WSO2 Application Server 5.3.0 中的安全 Web 服务

Question

我正在尝试保护 WSO2 Application Server 5.3.0 中的axis2 Web 服务，但Unsecured/Secured 链接被禁用。

在 5.0.0 版本中，我可以点击服务列表中的Unsecured 链接或Service Dashboard > Quality of Service Configuration 中的Security 链接。

我是否需要安装一些功能/模块才能使安全在 5.3.0 中正常工作？
（Quality of Service Configuration 也没有出现在 5.3.0 中）。

Answer 1

贡卡尔维斯。 这个配置对我有用，使用 WSO2 AS 5.3.0。

你需要进入 echo.aar/META-INF/service.xml 并把这个xml：

<service name="echo" serviceDocumentation="echo" exposedAllTransports="false" serviceDeployedTime="1386978405019" successfullyAdded="true" serviceActive="true" utEnabled="true">
    <operation name="echoStringArrays">
        <module name="addressing" version="4.4.1" type="engagedModules"/>
        <module name="rampart" version="1.61-wso2v14" type="engagedModules"/>
    </operation>
    <operation name="echoOMElement">
                    <module name="addressing" version="4.4.1" type="engagedModules"/>
        <module name="rampart" version="1.61-wso2v14" type="engagedModules"/>
    </operation>
    <operation name="echoInt">
        <module name="addressing" version="4.4.1" type="engagedModules"/>
        <module name="rampart" version="1.61-wso2v14" type="engagedModules"/>
    </operation>
    <operation name="throwAxisFault">
        <module name="addressing" version="4.4.1" type="engagedModules"/>
        <module name="rampart" version="1.61-wso2v14" type="engagedModules"/>
    </operation>
    <operation name="echoString">
        <module name="addressing" version="4.4.1" type="engagedModules"/>
        <module name="rampart" version="1.61-wso2v14" type="engagedModules"/>
    </operation>
    <bindings>
        <binding name="echoHttpBinding">
            <operation name="echoStringArrays"/>
            <operation name="echoOMElement"/>
            <operation name="echoInt"/>
            <operation name="throwAxisFault"/>
            <operation name="echoString"/>
            <policyUUID>UTOverTransport</policyUUID>
        </binding>
        <binding name="echoSoap11Binding">
            <operation name="echoStringArrays"/>
            <operation name="echoOMElement"/>
            <operation name="echoInt"/>
            <operation name="throwAxisFault"/>
            <operation name="echoString"/>
            <policyUUID>UTOverTransport</policyUUID>
        </binding>
        <binding name="echoSoap12Binding">
            <operation name="echoStringArrays"/>
            <operation name="echoOMElement"/>
            <operation name="echoInt"/>
            <operation name="throwAxisFault"/>
            <operation name="echoString"/>
            <policyUUID>UTOverTransport</policyUUID>
        </binding>
    </bindings>
 <wsp:PolicyAttachment xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">  
   <wsp:AppliesTo>  
     <policy-subject identifier="binding:soap11"/>  
     <policy-subject identifier="binding:soap12"/>  
   </wsp:AppliesTo>                 
            <wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UTOverTransport">
                <wsp:ExactlyOne>
                    <wsp:All>
                        <sp:TransportBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                            <wsp:Policy>
                                <sp:TransportToken>
                                    <wsp:Policy>
                                        <sp:HttpsToken RequireClientCertificate="false"/>
                                    </wsp:Policy>
                                </sp:TransportToken>
                                <sp:AlgorithmSuite>
                                    <wsp:Policy>
                                        <sp:Basic256/>
                                    </wsp:Policy>
                                </sp:AlgorithmSuite>
                                <sp:Layout>
                                    <wsp:Policy>
                                        <sp:Lax/>
                                    </wsp:Policy>
                                </sp:Layout>
                                <sp:IncludeTimestamp/>
                            </wsp:Policy>
                        </sp:TransportBinding>
                        <sp:SignedSupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                            <wsp:Policy>
                                <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"/>
                            </wsp:Policy>
                        </sp:SignedSupportingTokens>
                    </wsp:All>
                </wsp:ExactlyOne>
                <rampart:RampartConfig xmlns:rampart="http://ws.apache.org/rampart/policy">
                    <rampart:encryptionUser>useReqSigCert</rampart:encryptionUser>
                    <rampart:timestampPrecisionInMilliseconds>true</rampart:timestampPrecisionInMilliseconds>
                    <rampart:timestampTTL>300</rampart:timestampTTL>
                    <rampart:timestampMaxSkew>300</rampart:timestampMaxSkew>
                    <rampart:timestampStrict>false</rampart:timestampStrict>
                    <rampart:tokenStoreClass>org.wso2.carbon.security.util.SecurityTokenStore</rampart:tokenStoreClass>
                    <rampart:nonceLifeTime>300</rampart:nonceLifeTime>
                </rampart:RampartConfig>
  <sec:CarbonSecConfig xmlns:sec="http://www.wso2.org/products/carbon/security">
     <sec:Authorization>
        <sec:property name="org.wso2.carbon.security.allowedroles">admin,sys-admin
        </sec:property>
     </sec:Authorization>
  </sec:CarbonSecConfig>                    
            </wsp:Policy>
         </wsp:PolicyAttachment>  
<transports> 
    <transport>https</transport> 
</transports>
<parameter name="ServiceClass" locked="true">org.wso2.carbon.core.services.echo.Echo</parameter>
 <module ref="rampart"/>
</service>

