-login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>default</realm-name>
    </ejb-login-config>
    <service>
        <webservice-description-name>…</webservice-description-name>
        <port>
            <port-component-name>…</port-component-name>
            <ejb-endpoint-url>… </ejb-endpoint-url>
            <ejb-transport-guarantee>
                CONFIDENTIAL
            </ejb-transport-guarantee>
        </port>
    </service>
</jeus-webservices-dd>

wsdl2java -gen:client -username jeus -password jeus
http://localhost:8088/BA_DocLitEchoService/BA_DocLitEchoService?wsdl

Echo port = // … 서비스 Endpoint 인터페이스의 획득
((javax.xml.rpc.Stub) port)._setProperty(javax.xml.rpc.Stub.USERNAME_PROPERTY, "jeus");
((javax.xml.rpc.Stub) port)._setProperty(javax.xml.rpc.Stub.PASSWORD_PROPERTY, "jeus");
String s = port.echoString("JEUS");