AXIS第四课：AXIS高级应用，建立安全的AXIS服务
??? <parameter name="portName" value="Demo"/>
??? </handler>
第二部分：
??? <service name="SOAPMonitorService" provider="java:RPC">
??? <parameter name="allowedMethods" value="publishMessage"/>
??? <parameter name="className"?? value="org.apache.axis.monitor.SOAPMonitorService"/>
??? <parameter name="scope" value="Application"/>
??? </service>
3、选择你要监控的服务
以上次的HelloWorld服务为例，在server-config.wsdd中你会找到这段代码
<service name="HelloWorld" provider="java:RPC">
??? <parameter name="allowedMethods" value="sayHello"/>
??? <parameter name="className" value="HelloWorld"/>
</service>
在这段代码中加入以下的代码：
<requestFlow>
??? <handler type="soapmonitor"/>
</requestFlow>
<responseFlow>
??? <handler type="soapmonitor"/>
</responseFlow>
最后的样子是：
<service name="HelloWorld" provider="java:RPC">
<requestFlow>
??? <handler type="soapmonitor"/>
</requestFlow>
<responseFlow>
??? <handler type="soapmonitor"/>
</responseFlow>
<parameter name="allowedMethods" value="sayHello"/>
<parameter name="className" value="HelloWorld"/>
</service>
这样HelloWorld服务就被监控了
4、启动Tomcat,打开http://localhost:8080/axis/SOAPMonitor，你就会看到Applet界面，在
eclipse中运行我们上次写的客户端程序 TestClient.java。OK！你会在Applet界面看
见客户端与服务器端互发的XML内容，注意这里是明文！
二、使用axis的Handler进行访问控制（对安全要求不高时推荐）
axis为Web服务的访问控制提供了相关的配置描述符，并且提供了一个访问控制的简单 Handler。默认情况下，你只要在配置描述符中添加用户，然后在Web服务器的部署描述符中自动允许的角色即可。
1、在axis的配置文件users.lst（位于WEB-INF目录下）中添加一个用户，如"annlee 1111"，表示
用户名为annlee，密码为1111。
2、把例HelloWorld的Web服务重新部署（新加的部分已标出）
<service name="HelloWorld" provider="java:RPC">
<requestFlow>
??? <handler type="soapmonitor"/>
??? <handler type="Authenticate"/> //新加的AXIS自带的Handler
</requestFlow>
<responseFlow>
??? <handler type="soapmonitor"/>
</responseFlow>
<parameter name="allowedMethods" value="sayHello"/>
<parameter name="allowedRoles" value="annlee"/>?? //注意，这里是新加的部分！
<parameter name="className" value="HelloWorld"/>
</service>
在这个部署描述符中，指定HelloWorld服务只能被annlee访问
3、修改客户端程序 TestClient.java，增加访问用户名、密码（新加的部分已标出）
TestClient.java
import org.apache.axis.client.Call;
import org.apache.axis.client.Service;
import javax.xml.rpc.ParameterMode;
public class TestClient
{
public static void main(String [] args) throws Exception {
String endpoint = "http://localhost:" +"8080"+ "/axis/HelloWorld";
??? Service service = new Service();?
