公网Java Web应用调用内网SOAP WebService的安全方案咨询

Hey there! Let's work through your scenario to secure access from your public Java Web app to the internal SOAP WebService, plus cover how to implement the restricted method calls.

First, we need to layer security to make sure only your public app can call the two allowed methods, and no unauthorized access to the internal network or other WebService methods happens.

a. Deploy an API Gateway/Reverse Proxy as a Middle Layer #

This is your first line of defense:

• Restrict to allowed SOAP methods: SOAP requests use an Action header or have specific operation names defined in the WSDL. Configure the gateway to only forward requests that match the two allowed method actions/names—all other requests get a 403 Forbidden response immediately.
• Authenticate the public app: Set up mutual authentication between your public app and the gateway. Options include:
  • API Keys: Have your public app send a secure, unique API key in a request header (like X-API-Key) that the gateway validates before forwarding.
  • OAuth2 Client Credentials: Use a trusted identity provider to issue access tokens to your public app; the gateway validates these tokens.
  • Mutual SSL: Both the public app and gateway present SSL certificates to verify each other's identity.
• Network-level restrictions: Configure your internal firewall to only allow incoming traffic from the gateway's IP address to the SOAP WebService. Block all direct public traffic to the internal network entirely.

b. Add Method-Level Security to the SOAP WebService #

Double down on security by restricting access directly at the WebService:

• If your WebService uses Spring, use Spring Security to define method-level permissions—only allow a dedicated service account (used by the gateway) to invoke the two allowed methods.
• For non-Spring services, use your WebService container's built-in security (like Tomcat's realm configuration) or manually validate the incoming SOAP request's operation name before executing any logic.

Once the security layer is set up, here's how to call the restricted methods:

a. Generate SOAP Client Code #

First, generate client proxy classes to interact with the WebService:

• Use JDK's built-in wsimport tool: Run wsimport http://gateway-url/your-webservice?wsdl (or use the internal WSDL if you can access it privately) to generate Java classes that map to the WebService's methods and types.
• Or use Apache CXF's wsdl2java tool for more flexibility (supports custom interceptors, better error handling, etc.): Run wsdl2java -p com.yourpackage http://gateway-url/your-webservice?wsdl.

b. Example Call with Apache CXF #

Here's a code snippet to call the allowed methods, including authentication:

import com.yourpackage.YourWebServiceService;
import com.yourpackage.YourWebServicePortType;
import com.yourpackage.Method1Request;
import com.yourpackage.Method1Response;
import org.apache.cxf.jaxws.BindingProvider;
import javax.xml.ws.handler.MessageContext;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;

public class SoapClient {
    public static void main(String[] args) {
        // Initialize the service and port
        YourWebServiceService service = new YourWebServiceService();
        YourWebServicePortType port = service.getYourWebServicePort();

        // Point the client to the gateway's endpoint
        BindingProvider bindingProvider = (BindingProvider) port;
        bindingProvider.getRequestContext().put(
            BindingProvider.ENDPOINT_ADDRESS_PROPERTY,
            "http://gateway-url/your-webservice-endpoint"
        );

        // Add API Key authentication to the request header
        Map<String, Object> requestContext = bindingProvider.getRequestContext();
        Map<String, String> headers = new HashMap<>();
        headers.put("X-API-Key", "your-secure-api-key-here");
        requestContext.put(MessageContext.HTTP_REQUEST_HEADERS, headers);

        try {
            // Call allowed method 1
            Method1Request req1 = new Method1Request();
            req1.setParam("your-input-data");
            Method1Response res1 = port.method1(req1);
            System.out.println("Method1 Response: " + res1.getResult());

            // Call allowed method 2
            // Similar code for method2...
        } catch (Exception e) {
            // Handle errors (e.g., SOAP faults, authentication failures)
            e.printStackTrace();
        }
    }
}

c. Key Implementation Notes #

• Use HTTPS: Ensure all traffic between the public app and gateway, and gateway to internal WebService, uses HTTPS to encrypt data in transit.
• Error Handling: Catch SOAPFaultException to handle cases where the gateway or WebService rejects the request (e.g., invalid API key, disallowed method).
• Logging: Add logging to track all calls from the public app—include method names, timestamps, and success/failure status for auditing purposes.

内容的提问来源于stack exchange，提问作者Javina