使用wss4jsecurityinterceptor实现spring安全性 - 使用两个密钥配置签名和加密的安全性

Question

我试图通过在https://memorynotfound.com/spring-ws-certificate-authentication-wss4j/上阅读本教程来添加拦截器来保护spring-ws

我需要在单个密钥库（server.jks-文件）中使用两个单独的公钥 - 私钥（一个用于签名，第二个用于加密）。但是我无法配置安全拦截器。

如果使用单个密钥库，它在示例中工作正常，但是如果用于签名和加密的单独密钥，我应该如何设置以下内容

@Bean
public KeyStoreCallbackHandler securityCallbackHandler(){
    KeyStoreCallbackHandler callbackHandler = new KeyStoreCallbackHandler();
    callbackHandler.setPrivateKeyPassword("changeit");
    return callbackHandler;
}

@Bean
public Wss4jSecurityInterceptor securityInterceptor() throws Exception {
    Wss4jSecurityInterceptor securityInterceptor = new Wss4jSecurityInterceptor();

    // validate incoming request
    securityInterceptor.setValidationActions("Timestamp Signature Encrypt");
    securityInterceptor.setValidationSignatureCrypto(getCryptoFactoryBean().getObject());
    securityInterceptor.setValidationDecryptionCrypto(getCryptoFactoryBean().getObject());
    securityInterceptor.setValidationCallbackHandler(securityCallbackHandler());

    // encrypt the response
    securityInterceptor.setSecurementEncryptionUser("client-public");
    securityInterceptor.setSecurementEncryptionParts("{Content}{https://memorynotfound.com/beer}getBeerResponse");
    securityInterceptor.setSecurementEncryptionCrypto(getCryptoFactoryBean().getObject());

    // sign the response
    securityInterceptor.setSecurementActions("Signature Encrypt");
    securityInterceptor.setSecurementUsername("server");
    securityInterceptor.setSecurementPassword("changeit");
    securityInterceptor.setSecurementSignatureCrypto(getCryptoFactoryBean().getObject());

    return securityInterceptor;
}

@Bean
public CryptoFactoryBean getCryptoFactoryBean() throws IOException {
    CryptoFactoryBean cryptoFactoryBean = new CryptoFactoryBean();
    cryptoFactoryBean.setKeyStorePassword("changeit");
    cryptoFactoryBean.setKeyStoreLocation(new ClassPathResource("server.jks"));
    return cryptoFactoryBean;
}

对于加密，我们有方法setSecurementEncryptionUser，但是我们如何使用别名来解密/验证setValidationDecryptionCrypto和setValidationSignatureCrypto

Answer 1

你能尝试2个securityInterceptor和2个密钥商店吗？一个用于签名，一个用于加密。然后将两个拦截器添加到拦截器列表中。

@Override
public void addInterceptors(List<EndpointInterceptor> interceptors) {
    try {
        interceptors.add(signatureSecurityInterceptor());
        interceptors.add(encryptionSecurityInterceptor());
    } catch (Exception e) {
        throw new RuntimeException("could not initialize security interceptor");
    }
}