??? Call?? call?? = (Call) service.createCall();
??? call.getMessageContext().setUsername("annlee");// 用户名。
??? call.getMessageContext().setPassword("1111");//?? 密码
call.setTargetEndpointAddress( new java.net.URL(endpoint) );
call.setOperationName( "sayHello" );
String res = (String) call.invoke( new Object[] {} );
System.out.println( res );
}
}
执行TestClient，能够顺利访问Web服务；如果修改用户名或者密码，那么就不能访问 。同样，
你在http://localhost:8080/axis/SOAPMonitor中看到的请求和响应的XML是明文！
三、使用SSL/HTTPS协议来传输
Web服务也可以使用SSL作为传输协议。虽然JAX-RPC并没有强制规定是否使用SSL协议，但在tomcat
下可以使用HTTPS协议。
1、使用JDK自带的工具创建密匙库和信任库。
1）通过使用以下的命令来创建服务器端的密匙库：
keytool -genkey -alias Server -keystore server.keystore -keyalg RSA
输入keystore密码： changeit
您的名字与姓氏是什么？
[Unknown]： Server
您的组织单位名称是什么？
[Unknown]： ec
您的组织名称是什么？
[Unknown]： ec
您所在的城市或区域名称是什么？
[Unknown]： beijing
您所在的州或省份名称是什么？
[Unknown]： beijing
该单位的两字母国家代码是什么
[Unknown]： CN
CN=Server, OU=ec, O=ec, L=beijing, ST=beijing, C=CN 正确吗？
[否]： y
输入<Server>的主密码
??? （如果和 keystore 密码相同，按回车）：
以上命令执行完成后，将获得一个名为server.keystore的密匙库。
2)生成客户端的信任库。首先输出RSA证书：
keytool -export -alias Server -file test_axis.cer -storepass changeit -keystore server.keystore
然后把RSA证书输入到一个新的信任库文件中。这个信任库被客户端使用，被用来验证服务器端的身份。
keytool -import -file test_axis.cer -storepass changeit -keystore client.truststore -alias serverkey -noprompt
以上命令执行完成后，将获得一个名为client.truststore的信任库。
3）同理生成客户端的密匙库client.keystore和服务器端的信任库server.truststore.方便起见给出.bat文件
gen-cer-store.bat内容如下：
set SERVER_DN="CN=Server, OU=ec, O=ec, L=BEIJINGC, S=BEIJING, C=CN"
set CLIENT_DN="CN=Client, OU=ec, O=ec, L=BEIJING, S=BEIJING, C=CN"
set KS_PASS=-storepass changeit
set KEYINFO=-keyalg RSA
keytool -genkey -alias Server -dname %SERVER_DN% %KS_PASS% -keystore server.keystore %KEYINFO% -keypass changeit
keytool -export -alias Server -file test_axis.cer %KS_PASS% -keystore server.keystore
keytool -import -file test_axis.cer %KS_PASS% -keystore client.truststore -alias serverkey -noprompt
keytool -genkey -alias Client -dname %CLIENT_DN% %KS_PASS% -keystore client.keystore %KEYINFO% -keypass changeit
keytool -export -alias Client -file test_axis.cer %KS_PASS% -keystore client.keystore
keytool -import -file test_axis.cer %KS_PASS% -keystore server.truststore -alias clientkey -noprompt
好的，现在我们就有了四个文件：server.keystore，server.truststore，client.keystore，client.truststore
2、更改Tomcat的配置文件（server.xml），增加以下部署描述符：（其实里面有，只是被注释掉了）
??? <Connector port="8440"?
????????? maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
????????? enableLookups="false" disableUploadTimeout="true"
????????? acceptCount="100" scheme="https" secure="true"
????????? clientAuth="true" keystoreFile="f:\server.keystore" keystorePass="changeit"
????????? truststoreFile="f:\server.truststore" truststorePass="changeit"
????????? sslProtocol="TLS" />
3、把HelloWorld重新部署一次，在server-config.wsdd中修改如下部署代码。（还原了而已）
<service name="HelloWorld" provider="java:RPC">
<requestFlow>
??? <handler type="soapmonitor"/>
</requestFlow>
<responseFlow>
??? <handler type="soapmonitor"/>
</responseFlow>
<parameter name="allowedMethods" value="sayHello"/>
<parameter name="className" value="HelloWorld"/>
</service>
4、修改客户端程序 TestClient.java（修改的部分已标出）
public class TestClient
{
public static void main(String [] args) throws Exception {
String endpoint = "https://localhost:" +"8440"+ "/axis/HelloWorld";//注意区别在这里！https！
??? Service service = new Service();?
??? Call?? call?? = (Call) service.createCall();
call.setTargetEndpointAddress( new java.net.URL(endpoint) );
call.setOperationName( "sayHello" );
String res = (String) call.invoke( new Object[] {} );
System.out.println( res );
}
}
5、最后使用命令来执行客户端程序
java -cp %AXISCLASSPATH%
-Djavax.net.ssl.keyStore=client.keystore?
-Djavax.net.ssl.keyStorePassword=changeit?
-Djavax.net.ssl.trustStore=client.truststore?
TestClient
?
四、使用WS-Security规范对信息进行加密与身份认证
我们打算用Handler结合WSSecurity实现Web服务安全(Handler的有关内容请参阅AXIS第三课）
设想流程：用WSClientRequestHandler.java位于客户端对客户端发出的XML文档进行加密
????????? WSServerRequestHandler.java位于服务器端对客户端发出的加密后的XML文档进行解密
????????? WSServerResponseHandler.java位于服务器端对服务器端返回的XML文档进行加密
????????? WSClientResponseHandler.java位于客户端对服务器端返回的XML文档进行解密
??????????