Answer 2

QoS 功能已从所有基于 carbon kernel 4.4.x 的产品中移除。因此，您必须使用 wso2 Developer studio 或手动编辑 services.xml 文件，如@Jorge 所述，以便为您的axis2服务应用安全性。

带有用户名策略的示例 service.xml 如下所示

<service name="echo">
    <schema elementFormDefaultQualified="false"/>
    <description>
        This service echos the input provided to it.
    </description>
    <transports> 
        <transport>https</transport> 
        <transport>http</transport> 
    </transports>
    <parameter name="ServiceClass" locked="true">org.wso2.carbon.core.services.echo.Echo</parameter>
                <wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UTOverTransport">
                    <wsp:ExactlyOne>
                        <wsp:All>
                            <sp:TransportBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                                <wsp:Policy>
                                    <sp:TransportToken>
                                        <wsp:Policy>
                                            <sp:HttpsToken RequireClientCertificate="false"/>
                                        </wsp:Policy>
                                    </sp:TransportToken>
                                    <sp:AlgorithmSuite>
                                        <wsp:Policy>
                                            <sp:Basic256/>
                                        </wsp:Policy>
                                    </sp:AlgorithmSuite>
                                    <sp:Layout>
                                        <wsp:Policy>
                                            <sp:Lax/>
                                        </wsp:Policy>
                                    </sp:Layout>
                                    <sp:IncludeTimestamp/>
                                </wsp:Policy>
                            </sp:TransportBinding>
                            <sp:SignedSupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                                <wsp:Policy>
                                    <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"/>
                                </wsp:Policy>
                            </sp:SignedSupportingTokens>
                        </wsp:All>
                    </wsp:ExactlyOne>
                    <rampart:RampartConfig xmlns:rampart="http://ws.apache.org/rampart/policy">
                        <rampart:encryptionUser>useReqSigCert</rampart:encryptionUser>
                        <rampart:timestampPrecisionInMilliseconds>true</rampart:timestampPrecisionInMilliseconds>
                        <rampart:timestampTTL>300</rampart:timestampTTL>
                        <rampart:timestampMaxSkew>300</rampart:timestampMaxSkew>
                        <rampart:timestampStrict>false</rampart:timestampStrict>
                        <rampart:tokenStoreClass>org.wso2.carbon.security.util.SecurityTokenStore</rampart:tokenStoreClass>
                        <rampart:nonceLifeTime>300</rampart:nonceLifeTime>
                    </rampart:RampartConfig>
 <sec:CarbonSecConfig xmlns:sec="http://www.wso2.org/products/carbon/security">
        <sec:Authorization>
            <sec:property name="org.wso2.carbon.security.allowedroles">admin</sec:property>
        </sec:Authorization>
    </sec:CarbonSecConfig>
                </wsp:Policy>
        <module ref="rampart"/>
</service>