soap - 访问被拒绝用户是匿名的-spring boot ws基本身份验证
问题描述
我正在使用 spring boot 开发一个演示应用程序。所以这个想法是创建一个soap webservice并向它添加一个基本的http身份验证。我在网上遵循了一些教程,但这并不能帮助我解决问题。
起初,我创建了一个简单的soap web 服务,并使用soapui 对其进行了测试。它完美地工作。当我将spring security添加到类路径时,我成功打开了我的应用程序提供的wsdl(使用我的浏览器和spring默认提供的登录表单)。但即使在添加了身份验证标头之后,它也无法使用soapui 使用网络服务。
这是我的应用程序配置。
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web-services</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
</dependencies>
应用程序.yml
spring:
security:
basic:
enabled: true
user:
name: client
password: password
WebServiceConfig.java
@EnableWs
@Configuration
public class WebServiceConfig extends WsConfigurerAdapter {
@Bean
public ServletRegistrationBean<Servlet> messageDispatcherServlet(ApplicationContext applicationContext) {
MessageDispatcherServlet servlet = new MessageDispatcherServlet();
servlet.setApplicationContext(applicationContext);
return new ServletRegistrationBean<>(servlet, "/ws/library/*");
}
@Bean(name = "books")
public Wsdl11Definition defaultWsdl11Definition() {
SimpleWsdl11Definition wsdl11Definition = new SimpleWsdl11Definition();
wsdl11Definition.setWsdl(new ClassPathResource("/book.wsdl"));
return wsdl11Definition;
}
}
BookEndpoint.java
@Endpoint
public class BookEndpoint {
@PayloadRoot(
namespace = "http://www.cleverbuilder.com/BookService/",
localPart = "GetBook")
@ResponsePayload
public GetBookResponse getBook(@RequestPayload GetBook book) {
ObjectFactory factory = new ObjectFactory();
GetBookResponse response = factory.createGetBookResponse();
response.setID("A"+book.getID());
return response;
}
}
soapui生成的请求如下:
POST http://localhost:8080/ws/library/BookService HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://www.cleverbuilder.com/BookService/GetBook"
Authorization: Basic Y2xpZW50OnBhc3N3b3Jk
Content-Length: 280
Host: localhost:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
Cookie: JSESSIONID=77EF4FFB2B5A52EC21A47C230624B6DE
Cookie2: $Version=1
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:book="http://www.cleverbuilder.com/BookService/">
<soapenv:Header/>
<soapenv:Body>
<book:GetBook>
<ID>85</ID>
</book:GetBook>
</soapenv:Body>
</soapenv:Envelope>
和服务器响应:
HTTP/1.1 401
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
WWW-Authenticate: Basic realm="Realm"
Content-Length: 0
Date: Mon, 22 Apr 2019 09:08:43 GMT
记录的错误是:
Voter: org.springframework.security.web.access.expression.WebExpressionVoter@77114100, returned: -1
ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
谁能帮帮我?
解决方案
问题是crsf保护。我能够通过禁用它来解决问题。这是我添加的配置。
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf()
.disable();
}
}
推荐阅读
- swift - 使用 Codable 在 Swift 中带有子集合的 Firebase 文档
- django - 在管理员中按外键搜索
- javascript - Google Place 搜索、文本搜索和附近搜索不会返回某些完全匹配的内容
- reporting-services - SSRS 报告 - 透视数据(最后一列分组)
- regex - 在模式“字符串”匹配之前和之后添加空白行
- python - 为什么结果不同,尽管代码完全相同?
- android - 如何将特定数据从 firebase 子节点检索到 Android Studio
- javascript - 如何检查 JavaScript 对象中是否包含值?
- couchdb - bind: 地址已经在使用中怎么办?
- ruby - 我遇到了这种方法,但我可以阅读 def 流派,但我无法获得 (&:genre)