1、使用ISNetworks安全提供者，ISNetworks实现了RSA加密、解密算法。
当然，你也可以使用其它的安全提供者，并且可以使用不同的加密算法。
ISNetworks相关包ISNetworksProvider.jar。拷贝到%TOMCAT_HOME% \webapps\axis\WEB-INF\lib
2、Trust Services Integration Kit提供了一个WS-Security实现。你可以从http://www.xmltrustcenter.org获得相关库文件，分别是ws-security.jar和tsik.jar。ws-security.jar中包含一个WSSecurity类，我们使用它来对XML进行数字签名和验证，加密与解密。同样拷贝到%TOMCAT_HOME%\webapps\axis\WEB-INF\lib
3、创建密匙库和信任库。（见上面，一模一样！）
4、框架结构
WSClientHandler.java //基类，包含了一些公用方法
WSClientRequestHandler.java //继承于WSClientHandler.java，调用WSHelper.java对客户端发出的XML文档进行加密
WSClientResponseHandler.java //继承于WSClientHandler.java，调用WSHelper.java对服务器端返回的XML文档进行解密
WSServerHandler.java //基类，包含了一些公用方法
WSServerRequestHandler.java //继承于WSServerHandler.java，调用WSHelper.java对客户端发出的加密后的XML文档进行解密
WSServerResponseHandler.java//继承于WSServerHandler.java，调用WSHelper.java对服务器端返回的XML文档进行加密
WSHelper.java //核心类，对SOAP消息签名、加密、解密、身份验证
MessageConverter.java //帮助类，Document、SOAP消息互相转换
5、具体分析（在此强烈建议看一下tsik.jar的API）
WSHelper.java?
public class WSHelper {
??? static String PROVIDER="ISNetworks";//JSSE安全提供者。
//添加JSSE安全提供者，你也可以使用其它安全提供者。只要支持DESede算法。这是程序里动态加载还可以在JDK中静态加载
??? static
??? {
????? java.security.Security.addProvider(new com.isnetworks.provider.jce.ISNetworksProvider());
}
/**
*对XML文档进行数字签名。
*/
??? public static void sign(Document doc, String keystore, String storetype,
??????????????????????????????? String storepass, String alias, String keypass) throws Exception {
????????? FileInputStream fileInputStream = new FileInputStream(keystore);
????????? java.security.KeyStore keyStore = java.security.KeyStore.getInstance(storetype);
????????? keyStore.load(fileInputStream, storepass.toCharArray());
????????? PrivateKey key = (PrivateKey)keyStore.getKey(alias, keypass.toCharArray());
????????? X509Certificate cert = (X509Certificate)keyStore.getCertificate(alias);
????????? SigningKey sk = SigningKeyFactory.makeSigningKey(key);
????????? KeyInfo ki = new KeyInfo();
????????? ki.setCertificate(cert);
????????? WSSecurity wSSecurity = new WSSecurity();//ws-security.jar中包含的WSSecurity类
????????? wSSecurity.sign(doc, sk, ki);//签名。
??? }
/**
*对XML文档进行身份验证。
*/
??? public static boolean verify(Document doc, String keystore, String storetype,
??????????????????????????????? String storepass) throws Exception {
????????? FileInputStream fileInputStream = new FileInputStream(keystore);
????????? java.security.KeyStore keyStore = java.security.KeyStore.getInstance(storetype);
????????? keyStore.load(fileInputStream, storepass.toCharArray());
????????? TrustVerifier verifier = new X509TrustVerifier(keyStore);
????????? WSSecurity wSSecurity = new WSSecurity();
????????? MessageValidity[] resa = wSSecurity.verify(doc, verifier, null,null);
????????? if (resa.length > 0)
??????????????? return resa[0].isValid();
????????? return false;
??? }
/**
*对XML文档进行加密。必须有JSSE提供者才能加密。
*/
??? public static void encrypt(Document doc, String keystore, String storetype,
??????????????????????????????? String storepass, String alias) throws Exception {
????????? try
????????? {
????????? FileInputStream fileInputStream = new FileInputStream(keystore);
????????? java.security.KeyStore keyStore = java.security.KeyStore.getInstance(storetype);
????????? keyStore.load(fileInputStream, storepass.toCharArray());
????????? X509Certificate cert = (X509Certificate)keyStore.getCertificate(alias);
????????? PublicKey pubk = cert.getPublicKey();
????????? KeyGenerator keyGenerator = KeyGenerator.getInstance("DESede",PROVIDER);
