为CXF配置蓝图SSL

问题描述

我有一个已部署到Apache Karaf OSGi容器的应用程序。 该应用程序捆绑包使用Apache CXF实现SOAP和REST Web服务，该服务由blueprint.xml文件配置，如下所示：

<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0"
    xmlns:jaxws="http://cxf.apache.org/blueprint/jaxws"
    xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.2.0"
    xsi:schemaLocation="
  http://www.osgi.org/xmlns/blueprint/v1.0.0 http://www.osgi.org/xmlns/blueprint/v1.0.0/blueprint.xsd
  http://cxf.apache.org/blueprint/jaxws http://cxf.apache.org/schemas/blueprint/jaxws.xsd
  http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0 http://aries.apache.org/schemas/blueprint-cm/blueprint-cm-1.1.0.xsd
  http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.2.0 http://aries.apache.org/schemas/blueprint-ext/blueprint-ext.xsd">

    <jaxws:endpoint id="bundle1-server" implementor="com.myapp.Bundle1ServiceImpl" endpointName="s:Bundle1Port"
        serviceName="s:Bundle1Service" address="http://0.0.0.0:9080/SoapContext/Bundle1Port" wsdlLocation="wsdl/Bundle1Service.wsdl" xmlns:s="http://com.myapp/services/bundle1service">
    </jaxws:endpoint>
</blueprint>

当端点启动时，我可以在日志中看到它：

INFO  | org.apache.cxf.endpoint.ServerImpl |  | org.apache.cxf.endpoint.ServerImpl - initDestination -   85 | 109 - org.apache.cxf.cxf-core - 3.1.9 | Setting the server's publish address to be http://0.0.0.0:9080/SoapContext/Bundle1Port
INFO  | org.eclipse.jetty.server.ServerConnector |  | org.eclipse.jetty.server.AbstractConnector - doStart -  266 | 204 - org.eclipse.jetty.util - 9.2.15.v20160210 | Started ServerConnector@30394ac6{HTTP/1.1}{0.0.0.0:9080}

CXF使用Jetty接收传入的HTTP请求（pom.xml中存在cxf-rt-transports-http-jetty依赖项）。 我想将Web服务从http切换到https。 当我在blueprint.xml中更改端口号时，确实可以在新端口访问Web服务。 但是，将URL方案从http更改为https（从http：//：9080更改为https：//：9443）会导致错误：

org.osgi.service.blueprint.container.ComponentDefinitionException: Unable to initialize bean bundle1-server
...
Caused by: java.io.IOException: Protocol mismatch for port 9443: engine's protocol is http,the url protocol is https
        at org.apache.cxf.transport.http_jetty.JettyHTTPServerEngineFactory.createJettyHTTPServerEngine(JettyHTTPServerEngineFactory.java:277)

显然，我还需要指定服务器证书和CA证书。我尝试添加以下内容：

<httpj:engine-factory bus="cxf">
    <httpj:engine port="9443">
        <httpj:tlsServerParameters>
            <sec:keyManagers keyPassword="changeit">
                <sec:keyStore type="JKS" password="changeit"
                    file="/path-to-certificates/keystore.ks"/>
            </sec:keyManagers>
            <sec:trustManagers>
                <sec:keyStore type="JKS" password="password"
                    file="/path-to-certificates/truststore.ks"/>
            </sec:trustManagers>
            <sec:clientAuthentication want="false" required="false"/>
        </httpj:tlsServerParameters>
    </httpj:engine>
</httpj:engine-factory>

但是现在我得到了：

org.osgi.service.blueprint.container.ComponentDefinitionException: Unable to load class org.eclipse.jetty.server.Connector from recipe MapRecipe[name='#recipe-85']
...
Caused by: java.lang.ClassNotFoundException: org.eclipse.jetty.server.Connector not found by Bundle1 [255]
    at org.apache.felix.framework.BundleWiringImpl.findClassOrResourceByDelegation(BundleWiringImpl.java:1574)[org.apache.felix.framework-5.4.0.jar:]
    at org.apache.felix.framework.BundleWiringImpl.access$400(BundleWiringImpl.java:79)[org.apache.felix.framework-5.4.0.jar:]
    at org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.loadClass(BundleWiringImpl.java:2018)[org.apache.felix.framework-5.4.0.jar:]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:351)[:1.8.0_262]
    at org.apache.felix.framework.Felix.loadBundleClass(Felix.java:1925)[org.apache.felix.framework-5.4.0.jar:]
    at org.apache.felix.framework.BundleImpl.loadClass(BundleImpl.java:978)[org.apache.felix.framework-5.4.0.jar:]
    at org.apache.aries.blueprint.container.BlueprintContainerImpl.loadClass(BlueprintContainerImpl.java:467)[13:org.apache.aries.blueprint.core:1.6.1]
    at org.apache.aries.blueprint.container.BlueprintRepository.loadClass(BlueprintRepository.java:419)[13:org.apache.aries.blueprint.core:1.6.1]
    at org.apache.aries.blueprint.container.GenericType.parse(GenericType.java:135)[13:org.apache.aries.blueprint.core:1.6.1]
    at org.apache.aries.blueprint.di.AbstractRecipe.doLoadType(AbstractRecipe.java:168)[13:org.apache.aries.blueprint.core:1.6.1]

我在这里想念什么？

更新：我还尝试通过编辑etc / org.ops4j.pax.web.cfg使其包括在内，为整个Karaf服务器全局配置SSL

org.osgi.service.http.secure.enabled=true
org.ops4j.pax.web.ssl.keystore=/path-to-keystore.ks
org.ops4j.pax.web.ssl.password=changeit
org.ops4j.pax.web.ssl.keypassword=changeit
org.osgi.service.http.port.secure=8443

然后我可以在日志中看到

INFO  | org.ops4j.pax.web.service.jetty.internal.JettyServerImpl |  | org.ops4j.pax.web.service.jetty.internal.JettyServerImpl - addConnector -  226 | 222 - org.ops4j.pax.web.pax-web-jetty - 4.2.6 | Pax Web available at [0.0.0.0]:[8443]
INFO  | org.eclipse.jetty.server.ServerConnector |  | org.eclipse.jetty.server.AbstractConnector - doStart -  266 | 204 - org.eclipse.jetty.util - 9.2.15.v20160210 | Started secureDefault@3bae4ef2{SSL-http/1.1}{0.0.0.0:8443}
..
Caused by: java.io.IOException: Protocol mismatch for port 8443: engine's protocol is http,the url protocol is https

这真是令人困惑...

解决方法

我通过将org.eclipse.jetty.server添加到META-INF / MANIFEST.MF中的Import-Package中来修复ClassNotFoundException。 但是，我读到以下内容：“我强烈劝阻人们不要在蓝图文件中配置码头服务器” http://servicemix.396122.n5.nabble.com/servicemix-5-4-0-cxf-jetty-blueprint-issue-td5722268.html 因此，如果可能的话，也许我还是应该尝试修复后一个（全局）配置。