前言: 网上很多文章都在讲LDAP Server,但是很少有人提及如何使用它来做验证和授权,今天写出此贴,希望能够帮助各位开发人员。
目标: 使用JAAS框架,使用Struts框架,使用LDAP Server,使用JBOSS,做用户的验证和授权 (验证的含义是用户有效,即用户名、密码输入正确;授权的含义是用户被授予某种角色)
基础要求: 精通J2EE框架 会使用Struts开发 能够正确安装iPlanet Directory Server,并有使用经验 熟悉JBOSS开发 熟悉JAAS框架
准备: windows 2k (要加入域) j2sdk1.4.2 installed jboss3.2.5 higher installed iPlanet Directory Server 5.1 Service Pack 2 installed
首先说一下JAAS和LDAP: 在实际开发过程中,很多项目都会使用同一个用户信息源,比如客户的Notes系统、ERP系统等等。 如果我们授命为客户开发一套新的应用,就需要和上述系统一同使用一个用户信息源“LDAP Server”。 JAAS是一个JAVA应用的验证、授权框架。很多Application Server都会去实现这个框架(JBOSS就是其中之一),从而使开发人员不需要自己动手就可以在项目中使用高可靠的安全验证体系。
首先假设我们在JBOSS下开发一个应用,叫做“myapp” LDAP Server使用Sun iPlanet Directory Server LDAP中增加一个组织结构 Group: admin, Engineer Role: SysUser, admin, Engineer User: JZhao (密码:password,角色:SysUser、admin、Engineer)
如果不愿意手动建立用户,可以copy下面的内容存入temp.ldif文件中,使用iPlanet的导入功能建立用户 temp.ldif文件的内容: # ================================== OU DEFINITIONS # People OU - for holding records of all individuals dn: ou=People,dc=china,dc=xxx,dc=com ou: People objectClass: top objectClass: organizationalUnit
# Groups OU - for holding records of groupings of individuals dn: ou=Groups,dc=china,dc=xxx,dc=com ou: Groups objectClass: top objectClass: organizationalUnit
# Roles OU - for holding records of roles and the groups to which those roles have been assigned dn: ou=Roles,dc=china,dc=xxx,dc=com ou: Roles objectClass: top objectClass: organizationalUnit
# ================================== PEOPLE ENTRIES dn: uid=JZhao,ou=People,dc=china,dc=xxx,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson sn: Zhao cn: Jun Zhao uid: JZhao userPassword: {SSHA}UvEbEwmjbUYCjugQ8p53EPj0z22bbAxiWmSCaA== mail: junzhao@vandagroup.com.cn
# ================================== GROUPS ENTRIES dn: cn=SysUser,ou=Groups,dc=china,dc=xxx,dc=com objectClass: top objectClass: groupOfUniqueNames cn: SysUser uniqueMember: uid=JZhao,ou=People,dc=china,dc=xxx,dc=com
dn: cn=admin,ou=Groups,dc=china,dc=xxx,dc=com objectClass: top objectClass: groupOfUniqueNames cn: admin uniqueMember: uid=JZhao,ou=People,dc=china,dc=xxx,dc=com
dn: cn=Engineer,ou=Groups,dc=china,dc=xxx,dc=com objectClass: top objectClass: groupOfUniqueNames cn: Engineer
# ================================== ROLES ENTRIES dn: cn=SysUser,ou=Roles,dc=china,dc=xxx,dc=com objectClass: top objectClass: groupOfUniqueNames cn: SysUser uniqueMember: cn=Everyone,ou=Groups,dc=china,dc=xxx,dc=com uniqueMember: uid=JZhao,ou=People,dc=china,dc=xxx,dc=com
# ======================= dn: cn=admin,ou=Roles,dc=china,dc=xxx,dc=com objectClass: top objectClass: groupOfUniqueNames cn: admin uniqueMember: cn=admin,ou=Groups,dc=china,dc=xxx,dc=com uniqueMember: uid=JZhao,ou=People,dc=china,dc=xxx,dc=com
# ======================= dn: cn=Engineer,ou=Roles,dc=china,dc=xxx,dc=com objectClass: top objectClass: groupOfUniqueNames cn: Engineer uniqueMember: cn=Engineer,ou=Groups,dc=china,dc=xxx,dc=com uniqueMember: uid=JZhao,ou=People,dc=china,dc=xxx,dc=com
WEB-INF/web.xml中增加下面内容:
<welcome-file-list> <welcome-file>index.jsp</welcome-file> </welcome-file-list> <!-- 添加入口角色检查,对所有的jsp资源进行拦截保护,本段内容规定SysUser可以进入系统 --> <security-constraint> <web-resource-collection> <web-resource-name>Restricted</web-resource-name> <description>Declarative security tests</description> <url-pattern>*.jsp</url-pattern> <url-pattern>*.do</url-pattern> <url-pattern>/servlet/ComandLineServlet</url-pattern> <http-method>HEAD</http-method> <http-method>GET</http-method> <http-method>POST</http-method> <http-method>PUT</http-method> <http-method>DELETE</http-method> </web-resource-collection> <auth-constraint> <role-name>SysUser</role-name> </auth-constraint> <user-data-constraint> <description>no description</description> <transport-guarantee>NONE</transport-guarantee> </user-data-constraint> </security-constraint>
<!-- 定义登录的页面和登录出错的页面 --> <!--这里采用的是表单验证,表单验证首先进入login.jsp,我们这里出错页面也是login.jsp-->
<!--要注意的是,采取表单验证,login.jsp中必须是:账号 j_username* 密码 j_password action j_security_check -->
<login-config> <auth-method>FORM</auth-method> <form-login-config> <form-login-page>/login.jsp</form-login-page> <form-error-page>/login.jsp</form-error-page> </form-login-config> </login-config>
<!-- 在此定义安全角色 --> <security-role> <description>A user allowed to login</description> <role-name>SysUser</role-name> </security-role>
WEB-INF/jboss-web.xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE jboss-web PUBLIC "-//JBoss//DTD Web Application 2.3//EN" "http://www./j2ee/dtd/jboss-web_3_2.dtd">
<jboss-web> <!--这里的 myapp-security一定要和login-config.xml中的application-policy name 对应--> <security-domain>java:/jaas/myapp-security</security-domain> <context-root>myapp</context-root> </jboss-web>
JBOSS_HOME/server/default/conf/login-config.xml中增加
<application-policy name = "myapp-security"> <authentication> <login-module code = "org.jboss.security.auth.spi.LdapLoginModule" flag = "required"> <module-option name="java.naming.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</module-option> <module-option name="java.naming.provider.url">ldap://home.china.xxx.com:389/</module-option> <module-option name="java.naming.security.authentication">simple</module-option> <module-option name="principalDNPrefix">uid=</module-option> <module-option name="principalDNSuffix">,ou=People,dc=china,dc=xxx,dc=com</module-option> <module-option name="rolesCtxDN">ou=Roles,dc=china,dc=xxx,dc=com</module-option> <module-option name="uidAttributeID">uniqueMember</module-option> <module-option name="roleAttributeID">cn</module-option> <module-option name="matchOnUserDN">true</module-option> </login-module> </authentication> </application-policy>
index.jsp内容: <% out.write("Login Successful! "+new java.util.Date()); out.write("is SysUser="+httpServletRequest.isUserInRole("SysUser")); out.write("is admin="+httpServletRequest.isUserInRole("admin")); out.write("is Engineer="+httpServletRequest.isUserInRole("Engineer")); %>
login.jsp中的FORM内容: <FORM name="logonForm" method="post" action="j_security_check"> <input name="j_username" type="text" /> <input name="j_password" type="password" /> </FORM>
* 账号 j_username * 密码 j_password * action j_security_check “*”内容为固定写法,不能改变
所有准备完成之后,启动JBOSS,在浏览器中输入http://ip:8080/myapp 进入index.jsp,但权限不允许匿名进入,所以会被Server将请求转入login.jsp,输入JZhao:password,判断成功之后,将会自动转入index.jsp,在页面中你会看到下面的输入
Login Successfull! Sat Nov 27 11:52:36 CST 2004 is SysUser=true is admin=true is Engineer=true
转载请注明作者出处:玉虎 http://blog.csdn.net/oicqren
|