|
這次項(xiàng)目例子是采用struts+hibernate來(lái)搭建的,，其目的是為了實(shí)現(xiàn)jaas在tomcate中的簡(jiǎn)化實(shí)現(xiàn),。在參考了很多資源后,，發(fā)現(xiàn)利用現(xiàn)有框架和服務(wù)器來(lái)實(shí)現(xiàn)身份的驗(yàn)證和授權(quán)是最簡(jiǎn)單的途徑,，所以這次我采用的是在tomcate提供的jaas驗(yàn)證框架下實(shí)現(xiàn)jaas。雖然這個(gè)框架的功能很有限,，但結(jié)合struts的授權(quán)機(jī)制就可以滿(mǎn)足中等項(xiàng)目的需求了,。 一 首先參考tomcate下文檔的jaasRealm的配置，注意文檔中的兩個(gè)地方： Quick Start To set up Tomcat to use JAASRealm with your own JAAS login module, you will need to follow these steps: 1. Write your own LoginModule, User and Role classes based on JAAS (see the JAAS Authentication Tutorial and the JAAS Login Module Developer's Guide) to be managed by the JAAS Login Context (javax.security.auth.login.LoginContext) When developing your LoginModule, note that JAASRealm's built-in CallbackHandler +only recognizes the NameCallback and PasswordCallback at present. 2. Although not specified in JAAS, you should create seperate classes to distinguish between users and roles, extending javax.security.Principal, so that Tomcat can tell which Principals returned from your login module are users and which are roles (see org.apache.catalina.realm.JAASRealm). Regardless, the first Principal returned is always treated as the user Principal. 3. Place the compiled classes on Tomcat's classpath 4. Set up a login.config file for Java (see JAAS LoginConfig file) and tell Tomcat where to find it by specifying its location to the JVM, for instance by setting the environment variable: JAVA_OPTS=-DJAVA_OPTS=-Djava.security.auth.login.config==$CATALINA_HOME/conf/jaas.config 5. Configure your security-constraints in your web.xml for the resources you want to protect 6. Configure the JAASRealm module in your server.xml 7. Restart Tomcat 5 if it is already running. Additional Notes · When a user attempts to access a protected resource for the first time, Tomcat 5 will call the authenticate() method of this Realm. Thus, any changes you have made in the security mechanism directly (new users, changed passwords or roles, etc.) will be immediately reflected. · Once a user has been authenticated, the user (and his or her associated roles) are cached within Tomcat for the duration of the user's login. For FORM-based authentication, that means until the session times out or is invalidated; for BASIC authentication, that means until the user closes their browser. Any changes to the security information for an already authenticated user will not be reflected until the next time that user logs on again. · As with other Realm implementations, digested passwords are supported if the <Realm> element in server.xml contains a digest attribute; JAASRealm's CallbackHandler will digest the password prior to passing it back to the LoginModule 二 按照文檔Quick Start的順序先編寫(xiě)jaas’s code Role package bo;
import java.security.Principal;
public class Role implements Principal { private String rolename; public Role(String rolename) { this.rolename=rolename; }
/**//** * equals * * @param object Object * @return boolean * @todo Implement this java.security.Principal method */ public boolean equals(Object object){ System.out.print("object="+object.getClass().toString()); boolean flag=false; if(object==null) flag=false; if(this==object) flag= true; if(!(object instanceof Role)) flag= false; if(object instanceof Role) { Role that = (Role) object; if (this.getName().equals(that.getName())) { flag= true; } } System.out.println("flag="+flag); return flag;
}
/**//** * toString * * @return String * @todo Implement this java.security.Principal method */ public String toString() { return this.getName(); }
/**//** * hashCode * * @return int * @todo Implement this java.security.Principal method */ public int hashCode() { return rolename.hashCode(); }
/**//** * getName * * @return String * @todo Implement this java.security.Principal method */ public String getName() { return this.rolename; } }
User package bo;
import java.security.Principal;
public class User implements Principal { private String username; public User(String username) { this.username=username; }
/**//** * equals * * @param object Object * @return boolean * @todo Implement this java.security.Principal method */ public boolean equals(Object object) { System.out.print("object="+object.getClass().toString()); boolean flag=false; if(object==null) flag=false; if(this==object) flag= true; if(!(object instanceof User)) flag= false; if(object instanceof User) { User that = (User) object; if (this.getName().equals(that.getName())) { flag= true; } } System.out.println("flag="+flag); return flag; }
/**//** * toString * * @return String * @todo Implement this java.security.Principal method */ public String toString() { return this.getName(); }
/**//** * hashCode * * @return int * @todo Implement this java.security.Principal method */ public int hashCode() { return username.hashCode(); }
/**//** * getName * * @return String * @todo Implement this java.security.Principal method */ public String getName() { return this.username; }
}
TestLoginMoudle package bo;
import java.util.Map;
import javax.security.auth.Subject; import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; import javax.security.auth.callback.NameCallback; import javax.security.auth.callback.PasswordCallback; import javax.security.auth.login.FailedLoginException; import javax.security.auth.login.LoginException; import javax.security.auth.spi.LoginModule;
