如何在web.xml OSGI WAB自由角色映射中映射admin auth约束

Question

我正在构建一个单独的admincenter工具，需要管理员角色才能访问。如何在web.xml的auth-constraint中指定它。

我试过下面，它不起作用

<security-constraint>
    <web-resource-collection>
        <web-resource-name>commonlogin-secure-resources</web-resource-name>
        <url-pattern>/rest/readyToLand</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>test</role-name>
        <role-name>Administrator</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

在server.xml

<basicRegistry>
    <user name="admin" password="adminPassword"/>
</basicRegistry>    
<administrator-role>
    <user>admin</user>
</administrator-role>

登录后，如果我尝试访问此URL，则表示我无权访问它。我需要在某处做绑定吗？

将IBM-Authorization-Roles: com.ibm.ws.management添加到MANIFEST.MF后，我可以使用admin角色访问它，但不能使用test角色访问它。配置有什么问题。如何在osgi包中进行角色映射？

Answer 1

在web.xml添加额外的角色allAuthenticatedUsers允许他们与管理员用户。在关于OSGI捆绑安全性的ibm文档中没有找到太多内容。但它奏效了。

   <security-constraint>
        <web-resource-collection>
            <url-pattern>/rest/readyToLand</url-pattern>
            <url-pattern>/LoginSuccess.jsp</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>Administrator</role-name>
            <role-name>allAuthenticatedUsers</role-name>
        </auth-constraint>
    </security-constraint>
    <security-role id="SecurityRole_1">
        <description>Administrator role</description>
        <role-name>Administrator</role-name>
    </security-role>
    <security-role id="SecurityRole_2">
        <description>Any Role</description>
        <role-name>allAuthenticatedUsers</role-name>
    </security-role>

我想我不需要<role-name>Administrator</role-name>。但request.isUserInRole('Administrator')无论如何都是真的。

更新任何一种情况我无法识别管理员，测试用户在应用程序中具有上述配置。使用IBM-Authorization-Roles: com.ibm.ws.management只能识别管理员 - request.isUserInRole('Administrator')将起作用。但即使用户使用该测试角色登录并且能够访问该URL，request.isUserInRole('test')也不是。

这很奇怪 - 它允许访问但是当我检查角色是什么时，它不起作用。看起来IBM中存在一个问题 - Liberty代码（17.0.0.4）。但不确定。

Answer 2

我使用spring security实现了相同的功能。假设您有应用程序，并且您拥有不同角色的不同用户，因此您可以通过spring安全性来实现。使用Spring安全性是保护应用程序安全的最佳方式。

1.在Web.xml中添加条目

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

2.然后通过用户在Spring-security.xml中添加条目，将admin / framework / something / doAction添加到用户/例如/ framework / something / do中添加要限制的URL

<security:http use-expressions="true" auto-config="false"
    entry-point-ref="http403EntryPoint" pattern="/framework/something/doAction"
    create-session="stateless">
    <security:csrf disabled="true" />
    <security:custom-filter position="PRE_AUTH_FILTER"
        ref="authorizationGlobalFilterBean" />
</security:http>

3.AuthorizationGlobalFilterBean将按角色过滤用户。您可以在此处进行验证。

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

    logger.debug("Authorization  Filter Called#########################################################");
    // logger.debug("sessionServiceImpl..."+sessionServiceImpl);
    // logger.debug("iUserDao..."+iUserDao);

    HttpServletRequest httpReq = (HttpServletRequest) request;
    // logger.debug("http Request URL.."+httpReq.getRequestURL());

    HttpServletRequest r = (HttpServletRequest) request;
    String sessionObjId = getSessionIdFromHeader(r);

    // check session
    boolean isSessionExpired = checkSessionExpired(sessionObjId);

    if (isSessionExpired) {
        HttpServletResponse resp = (HttpServletResponse) response;
        resp.addHeader("sessionId", "");
        resp.addHeader("status", "false");
        resp.addHeader("message", "Session Expired");
        resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Session Expired");
        return;
    }

    // CustomUserDetailsService cs = new CustomUserDetailsService();
    UserDetails user = loadUserByUsername(sessionObjId);

    if (user == null) {
        HttpServletResponse resp = (HttpServletResponse) response;
        resp.addHeader("sessionId", "");
        resp.addHeader("status", "false");
        resp.addHeader("message", "User Not Found");
        resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "User Not Found");
        return;
    }
    // logger.debug("user..."+user);
    logger.debug("user name.." + user.getUsername());
    logger.debug("user name.." + user.getUsername());

    List<String> ltUserPrivileges = userServiceImpl.findUserPrivilege(user.getUsername());
    logger.debug("ltUserPrivileges..." + ltUserPrivileges);