????????? keyGenerator.init(168, new SecureRandom());
????????? SecretKey key = keyGenerator.generateKey();
????????? KeyInfo ki = new KeyInfo();
????????? ki.setCertificate(cert);
????????? WSSecurity wSSecurity = new WSSecurity();
????????? //加密。
????????? wSSecurity.encrypt(doc, key, AlgorithmType.TRIPLEDES, pubk, AlgorithmType.RSA1_5, ki);
??? }
??? catch(Exception e)
??? {
????????? e.printStackTrace();
??? }
??? }
/**
*对文档进行解密。
*/
??? public static void decrypt(Document doc, String keystore, String storetype,
??????????????????????????????? String storepass, String alias, String keypass) throws Exception {
????????? FileInputStream fileInputStream = new FileInputStream(keystore);
????????? java.security.KeyStore keyStore = java.security.KeyStore.getInstance(storetype);
????????? keyStore.load(fileInputStream, storepass.toCharArray());
????????? PrivateKey prvk2 = (PrivateKey)keyStore.getKey(alias, keypass.toCharArray());
????????? WSSecurity wSSecurity = new WSSecurity();
????????? //解密。
????????? wSSecurity.decrypt(doc, prvk2, null);
????????? WsUtils.removeEncryptedKey(doc);//从 WS-Security Header中删除 EncryptedKey 元素
??? }
??? public static void removeWSSElements(Document doc) throws Exception {
????????? WsUtils.removeWSSElements(doc);// 删除WSS相关的元素。
??? }
}
WSClientHandler.java
//继承自org.apache.axis.handlers.BasicHandler即AXIS内在的
public class WSClientHandler extends BasicHandler{
protected String keyStoreFile ;
protected String keyStoreType ="JKS";//默认
protected String keyStorePassword ;
protected String keyAlias ;
protected String keyEntryPassword ;
protected String trustStoreFile ;
protected String trustStoreType = "JKS";//默认
protected String trustStorePassword ;
protected String certAlias ;
public void setInitialization(String keyStoreFile,String keyStoreType,String keyStorePassword,
????????? String keyAlias,String keyEntryPassword,String trustStoreFile,
????????? String trustStoreType,String trustStorePassword,String certAlias){
this.keyStoreFile=keyStoreFile;
this.keyStoreType=keyStoreType;
this.keyStorePassword=keyStorePassword;
this.keyAlias=keyAlias;
this.keyEntryPassword=keyEntryPassword;
this.trustStoreFile=trustStoreFile;
this.trustStoreType=trustStoreType;
this.trustStorePassword=trustStorePassword;
this.certAlias=certAlias;
}
public void setInitialization(String keyStoreFile,String keyStorePassword,
????????? String keyAlias,String keyEntryPassword,String trustStoreFile,
????????? String trustStorePassword,String certAlias){
this.keyStoreFile=keyStoreFile;
this.keyStorePassword=keyStorePassword;
this.keyAlias=keyAlias;
this.keyEntryPassword=keyEntryPassword;
this.trustStoreFile=trustStoreFile;
this.trustStorePassword=trustStorePassword;
this.certAlias=certAlias;
}
public void invoke(MessageContext messageContext) throws AxisFault {//在这个方法里对XML文档进行处理
//do nothing now!
}
public void onFault(MessageContext msgContext) {
System.out.println("处理错误，这里忽略！");
??? }
}
WSClientRequestHandler.java
public class WSClientRequestHandler extends WSClientHandler{
public void invoke(MessageContext messageContext) throws AxisFault {
try {
SOAPMessage soapMessage = messageContext.getMessage();
Document doc = MessageConverter.convertSoapMessageToDocument(soapMessage); //soapMessage转换为Document
WSHelper.sign(doc, keyStoreFile, keyStoreType,keyStorePassword, keyAlias, keyEntryPassword); //数字签名
WSHelper.encrypt(doc, trustStoreFile, trustStoreType, trustStorePassword, certAlias); //加密
soapMessage = MessageConverter.convertDocumentToSOAPMessage(doc);?