public class TestLoginMoudle implements LoginModule{
// initial state private Subject subject;
private CallbackHandler callbackHandler;
private Map sharedState;
private Map options;
// 配置選項(xiàng). private boolean debug = false;
// 鑒別狀況 private boolean succeeded = false;
private boolean commitSucceeded = false;
// 用戶(hù)名和用戶(hù)密碼. private String username;
private char[] password;
// 用戶(hù)的Principal private User user; private Role role;
/**//** * initialize * * @param subject Subject * @param callbackHandler CallbackHandler * @param map Map * @param map3 Map * @todo Implement this javax.security.auth.spi.LoginModule method */ public void initialize(Subject subject, CallbackHandler callbackHandler, Map map, Map map3) { this.subject = subject; this.callbackHandler = callbackHandler; this.sharedState = map; this.options = map3; }
/**//** * login * * @return boolean * @throws LoginException * @todo Implement this javax.security.auth.spi.LoginModule method */ public boolean login() throws LoginException{ //提示輸入用戶(hù)名和密碼; if (callbackHandler == null){ throw new LoginException("No CallBackHandler!"); } Callback[] callbacks = new Callback[2]; callbacks[0] = new NameCallback("user name"); callbacks[1] = new PasswordCallback("password", false); try{ callbackHandler.handle(callbacks); username = ( (NameCallback) callbacks[0]).getName(); password = ( (PasswordCallback) callbacks[1]).getPassword(); System.out.println("username=" + username); System.out.println("password=" + new String(password)); } catch (Exception e) { e.printStackTrace(); } // 檢驗(yàn)用戶(hù)名和用戶(hù)密碼. boolean isuser = false; boolean ispass = false;
//應(yīng)該調(diào)用ORM操作數(shù)據(jù)對(duì)比用戶(hù)名和密碼;
if (username.equals("hello")) { isuser = true; String pw_str = new String(password); if (pw_str.equals("hello")) { System.out.println("Login succesed!"); ispass = true; succeeded = true; return succeeded; } } if (!isuser) { throw new FailedLoginException("User Name Incorrect"); } else { throw new FailedLoginException("Password Incorrect"); } }
/**//** * commit * * @return boolean * @throws LoginException * @todo Implement this javax.security.auth.spi.LoginModule method */ public boolean commit() throws LoginException { if (!succeeded) { return false; } else { user = new User(username); role = new Role("guest"); if (!subject.getPrincipals().contains(user)) { //注冊(cè)用戶(hù) subject.getPrincipals().add(user); } if (!subject.getPrincipals().contains(role)) { //注冊(cè)角色 subject.getPrincipals().add(role); } if (debug) { System.out.println("Add Subject Successed!"); } username = null; for (int i = 0; i < password.length; i++) { password[i] = ' '; } commitSucceeded = true; return true; } }
/**//** * abort * * @return boolean * @throws LoginException * @todo Implement this javax.security.auth.spi.LoginModule method */ public boolean abort() throws LoginException { System.out.println("abort()"); if (succeeded == false) { return false; } else if (succeeded == true && commitSucceeded == false) { // login succeeded but overall authentication failed succeeded = false; username = null; if (password != null) { for (int i = 0; i < password.length; i++) { password[i] = ' '; } password = null; } user = null; role = null; } else { logout(); } return true;
}
/**//** * logout * * @return boolean * @throws LoginException * @todo Implement this javax.security.auth.spi.LoginModule method */ public boolean logout() throws LoginException { System.out.println("logout()"); subject.getPrincipals().remove(user); subject.getPrincipals().remove(role); succeeded = false; succeeded = commitSucceeded; username = null; if (password != null) { for (int i = 0; i < password.length; i++) { password[i] = ' '; } password = null; } user = null; role = null; return true;
}
} 將上述文件打包在一個(gè)jar文件中,，jar文件名字可以任意?。?/p> 假設(shè)$CATALINA_HOME=D:\jakarta-tomcat- 當(dāng)將文件打包后,，需要將打包的文件放在$CATALINA_HOME\server\lib下,。 如果不將上述文件打包的話(huà)，可以直接將上述文件和所屬的包放在$CATALINA_HOME\server\classes文件夾下,。 三 首先要建立jaas.config文件,，我的jaas.config文件內(nèi)容如下： MyFooRealm{ bo.TestLoginMoudle required debug=true; }; 在環(huán)境變量中配置JAVA_OPTS=-Djava.security.auth.login.config==%CATALINA_HOME%/conf/jaas.config 四 在你建的工程web.xml中配置你想保護(hù)的資源和驗(yàn)證形勢(shì)，其代碼如下： <security-constraint> <display-name>Tomcat server configuation security constraint</display-name> <web-resource-collection> <web-resource-name>Protected Area</web-resource-name> <!-- Define the context-relative URL(s) to be protected --> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <!-- Anyone with one of the listed roles may access this area --> <role-name>guest</role-name> </auth-constraint> </security-constraint>
<login-config> <auth-method>FORM</auth-method> <realm-name>jaas role validate</realm-name> <form-login-config> <form-login-page>/roleValidate/login.jsp</form-login-page> <form-error-page>/roleValidate/error.jsp</form-error-page> </form-login-config> </login-config>
五 在tomcate中配置servlet.xml來(lái)修改服務(wù)器默認(rèn)的驗(yàn)證框架： <Realm className="org.apache.catalina.realm.JAASRealm" appName="MyFooRealm" userClassNames="bo.User" roleClassNames="bo.Role" debug="99"/>
好了,，現(xiàn)在重新啟動(dòng)服務(wù)器就可以看到效果了,！ |
|
|
