怎么使用WSS4J API进行对消息解密

Question

最近用到CXF框架实现来构建web service , 需要使用2个证书加密SOAP消息的不同部分, 看了很多资料只提到用WSS4J API进行消息加密,找不到任何有关用API解密的资料我尝试过使用WSS4JInInterceptor,和利用WSSecurityEngine的processSecurityHeader方法处理消息都会抛出如下异常org.apache.cxf.binding.soap.SoapFault: The signature or decryption was invalid; nested exception is: 
java.lang.Exception: alias is null
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.createSoapFault(WSS4JInInterceptor.java:561)
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:309)
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:78)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:243)
at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:109)
at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.serviceRequest(JettyHTTPDestination.java:312)
at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:276)
at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:70)
at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765)
at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:230)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at org.mortbay.jetty.Server.handle(Server.java:326)
at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:536)
at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:930)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:834)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218)
at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:405)
at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:409)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)

Answer 1

接收到的SOAP消息如下,,,不知道安全头格式有没问题,麻烦高手看看....
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
<soap:Header&gt;
<wsse:Security
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
soap:mustUnderstand="1"&gt;
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="EncKeyId-5AAD29283A44A4433E12704465144864"&gt;
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" /&gt;
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
<wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
<ds:X509Data&gt;
<ds:X509IssuerSerial&gt;
<ds:X509IssuerName&gt;CN=kaka</ds:X509IssuerName&gt;
<ds:X509SerialNumber&gt;1266762444</ds:X509SerialNumber&gt;
</ds:X509IssuerSerial&gt;
</ds:X509Data&gt;
</wsse:SecurityTokenReference&gt;
</ds:KeyInfo&gt;
<xenc:CipherData&gt;
<xenc:CipherValue&gt;
ekranYKFRrVJtqNO5QyBNVqtowrDV3ddX6IWjz3eItnoNkXyk4FMjxZ5PiwUq27MJQO83sTF5p+xyzcc8caL8IZqmqZU15rBx6TCiK9zsJUJ7bVdbd/wVQAZp1dE6PbVI31quS7f3vWgx2MJiPDCcdDbKMBgu1Vr980GbyIG/dc=
</xenc:CipherValue&gt;
</xenc:CipherData&gt;
<xenc:ReferenceList&gt;
<xenc:DataReference URI="#EncDataId-2" /&gt;
</xenc:ReferenceList&gt;
</xenc:EncryptedKey&gt;
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="EncKeyId-5AAD29283A44A4433E12704465143562"&gt;
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" /&gt;
&lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
&lt;wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
&lt;ds:X509Data&gt;
&lt;ds:X509IssuerSerial&gt;
&lt;ds:X509IssuerName&gt;CN=Mayank
Mishra,OU=Dev,O=Apache,L=INDORE,ST=MP,C=IN&lt;/ds:X509IssuerName&gt;
&lt;ds:X509SerialNumber&gt;1245003015&lt;/ds:X509SerialNumber&gt;
&lt;/ds:X509IssuerSerial&gt;
&lt;/ds:X509Data&gt;
&lt;/wsse:SecurityTokenReference&gt;
&lt;/ds:KeyInfo&gt;
&lt;xenc:CipherData&gt;
&lt;xenc:CipherValue&gt;
FUCAVEvvhdveGbD89mAysbH5epXrUSPXsD6vJr/2Dj4e/ozrnzviN50HlJeXLuaMdetvKST0c9FUb59fpfo5GnYu1nnonM3RjCXqf0tr6F7SZbTcWYPcRKSe11mavkfjxHXza7Cq+khaBpM6ZfB0GahYQNy0mLuI3LRvIAIa+ow=
&lt;/xenc:CipherValue&gt;
&lt;/xenc:CipherData&gt;
&lt;xenc:ReferenceList&gt;
&lt;xenc:DataReference URI="#EncDataId-1" /&gt;
&lt;/xenc:ReferenceList&gt;
&lt;/xenc:EncryptedKey&gt;
&lt;/wsse:Security&gt;
&lt;/soap:Header&gt;
&lt;soap:Body&gt;
&lt;ns2:twoParam xmlns:ns2="http://ws.test.com/"&gt;
&lt;param1&gt;
&lt;xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="EncDataId-1" Type="http://www.w3.org/2001/04/xmlenc#Content"&gt;
&lt;xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" /&gt;
&lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
&lt;wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
&lt;wsse:Reference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
URI="#EncKeyId-5AAD29283A44A4433E12704465143562" /&gt;
&lt;/wsse:SecurityTokenReference&gt;
&lt;/ds:KeyInfo&gt;
&lt;xenc:CipherData&gt;
&lt;xenc:CipherValue&gt;O2Khz3d41vtT2rOeOqA7cxy9exrZFwvLDG4wHedpcE4=
&lt;/xenc:CipherValue&gt;
&lt;/xenc:CipherData&gt;
&lt;/xenc:EncryptedData&gt;
&lt;/param1&gt;
&lt;param2&gt;
&lt;xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="EncDataId-2" Type="http://www.w3.org/2001/04/xmlenc#Content"&gt;
&lt;xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" /&gt;
&lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
&lt;wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
&lt;wsse:Reference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
URI="#EncKeyId-5AAD29283A44A4433E12704465144864" /&gt;
&lt;/wsse:SecurityTokenReference&gt;
&lt;/ds:KeyInfo&gt;
&lt;xenc:CipherData&gt;
&lt;xenc:CipherValue&gt;1jyXyvVv6iVnNIDQNfechi/XSbHIczlkGoH7udH1Jls=
&lt;/xenc:CipherValue&gt;
&lt;/xenc:CipherData&gt;
&lt;/xenc:EncryptedData&gt;
&lt;/param2&gt;
&lt;/ns2:twoParam&gt;
&lt;/soap:Body&gt;
&lt;/soap:Envelope&gt;