CXF自定义拦截器实现权限控制

一. 拦截器

在我们学习Java的征途中碰到了很多拦截器: Servlet中的Filter就是一个拦截器, Struts2中也有拦截器,.

CXF中的拦截器其基本原理还是使用动态代理, 我们可以在不对核心模块进行修改的情况下, 动态添加一些功能, 从而降低代码的耦合性.

二. CXF拦截器

CXF通过在Interceptor中对消息进行特殊处理, 实现了很多重要功能模块, 例如: 日志记录, soap消息处理, 消息的压缩处理.

下面我们使用一个例子介绍CXF Log拦截器: 

1. 服务端添加日志拦截器:

public class MyServer {public static void main(String[] args) {HelloService helloService = new HelloServiceImpl();EndpointImpl epi = (EndpointImpl)Endpoint.publish("http://localhost/sayHello", helloService);epi.getInInterceptors().add(new LoggingInInterceptor()); // 添加服务器端in log拦截器epi.getOutInterceptors().add(new LoggingOutInterceptor()); // 添加服务器端out log拦截器System.out.println("Web Service 暴露成功");}}

2. 客户端添加日志拦截器

public class MyClient {public static void main(String[] args) {HelloServiceImplService factory = new HelloServiceImplService();HelloService helloService = factory.getHelloServiceImplPort();Client client = ClientProxy.getClient(helloService);client.getInInterceptors().add(new LoggingInInterceptor()); // 添加客户端in log拦截器client.getOutInterceptors().add(new LoggingOutInterceptor()); // 添加客户端out log拦截器System.out.println(helloService.sayHello("zhangsan"));}}

其他程序代码请参考上一篇博客: http://blog.csdn.net/zdp072/article/details/27829831

客户端需要引入以下jar包: cxf-2.2.10.jar  wsdl4j-1.6.2.jar  XmlSchema-1.4.5.jar

3. 日志如下:

- - 服务端

2014-6-7 23:04:28 org.apache.cxf.service.factory.ReflectionServiceFactoryBean buildServiceFromClass信息: Creating Service {http://impl.service.zdp.com/}HelloServiceImplService from class com.zdp.service.HelloService2014-6-7 23:04:28 org.apache.cxf.endpoint.ServerImpl initDestination信息: Setting the server's publish address to be http://localhost:80/sayHello2014-06-07 23:04:28.718::INFO:  Logging to STDERR via org.mortbay.log.StdErrLog2014-06-07 23:04:28.726::INFO:  jetty-6.1.212014-06-07 23:04:28.799::INFO:  Started SelectChannelConnector@localhost:80Web Service 暴露成功

- - 客户端

2014-6-7 23:05:26 org.apache.cxf.service.factory.ReflectionServiceFactoryBean buildServiceFromWSDL信息: Creating Service {http://impl.service.zdp.com/}HelloServiceImplService from WSDL: http://localhost/sayHello?wsdl2014-6-7 23:05:26 org.apache.cxf.interceptor.LoggingOutInterceptor$LoggingCallback onClose信息: Outbound Message---------------------------ID: 1Address: http://localhost/sayHelloEncoding: UTF-8Content-Type: text/xmlHeaders: {SOAPAction=[""], Accept=[*/*]}Payload: <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ns2:sayHello xmlns:ns2="http://service.zdp.com/"><arg0>zhangsan</arg0></ns2:sayHello></soap:Body></soap:Envelope>--------------------------------------2014-6-7 23:05:26 org.apache.cxf.interceptor.LoggingInInterceptor logging信息: Inbound Message----------------------------ID: 1Response-Code: 200Encoding: UTF-8Content-Type: text/xml; charset=utf-8Headers: {content-type=[text/xml; charset=utf-8], Content-Length=[275], Server=[Jetty(6.1.21)]}Payload: <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ns1:sayHelloResponse xmlns:ns1="http://service.zdp.com/"><return>zhangsan, 您好！ 现在的时间是: Sat Jun 07 23:05:26 CST 2014</return></ns1:sayHelloResponse></soap:Body></soap:Envelope>--------------------------------------zhangsan, 您好！ 现在的时间是: Sat Jun 07 23:05:26 CST 2014

三. CXF自定义拦截器

如何使用CXF进行权限控制呢?

思路: 服务器端要求input消息总是携带有用户名, 密码信息, 如果没有用户名和密码信息, 直接拒绝调用.\

代码实现:

1. 服务器端拦截器:

/**   * 服务端权限拦截器 */public class AuthInterceptor extends AbstractPhaseInterceptor<SoapMessage> {public AuthInterceptor() {super(Phase.PRE_INVOKE); //拦截器在调用方法之前拦截SOAP消息}    // 拦截器操作@Overridepublic void handleMessage(SoapMessage msg) throws Fault {System.out.println("come to auth interceptor...");//获取SOAP消息的所有HeaderList<Header> headers = msg.getHeaders();if(headers == null || headers.size() < 1) {throw new Fault(new IllegalArgumentException("没有Header,拦截器实施拦截"));}//获取Header携带是用户和密码信息Header firstHeader = headers.get(0);Element element = (Element) firstHeader.getObject();NodeList userNameElement = element.getElementsByTagName("userName");NodeList passwordElement = element.getElementsByTagName("password");if (userNameElement.getLength() != 1) {throw new Fault(new IllegalArgumentException("用户名格式不对"));}if (passwordElement.getLength() != 1) {throw new Fault(new IllegalArgumentException("用户密码格式不对"));}//获取元素的文本内容String userName = userNameElement.item(0).getTextContent();String password = passwordElement.item(0).getTextContent();// 实际项目中, 应该去查询数据库, 该用户名,密码是否被授权调用该webserviceif (!userName.equals("zhangsan") || !password.equals("123456")) {throw new Fault(new IllegalArgumentException("用户名或密码不正确"));}}}

2. 客户端拦截器

/** * 客户端拦截器(在xml片段中加头部) */public class AddHeaderInterceptor extends AbstractPhaseInterceptor<SoapMessage>{    private String userName;private String password;public AddHeaderInterceptor(String userName, String password) {super(Phase.PREPARE_SEND);this.userName = userName;this.password = password; }@Overridepublic void handleMessage(SoapMessage msg) throws Fault {List<Header> headers = msg.getHeaders();//创建Document对象Document document = DOMUtils.createDocument();Element element = document.createElement("authHeader"); //配置服务器端Head信息的用户密码Element userNameElement= document.createElement("userName"); userNameElement.setTextContent(userName);Element passwordElement = document.createElement("password"); passwordElement.setTextContent(password);element.appendChild(userNameElement);element.appendChild(passwordElement);headers.add(new Header(new QName(""), element));/** * 生成的XML文档 * <authHeader> *     <userName>zhangsan</userName> *     <password>123456</password> * </authHeader> */}}

3. 服务端

public class MyServer {public static void main(String[] args) {HelloService helloService = new HelloServiceImpl();EndpointImpl epi = (EndpointImpl)Endpoint.publish("http://localhost/sayHello", helloService);// 添加服务器端in 权限拦截器, 该AuthInterceptor就会负责检查用户名, 密码是否正确epi.getInInterceptors().add(new AuthInterceptor()); System.out.println("Web Service 暴露成功");}}

4. 客户端

public class MyClient {public static void main(String[] args) {HelloServiceImplService factory = new HelloServiceImplService();// 此处返回的只是webservice的代理HelloService helloService = factory.getHelloServiceImplPort();Client client = ClientProxy.getClient(helloService);client.getOutInterceptors().add(new AddHeaderInterceptor("zhangsan", "123456")); System.out.println(helloService.sayHello("zhangsan"));}}