XFire官方網(wǎng)站提供的基于Webservice認(rèn)證的例子有問(wèn)題，在新版本的XFire1.1.2中編譯不通過(guò)，不過(guò)這也是小Case，我后來(lái)折騰了一下，為SpringSide提供了一個(gè)簡(jiǎn)單的Webservice認(rèn)證功能。
XFire跟Spring的天然融合，讓我們可以少努力10年就能簡(jiǎn)單地在Spring中使用Webservice的強(qiáng)大魅力，我從AXIS專向XFire有一些沖動(dòng)，也吃了不少虧，但受REST一族的強(qiáng)力吹捧，感覺(jué)還是值得嘗試的，因此，在公司的系統(tǒng)中也把Axis徹底換了XFire。
回到SpringSide，我大概介紹一下如何配置一個(gè)真正實(shí)用的XFire驗(yàn)證服務(wù)。
SpringSide中的XFire配置文件放在：
SpringSide-bookstore\src\org\springside\bookstore\plugins\webservice\applicationContext-webservice-server.xml
我們?cè)诶锩娑x各個(gè)Webservice，該文件其實(shí)對(duì)應(yīng)于XFire官方的XFire-Servlet.xml
看看下面的BookService，這是一個(gè)典型的Webservice服務(wù)，紅色的inHandlers是我掛上去的。它的意思是所有訪問(wèn)BookService的請(qǐng)求都會(huì)被先送到
authenticationHandler去處理，我們的驗(yàn)證邏輯可以在里面進(jìn)行。
????<!--Web Service 在SpringMVC中的URL 路徑映射-->
??? <bean class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
??????? <property name="mappings">
??????????? <value>/BookService=bookWebService</value>
??????? </property>
??????? <property name="inHandlers">
??????????? <ref bean="authenticationHandler"/>
??????? </property>??? </bean>
我們接著看看
authenticationHandler的代碼：
我們?cè)赟pringSide中通過(guò)header方式向服務(wù)器提供驗(yàn)證信息（另外一種更簡(jiǎn)單的方式是創(chuàng)建一個(gè)Login的webservice服務(wù)，然后在XFire Session中建立Token信息）。
package?org.springside.bookstore.plugins.webservice.authentication;
import?org.apache.log4j.Logger;
import?org.codehaus.xfire.MessageContext;
import?org.codehaus.xfire.exchange.InMessage;
import?org.codehaus.xfire.fault.XFireFault;
import?org.codehaus.xfire.handler.AbstractHandler;
import?org.jdom.Element;
import?org.jdom.Namespace;
/**
?*?XFire的回調(diào)的Handler，在XFire配置文件中配置
?*?Server端的認(rèn)證模塊，回調(diào)處理模塊
?*?
?*?ClientAuthHandler跟AuthenticationHandler要一起用，或者都不用
?*?
?*?@author??david.turing
?*?@blog??openssl.blogjava.net
?*
?*/
public?class?AuthenticationHandler?extends?AbstractHandler?{
????private?static?final?Logger?log?=?Logger.getLogger(AuthenticationHandler.class);
????
????public?void?invoke(MessageContext?context)?throws?Exception?{
????????
????????log.info("#AuthenticationHandler?is?invoked");
????????InMessage?message=context.getInMessage();
????????
????????final?Namespace?TOKEN_NS?=?Namespace.getNamespace("SpringSide","http://service.webservice.plugins.bookstore.springside.org");??
????????
????????if(message.getHeader()==null)
????????{
????????????throw?new?XFireFault("GetRelation?Service?Should?be?Authenticated",
????????????????????XFireFault.SENDER);
????????}
????????
????????Element?token?=?message.getHeader().getChild("AuthenticationToken",?TOKEN_NS);
????????if?(token?==?null)
????????{
????????????throw?new?XFireFault("Request?must?include?authentication?token.",
?????????????????????????????????XFireFault.SENDER);
????????}
????????String?username?=?token.getChild("Username",?TOKEN_NS).getValue();
????????String?password?=?token.getChild("Password",?TOKEN_NS).getValue();
????????System.out.println("username="+username);????????
????????System.out.println("password="+password);
????????
????????if(username==null||password==null)
????????????throw?new?XFireFault("Supplied?Username?and?Password?Please",
????????????????????XFireFault.SENDER);
????????
????????/**
?????????*?檢查用戶名密碼是否正確
?????????*/
????????PasswordAuthenticationManager?pamanager=new?PasswordAuthenticationManager();
????????if(!pamanager.authenticate(username,password))
????????????throw?new?XFireFault("Authentication?Fail!?Check?username/password",
????????????????????XFireFault.SENDER);
?
????????
????}
}
注意，XFireFault異常是往客戶端拋的，Webservice Client應(yīng)該學(xué)會(huì)catch XFireFault.