//处理后的Document再转换回soapMessage
messageContext.setMessage(soapMessage);
} catch (Exception e){
System.err.println("在处理响应时发生以下错误： " + e);
??? e.printStackTrace(); }
??? }
}
WSClientResponseHandler.java
public class WSClientResponseHandler extends WSClientHandler{
public void invoke(MessageContext messageContext) throws AxisFault {
try {
??????? SOAPMessage soapMessage = messageContext.getCurrentMessage();
??????? Document doc = MessageConverter.convertSoapMessageToDocument(soapMessage);
??? WSHelper.decrypt(doc, keyStoreFile, keyStoreType,
????????????????? keyStorePassword, keyAlias, keyEntryPassword);//解密
??????? WSHelper.verify(doc, trustStoreFile, trustStoreType, trustStorePassword);//验证
??????? WSHelper.removeWSSElements(doc);
??????? soapMessage = MessageConverter.convertDocumentToSOAPMessage(doc);
??????? messageContext.setMessage(soapMessage);
} catch (Exception e){
??????? e.printStackTrace();
??????? System.err.println("在处理响应时发生以下错误： " + e);
??????????????? }
??? }
}???
WSServerHandler.java?
public class WSServerHandler extends BasicHandler{
protected String keyStoreFile ;
protected String keyStoreType ="JKS";//默认
protected String keyStorePassword ;
protected String keyAlias ;
protected String keyEntryPassword ;
protected String trustStoreFile ;
protected String trustStoreType = "JKS";//默认
protected String trustStorePassword ;
protected String certAlias ;
public void invoke(MessageContext messageContext) throws AxisFault {
//do nothing now!
}
public void onFault(MessageContext msgContext) {
System.out.println("处理错误，这里忽略！");
??? }
public void init() { //初始化，从配置文件server-config.wsdd中读取属性
keyStoreFile = (String)getOption("keyStoreFile");
if(( keyStoreFile== null) )
??? System.err.println("Please keyStoreFile configured for the Handler!");
trustStoreFile = (String)getOption("trustStoreFile");
if(( trustStoreFile== null) )
System.err.println("Please trustStoreFile configured for the Handler!");
keyStorePassword = (String)getOption("keyStorePassword");
if(( keyStorePassword== null) )
System.err.println("Please keyStorePassword configured for the Handler!");
keyAlias = (String)getOption("keyAlias");
if(( keyAlias== null) )
System.err.println("Please keyAlias configured for the Handler!");
keyEntryPassword = (String)getOption("keyEntryPassword");
if(( keyEntryPassword== null) )
System.err.println("Please keyEntryPassword configured for the Handler!");
trustStorePassword = (String)getOption("trustStorePassword");
if(( trustStorePassword== null) )
System.err.println("Please trustStorePassword configured for the Handler!");
certAlias = (String)getOption("certAlias");
if ((certAlias==null))
??? System.err.println("Please certAlias configured for the Handler!");
if ((getOption("keyStoreType")) != null)
??? keyStoreType = (String)getOption("keyStoreType");
if ((getOption("trustStoreType")) != null)
??? trustStoreType = (String)getOption("trustStoreType");
}
}???????
WSServerRequestHandler.java?
public class WSServerRequestHandler extends WSServerHandler{
public void invoke(MessageContext messageContext) throws AxisFault {
try {
??? SOAPMessage msg = messageContext.getCurrentMessage();
??????? Document doc = MessageConverter.convertSoapMessageToDocument(msg);
??????? System.out.println("接收的原始消息:");
????? msg.writeTo(System.out);
??? WSHelper.decrypt(doc, keyStoreFile, keyStoreType,
????????????????? keyStorePassword, keyAlias, keyEntryPassword);//解密
??????? WSHelper.verify(doc, trustStoreFile, trustStoreType, trustStorePassword);//验证
??????? WSHelper.removeWSSElements(doc);
??????? msg = MessageConverter.convertDocumentToSOAPMessage(doc);
??????? System.out.println("怀原后的原始消息:");
??????? msg.writeTo(System.out);
??????? messageContext.setMessage(msg);
} catch (Exception e){
??????? e.printStackTrace();
??????? System.err.println("在处理响应时发生以下错误： " + e);
??????????????? }
??? }
}???
