EJBCA 6 通过调用WebService接口增加用户并获取证书

今天终于搞定通过调用WebService 接口的方式在EJBCA 中增加用户。

本项目完整代码请参见http://git.oschina.net/xiangyunsoft/EjbcaWs

1、EJBCA6 默认会配置好ws服务，如果有其他配置需要在conf/jaxws.properties文件中进行配置。

2、编写客户端代码，调用ws接口服务

package cn.com.rexen.ca;
 
import org.cesecore.util.CryptoProviderTools;
import org.cesecore.util.provider.TLSProvider;
import org.ejbca.core.protocol.ws.client.gen.*;
 
import javax.net.ssl.KeyManagerFactory;
import javax.xml.namespace.QName;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.*;
import java.security.cert.CertificateException;
import java.util.List;
 
/**
 * 调用EJBCA WS接口.
 * Created by libo on 2014/6/16.
 */
public class CaWS {
 
    /** 解决 java.security.cert.CertificateException: No subject alternative names matching IP address 172.17.2.248 found
    172.17.2.248 换成自己的IP或机器名。
     */
    static {
        javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(
                new javax.net.ssl.HostnameVerifier() {
 
                    public boolean verify(String hostname,
                                          javax.net.ssl.SSLSession sslSession) {
                        if (hostname.equals("172.17.2.248")) {
                            return true;
                        }
                        return false;
                    }
                }
        );
    }
 
    private EjbcaWS ejbcaWS;
 
    public static void main(String[] args) throws Exception {
        CaWS caWS = new CaWS();
        caWS.initEjbcaWs();
        caWS.create();
        caWS.findUser();
    }
 
    /**
     * 查询用户信息.
     */
    public void findUser() throws MalformedURLException, EjbcaException_Exception, IllegalQueryException_Exception, EndEntityProfileNotFoundException_Exception, AuthorizationDeniedException_Exception, ApprovalException_Exception, UserDoesntFullfillEndEntityProfile_Exception, CADoesntExistsException_Exception, WaitingForApprovalException_Exception {
        UserMatch usermatch = new UserMatch();
        usermatch.setMatchwith(UserMatch.MATCH_WITH_EMAIL); //按EMAIL地址进行查询
        usermatch.setMatchtype(UserMatch.MATCH_TYPE_EQUALS);    //查询匹配方式
        usermatch.setMatchvalue("123@qq.com");
        List<UserDataVOWS> result = ejbcaWS.findUser(usermatch);
        System.out.println("result:" + result);
 
        for (UserDataVOWS ud : result) {
            System.out.println("==========================");
            System.out.println("userName:" + ud.getUsername());
            System.out.println("email:" + ud.getEmail());
            System.out.println("SubjectDN:" + ud.getSubjectDN());
            System.out.println("caName:" + ud.getCaName());
            System.out.println("==========================");
        }
    }
 
    /**
     * 初始化ws 接口服务.
     */
    public void initEjbcaWs() {
        CryptoProviderTools.installBCProvider();
        String urlstr = "https://172.17.2.248:8443/ejbca/ejbcaws/ejbcaws?wsdl";
        String fileName = "F:\\workspace\\caWS\\src\\superadmin_62.p12";
        String password = "ejbca";
        System.setProperty("javax.net.ssl.keyStore", fileName);
        System.setProperty("javax.net.ssl.keyStoreType", "pkcs12");
 
        Provider tlsProvider = new TLSProvider();
        Security.addProvider(tlsProvider);
        Security.setProperty("ssl.TrustManagerFactory.algorithm", "AcceptAll");
        System.setProperty("javax.net.ssl.keyStorePassword", password);
        try {
            KeyManagerFactory.getInstance("NewSunX509");
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
 
        Security.setProperty("ssl.KeyManagerFactory.algorithm", "NewSunX509");
        QName qname = new QName("http://ws.protocol.core.ejbca.org/", "EjbcaWSService");
        URL url = null;
        try {
            url = new URL(null, urlstr, new sun.net.www.protocol.http.Handler());
        } catch (MalformedURLException e) {
            e.printStackTrace();
        }
        EjbcaWSService service = new EjbcaWSService(url, qname);
        ejbcaWS = service.getEjbcaWSPort();
 
        String version = ejbcaWS.getEjbcaVersion();
 
        System.out.println("ejbcaWS init successfully. EJBCA Version is :" + version);
    }
 