    String requestURI = httpReq.getRequestURI();
    // String requestURL = httpReq.getRequestURL().toString();
    String contextPath = httpReq.getContextPath();
    String queryString = httpReq.getQueryString();
    // String port = httpReq.getServerPort()+"";
    // logger.debug("request URL..."+httpReq.getRequestURL());
    // logger.debug("requestURI..."+requestURI);
    // logger.debug("contextPath..."+contextPath);
    // logger.debug("queryString..."+queryString);
    int i = 0;
    if ((i = requestURI.indexOf(contextPath)) >= 0) {
        // logger.debug("removing context from path.."+i);
        requestURI = requestURI.substring(i + contextPath.length());
        // logger.debug("new requestURI.."+requestURI);
    }
    if (queryString != null && queryString.trim().length() > 0) {
        requestURI = requestURI + "?" + queryString;
    }
    logger.debug("Final requestURI.." + requestURI);

    /*
     * if( (i=requestURL.indexOf(port))>=0){
     * logger.debug("removing port from path.."+i);
     * requestURL = requestURL.substring(i+port.length());
     * logger.debug("new requestURL.."+requestURL);
     * }
     */

    List<String> ltPrev = getMatchingUrlPrivileges(requestURI,request);
    boolean allowed = false;
    if (ltPrev != null && ltPrev.size() > 0) {
        for (String expectedPrev : ltPrev) {
            logger.debug("Expected Previleges.." + expectedPrev);
            if (ltUserPrivileges != null && ltUserPrivileges.contains(expectedPrev)) {
                logger.debug("Previlege Available.....................................................");
                allowed = true;
                break;
            }
        }
        Authentication authentication;
        try { // If the credentials to not match then an AuthenticationException is thrown.
            authentication = attemptAuthentication(user);

            // If successfully authenticated then pass the request to the success handler
            if (authentication.isAuthenticated())
                SecurityContextHolder.getContext().setAuthentication(authentication);

            logger.debug("successfull authentiation");
        } catch (AuthenticationException exception) {
            // Pass the request to authentication failure handler.
            logger.error("unsuccessfull authentication", exception);
            return;
        }

    } else {

        logger.debug("There is no user previleges  required for the URL , so 
      allow it");
        allowed = true;
        Authentication authentication;
        try { // If the credentials to not match then an 
            // AuthenticationException is thrown.
            authentication = attemptAuthentication(user);

            // If successfully authenticated then pass the request to the success handler
            if (authentication.isAuthenticated())
                SecurityContextHolder.getContext().setAuthentication(authentication);

            logger.debug("successfull authentiation");
        } catch (AuthenticationException exception) {
            // Pass the request to authentication failure handler.
            logger.error("unsuccessfull authentication", exception);
            return;
        }
    }

    if (!allowed) {
        logger.debug("*****************************User 
         AccessDenied******************************");
        // throw new PreAuthenticationUserNotFound("User Access Denied");
        // ((HttpServletResponse) 
        response).sendError(HttpServletResponse.SC_FORBIDDEN, "User Access 
       Denied");
        ((HttpServletResponse) response).setContentType("application/json");
        ((HttpServletResponse) response).setStatus(HttpServletResponse.SC_FORBIDDEN);
        try {
            JSONObject json  = new JSONObject();
            json.put("msg", "User Access Denied");
            json.put("url", requestURI);
            ((HttpServletResponse) response).getOutputStream().println(json.toString());
        } catch (JSONException e) {
            logger.error("Error: ", e);
        }
        return;
    }

    /**
     * if(user.getUsername().equalsIgnoreCase("ypalrecha") &&
     * httpReq.getRequestURL().indexOf("framework/dag/dagWithParams")>=0){
     * logger.debug("*****************************User Access Denied******************************");
     * throw new PreAuthenticationUserNotFound("User Access Denied");
     * }
     **/
    /*
     * if(user){
     * throw new PreAuthenticationUserNotFound("Session not valid or expired");
     * }
     */

    // logger.debug("Request Session..."+r.getHeader("sessionId"));
    // logger.debug("Request Status..."+r.getHeader("status"));

    chain.doFilter(request, response);
}

Authentication attemptAuthentication(UserDetails user) throws AuthenticationException, IOException, ServletException {

    String username = user.getUsername();
    String password = user.getPassword();

    Authentication authentication = new UsernamePasswordAuthenticationToken(username, password, getAuthorities("Admin"));
    return authentication;
}

您有用户的角色更多..

public List<String> getRoles(String role) {

    List<String> roles = new ArrayList<String>();
    if (role.trim().equalsIgnoreCase("Admin".trim())) {
        roles.add("ROLE_ADMIN");
    }

    if (role.trim().equalsIgnoreCase("User".trim())) {
        roles.add("ROLE_USER");
    }
    return roles;
}