WSServerResponseHandler.java
public class WSServerResponseHandler extends WSServerHandler{
public void invoke(MessageContext messageContext) throws AxisFault {
try {
SOAPMessage soapMessage = messageContext.getMessage();
??? System.out.println("返回的原始消息:");
????? soapMessage.writeTo(System.out);
??? Document doc = MessageConverter.convertSoapMessageToDocument(soapMessage);
??? WSHelper.sign(doc, keyStoreFile, keyStoreType,
????? keyStorePassword, keyAlias, keyEntryPassword);//数字签名
??? WSHelper.encrypt(doc, trustStoreFile, trustStoreType,//加密
??? trustStorePassword, certAlias);
??? soapMessage = MessageConverter.convertDocumentToSOAPMessage(doc);
??? System.out.println("返回的加密后的消息:");
??? soapMessage.writeTo(System.out);
??? messageContext.setMessage(soapMessage);
??? } catch (Exception e){
??? System.err.println("在处理响应时发生以下错误： " + e);
????? e.printStackTrace();
????? }
??? }
}
6、应用
为方便使用，把上述文件打包为ws-axis.jar,放入%TOMCAT_HOME%\webapps\axis\WEB-INF\lib
1）把HelloWorld重新部署一次，在server-config.wsdd中修改如下部署代码。
??? <service name="HelloWorld" provider="java:RPC">
????? <parameter name="allowedMethods" value="*"/>
????? <parameter name="className" value="HelloWorld"/>
????? <requestFlow>
????? <handler type="soapmonitor"/>
????? <handler type="java:com.annlee.WSAxis.WSServerRequestHandler">
??????? <parameter name="keyStoreFile" value="f:\server.keystore"/>
??????? <parameter name="trustStoreFile" value="f:\server.truststore"/>
??????? <parameter name="keyStorePassword" value="changeit"/>
??????? <parameter name="keyAlias" value="Server"/>
??????? <parameter name="keyEntryPassword" value="changeit"/>
??????? <parameter name="trustStorePassword" value="changeit"/>
??????? <parameter name="certAlias" value="clientkey"/>
????? </handler>
??? </requestFlow>
??? <responseFlow>
????? <handler type="soapmonitor"/>
????? <handler type="java:com.annlee.WSAxis.WSServerResponseHandler">
??????? <parameter name="keyStoreFile" value="f:\server.keystore"/>
??????? <parameter name="trustStoreFile" value="f:\server.truststore"/>
??????? <parameter name="keyStorePassword" value="changeit"/>
??????? <parameter name="keyAlias" value="Server"/>
??????? <parameter name="keyEntryPassword" value="changeit"/>
??????? <parameter name="trustStorePassword" value="changeit"/>
??????? <parameter name="certAlias" value="clientkey"/>
????? </handler>
??? </responseFlow>
</service>
2)修改客户端程序 TestClient.java（修改的部分已标出，记着导入ws-axis.jar）
import javax.xml.namespace.QName;
import org.apache.axis.client.Call;
import org.apache.axis.client.Service;
import com.annlee.WSAxis.*;
public class WSSClient1
{
public static void main(String [] args)
{
??? try {
????????? //服务端的url，需要根据情况更改。
??????? String endpointURL = "http://localhost:8080/axis/services/HelloWorld";
??????? Service svc = new Service();
??????? WSClientHandler handler=new WSClientRequestHandler();
//注意新加的HANDLER
??????? handler.setInitialization("f:/client.keystore","changeit","Client","changeit",
????????? "f:/client.truststore","changeit","serverkey");//初始化
??????? WSClientHandler handlee=new WSClientResponseHandler();
//注意新加的HANDLER
??????? handlee.setInitialization("f:/client.keystore","changeit","Client","changeit",
????????? "f:/client.truststore","changeit","serverkey");//初始化
????????????? Call call =(Call)svc.createCall();
????????????? call.setClientHandlers(handler,handlee);//添加Handler
????????????? call.setTargetEndpointAddress(new java.net.URL(endpointURL));
????????????? call.setOperationName(new QName("sayHello"));
????????????? String result = (String) call.invoke( new Object [] {});
????????????? System.out.println("the result"+result);
??? } catch (Exception e) {
????????? e.printStackTrace();
??? }
}
}
运行的时候http://localhost:8080/axis/SOAPMonitor中看到的请求的XML就已加密！
总结
这里对代码的解释是不够的，很多概念没有提到。建议你最好看tsik.jar和AXIS的API深入了解。另外对ws-axis.jar的加解密实现打算运用apache的wss4j,相关网址http://ws.apache.org/ws-fx/wss4j/。不过这个东西也应该够用了暂时。