服務(wù)器端就是這么簡(jiǎn)單，看看客戶端的TestCase
package?org.springside.bookstore.plugins.webservice.service;
import?java.lang.reflect.Proxy;
import?java.net.MalformedURLException;
import?java.util.List;
import?org.codehaus.xfire.client.Client;
import?org.codehaus.xfire.client.XFireProxy;
import?org.codehaus.xfire.client.XFireProxyFactory;
import?org.codehaus.xfire.service.Service;
import?org.codehaus.xfire.service.binding.ObjectServiceFactory;
import?org.springside.bookstore.commons.domain.Book;
import?org.springside.bookstore.plugins.webservice.authentication.ClientAuthHandler;
import?junit.framework.TestCase;
public?class?BookServiceWithAuthenticationTestCase?extends?TestCase?{
????protected?void?setUp()?throws?Exception?{
????????super.setUp();
????}
????protected?void?tearDown()?throws?Exception?{
????????super.tearDown();
????}
????
????public?void?getBookFromWebservice()?throws?Exception{
????
??????????Service?serviceModel?=?new?ObjectServiceFactory()
????????????????.create(BookService.class);
????????BookService?service?=?null;
????????
????????try?{
????????????service=(BookService)?new?XFireProxyFactory().create(
????????????????????serviceModel,
????????????????????"http://localhost:8080/springside/service/BookService");
????????}?catch?(MalformedURLException?e)?{
????????????e.printStackTrace();
????????}
????????
????????Client?client?=?((XFireProxy)?Proxy.getInvocationHandler(service)).getClient();
????????//掛上ClientAuthHandler，提供認(rèn)證
????????client.addOutHandler(new?ClientAuthHandler());
????????List?list?=?service.findBooksByCategory(null);
????????assertNotNull(list);
????????for(int?i=0;i<list.size();i++)
????????????System.out.println(((Book)list.get(i)).getName());
????}
}
你應(yīng)該看到上面的client.addOutHandler(new ClientAuthHandler());
沒(méi)錯(cuò)，它跟服務(wù)器端的AuthenticationHandler是一對(duì)，一起使用的！
也就是，每個(gè)被送往WebService服務(wù)的請(qǐng)求都被ClientAuthHandler處理過(guò)了。
看看ClientAuthHandler做了些什么：
package?org.springside.bookstore.plugins.webservice.authentication;
import?org.apache.log4j.Logger;
import?org.codehaus.xfire.MessageContext;
import?org.codehaus.xfire.handler.AbstractHandler;
import?org.jdom.Element;
import?org.jdom.Namespace;
/**
?*?客戶端端的認(rèn)證模塊，回調(diào)處理模塊
?*?每個(gè)需要認(rèn)證的WebService方法都可以掛這個(gè)Handler
?*?
?*?僅用于Demo，從解耦和易用性出發(fā)，
?*?沒(méi)有跟Acegi結(jié)合，你可以任意擴(kuò)展
?*?默認(rèn)用戶名/密碼是admin/admin
?*?
?*?ClientAuthHandler跟AuthenticationHandler要一起用，或者都不用
?*?
?*?@author??david.turing
?*
?*?@blog?openssl.blogjava.net
?*/????
public?class?ClientAuthHandler?extends?AbstractHandler?{
????????private?static?final?Logger?log?=?Logger.getLogger(ClientAuthHandler.class);
????????
????????//客戶端自己配置用戶名密碼或者更安全的KeyStore方式
????????private?String?username?=?"admin";
????????private?String?password?=?"admin";
????????
????????public?ClientAuthHandler()?{
????????}
????????
????????public?ClientAuthHandler(String?username,String?password)?{
????????????this.username?=?username;
????????????this.password?=?password;
????????}
????????
????????public?void?setUsername(String?username)?{
????????????this.username?=?username;
????????}
????????
????????public?void?setPassword(String?password)?{
????????????this.password?=?password;
????????}
????????
????????public?void?invoke(MessageContext?context)?throws?Exception?{
????????????????????????
????????????/*******************************************
?????????????*?Soap?Header方式
?????????????*?從Soap?Header中獲取用戶名密碼
?????????????*******************************************/
????????????final?Namespace?ns?=?Namespace.getNamespace("SpringSide","http://service.webservice.plugins.bookstore.springside.org");??
????????????Element?el?=?new?Element("header",ns);
????????????Element?auth?=?new?Element("AuthenticationToken",?ns);
????????????Element?username_el?=?new?Element("Username",ns);
????????????username_el.addContent(username);
????????????Element?password_el?=?new?Element("Password",ns);
????????????password_el.addContent(password);
????????????auth.addContent(username_el);
????????????auth.addContent(password_el);
????????????el.addContent(auth);????????????
????????????context.getCurrentMessage().setHeader(el);????????????
????????????log.info("ClientAuthHandler?done!");
????????}
????}
不就是往header里面注入username,password！
在SpringSide中，所有的Spring配置文件都被小白分散到各個(gè)Module中去了，Wuyu原先是在Plugin中提供Webservice功能，因此，我仍然在Plugin中創(chuàng)建XFire接口。
SpringSide的Spring配置文件放在:
SpringSide-bookstore\webapp\WEB-INF\springmvc-servlet.xml
該文件定義了Plugin的xml:
AuthenticationHandler這個(gè)Bean需要先定義在Plugins-servlet.xml中，其它很簡(jiǎn)單，大家去Try一下就知道了。