基于声明的Sharepoint站点和Apache CXF STSClient通信

我们目前正在开发一个项目，我们需要在使用基于声明的身份验证的Sharepoint 2016站点中访问Sharepoint Foundation Web服务API。用于提供索赔的安全令牌服务是托管在Win2k12服务器上的ADFS 2.0。用户需要出示他的电子邮件地址以便进行认证并获取安全令牌以进行进一步操作。基于声明的Sharepoint站点和Apache CXF STSClient通信

注：由于这是我们使用的是自签名证书的ADFS端点的开发设置

我们使用Apache CXF 2.7.12和JDK 8的客户端开发堆栈访问本网站服务。当我们请求令牌时，在WARNING级别会记录与HttpsToken断言失败相关的异常，然后不会发生任何事情。电话没有完成，我们必须杀死这个过程。

由于这是我们第一次使用CXF，要求在如何解决这个问题上提供一些帮助和指导。我们已经提到了以下网站进行初步调查，但没有人似乎与这个特殊的问题是帮助我们：

Using Apache CXF to connect CRM Dynamics

Apache CXF Client Configuration options

下面是WS-政策对SharePoint站点可在URL

<wsp:Policy wsu:Id="UserNameWSTrustBinding_IWSTrust13Async_policy"> 
<wsp:ExactlyOne> 
<wsp:All> 
<sp:TransportBinding> 
<wsp:Policy> 
<sp:TransportToken> 
<wsp:Policy> 
<sp:HttpsToken/> 
</wsp:Policy> 
</sp:TransportToken> 
<sp:AlgorithmSuite> 
<wsp:Policy> 
<sp:Basic256/> 
</wsp:Policy> 
</sp:AlgorithmSuite> 
<sp:Layout> 
<wsp:Policy> 
<sp:Strict/> 
</wsp:Policy> 
</sp:Layout> 
<sp:IncludeTimestamp/> 
</wsp:Policy> 
</sp:TransportBinding> 
<sp:SignedEncryptedSupportingTokens> 
<wsp:Policy> 
<sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"> 
<wsp:Policy> 
<sp:WssUsernameToken10/> 
</wsp:Policy> 
</sp:UsernameToken> 
</wsp:Policy> 
</sp:SignedEncryptedSupportingTokens> 
<sp:EndorsingSupportingTokens> 
<wsp:Policy> 
<sp:KeyValueToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never" wsp:Optional="true"/> 
<sp:SignedParts> 
<sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/> 
</sp:SignedParts> 
</wsp:Policy> 
</sp:EndorsingSupportingTokens> 
<sp:Wss11> 
<wsp:Policy/> 
</sp:Wss11> 
<sp:Trust13> 
<wsp:Policy> 
<sp:MustSupportIssuedTokens/> 
<sp:RequireClientEntropy/> 
<sp:RequireServerEntropy/> 
</wsp:Policy></sp:Trust13> 
<wsaw:UsingAddressing/> 
</wsp:All> 
</wsp:ExactlyOne> 
</wsp:Policy>

我们现在配置STSClient如下：

STSClient spSTSClient = new STSClient(bus); 
spSTSClient.setTrust(new Trust10(SP12Constants.INSTANCE)); 
spSTSClient.setSoap12(); 


//would we also also need to set the token type and key type? 

// spSTSClient.setTokenType("urn:oasis:names:tc:SAML:2.0:assertion"); 
//spSTSClient.setKeyType("http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer");   

spSTSClient.setWsdlLocation("https://myadfsserver.com/adfs/services/trust/mex"); 
spSTSClient.setServiceName("{http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}SecurityTokenService"); 
    spSTSClient.setEndpointName("{http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}UserNameWSTrustBinding_IWSTrust13Async"); 
      spSTSClient.setAddressingNamespace("http://www.w3.org/2005/08/addressing"); String sharePointUsername = “[email protected]"; 
String sharePointPassword = “foobar#”; 

SecurityToken secToken = spsSTSClient.requestSecurityToken("http://mysharepointsite.com/_trust");

的requestSecurityToken调用抛出一个如下图所示的警告：

WARNING: Interceptor for {http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}SecurityTokenService#{http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}Trust13IssueAsync has thrown exception, unwinding now 
org.apache.cxf.ws.policy.PolicyException: Assertion of type {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}HttpsToken could not be asserted: Not an HTTPs connection 
    at org.apache.cxf.ws.security.policy.interceptors.HttpsTokenInterceptorProvider$HttpsTokenOutInterceptor.assertHttps(HttpsTokenInterceptorProvider.java:144) 
    at org.apache.cxf.ws.security.policy.interceptors.HttpsTokenInterceptorProvider$HttpsTokenOutInterceptor.handleMessage(HttpsTokenInterceptorProvider.java:87) 
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272) 
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:570) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:479) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:382) 
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:335)

来源

2016-11-14 Prahalad Deshpande

的WSDL要求TransportBinding可以使用，但您使用的不是“https”开头的网址，如：“http://mysharepointsite.com/_trust”

来源

2016-11-21 10:30:49

谢谢你的回应。我意识到这是代码中的一个错字。但是，即使做了这个改变，问题仍然存在。解决此问题的唯一方法是使用空WSP策略指定策略覆盖。但是我知道这是一个* Hack *。任何其他技巧疑难解答将是伟大的。另外，使用这个空的策略XML，Https错误消失了，但是现在我收到一个错误，表示{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}TransportBinding：Received Timestamp不匹配要求。这意味着什么？ –

基于声明的Sharepoint站点和Apache CXF STSClient通信

回答

相关问题