    /**
     * 增加用户
     */
    public void create() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, NoSuchProviderException, IOException, WaitingForApprovalException_Exception, NotFoundException_Exception, AuthorizationDeniedException_Exception, ApprovalException_Exception, UserDoesntFullfillEndEntityProfile_Exception, CADoesntExistsException_Exception, EjbcaException_Exception, InvalidAlgorithmParameterException {
        String password = "123456";
 
        final UserDataVOWS userData = new UserDataVOWS();
        userData.setUsername("t_123");
        userData.setPassword(password); //如果模板指定自动生成密码，则不需要指定。
        userData.setClearPwd(false);
        userData.setSubjectDN("E=123@qq.com,UID=35,CN=t_123,OU=研发中心,O=qq.com,L=changchu,ST=jilin,C=china");
        userData.setCaName("ManagementCA");
        userData.setEmail("123@qq.com");
        userData.setSubjectAltName(null);
        userData.setStatus(UserDataVOWS.STATUS_NEW);
        userData.setTokenType(UserDataVOWS.TOKEN_TYPE_P12);
        userData.setEndEntityProfileName("EMPTY");
        userData.setCertificateProfileName("ENDUSER");
//        userData.setSendNotification(true);       //如果配置邮件发送，则可以设置增加用户时发送信息。
        ejbcaWS.editUser(userData);
        
        writeFile(userData, ejbcaWS);
 
        System.out.println("create user successfully.");
    }
    
        /**
     * 生成证书
     */
    public void writeFile(UserDataVOWS user1, EjbcaWS ws) throws InvalidAlgorithmParameterException, CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException, UserDoesntFullfillEndEntityProfile_Exception, AuthorizationDeniedException_Exception, ApprovalException_Exception, WaitingForApprovalException_Exception, NotFoundException_Exception, EjbcaException_Exception, InvalidKeyException, NoSuchProviderException, SignatureException, CADoesntExistsException_Exception {
        // For now, assume RSA and SHA1WithRSA.
        String strKeySpec = "1024";
        KeyPair keys = KeyTools.genKeys(strKeySpec,
                AlgorithmConstants.KEYALGORITHM_RSA);
 
        PKCS10CertificationRequest pkcs10 = new PKCS10CertificationRequest("SHA256withRSA", new X500Principal(
                user1.getSubjectDN()), keys.getPublic(), null, keys.getPrivate());
 
        CertificateResponse certenv = ws.certificateRequest(user1,
                new String(Base64.encode(pkcs10.getEncoded())),
                CertificateHelper.CERT_REQ_TYPE_PKCS10, null,
                CertificateHelper.RESPONSETYPE_CERTIFICATE);
//
        X509Certificate cert = certenv.getCertificate();
        java.security.KeyStore jks = java.security.KeyStore
                .getInstance(user1.getTokenType().equals("JKS") ? "JKS"
                        : "pkcs12");
        jks.load(null, user1.getPassword().toCharArray());
 
        java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory
                .getInstance("X.509");
        java.security.cert.Certificate cert1 = cf
                .generateCertificate(new ByteArrayInputStream(cert
                        .getEncoded()));
 
        java.security.cert.Certificate[] certs = new java.security.cert.Certificate[1];
        certs[0] = cert1;
 
        // Following logic used in EjbcaWS.java, the alias is the common
        // name, if present, and otherwise, is the username.
        String alias = CertTools.getPartFromDN(user1.getSubjectDN(),
                "CN");
        if (alias == null) {
            alias = user1.getUsername();
        }
 
 
        String strFileName = "c:\\temp\\test.p12";
 
        FileOutputStream out = new FileOutputStream(strFileName);
 
        // storing keystore
        java.security.PrivateKey ff = keys.getPrivate();
 
        jks.setKeyEntry(alias, ff, user1.getPassword().toCharArray(),
                certs);
        jks.store(out, user1.getPassword().toCharArray());
        out.close();
    }
}

执行程序运行结果如下：

ejbcaWS init successfully. EJBCA Version is :EJBCA 6.2.0 (r19221)
create user successfully.
result:[org.ejbca.core.protocol.ws.client.gen.UserDataVOWS@44c35c97]
==========================
userName:t_123
email:123@qq.com
SubjectDN:E=123@qq.com,UID=35,CN=t_123,OU=研发中心,O=qq.com,L=changchu,ST=jilin,C=china
caName:ManagementCA
==========================

工程所需要jar在ejcb_home/dist/ejbca-ws-cli/lib目录下。