用於glassfish 3.1網絡應用的CAS認證。關於授權呢？

Question

我試圖建立一個基於glassfish 3.1 + JSF2的Web應用程序。授權使用CAS服務器在Web應用程序安裝jasig CAS客戶端作爲建議在這裏進行：

Configuring the JA-SIG CAS Client for Java in the web.xml

，我能趕上的主要對象在EJB內，當用戶進行身份驗證。 CAS主要屬性來自Active Directory上的LDAP。現在我該如何添加授權？ 如何才能將特定網頁的訪問權限僅限於AD中定義的特定用戶組？

目的只是讓用戶根據其LDAP角色訪問不同的網頁。 我試圖遵循保護從Java EE教程Web應用程序和我的web.xml是

<filter> 
    <filter-name>CAS Authentication Filter</filter-name> 
    <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> 
    <init-param> 
     <param-name>casServerLoginUrl</param-name> 
     <param-value>https://casserver:8443/cas/login</param-value> 
    </init-param> 
    <init-param> 
     <param-name>serverName</param-name> 
     <param-value>http://localhost:8080</param-value> 
    </init-param> 
</filter> 
<filter> 
    <filter-name>CAS Validation Filter</filter-name> 
    <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class> 
    <init-param> 
     <param-name>casServerUrlPrefix</param-name> 
     <param-value>https://casserver:8443/cas</param-value> 
    </init-param> 
    <init-param> 
     <param-name>serverName</param-name> 
     <param-value>http://localhost:8080</param-value> 
    </init-param> 
</filter> 
<filter> 
    <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> 
    <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class> 
</filter> 
<!-- 
<filter> 
    <filter-name>CAS Assertion Thread Local Filter</filter-name> 
    <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class> 
</filter> 
--> 
<filter-mapping> 
    <filter-name>CAS Authentication Filter</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 
<filter-mapping> 
    <filter-name>CAS Validation Filter</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 
<filter-mapping> 
    <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 
<context-param> 
    <param-name>javax.faces.PROJECT_STAGE</param-name> 
    <param-value>Production</param-value> 
</context-param> 
<servlet> 
    <servlet-name>Faces Servlet</servlet-name> 
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class> 
    <load-on-startup>1</load-on-startup> 
</servlet> 
<servlet-mapping> 
    <servlet-name>Faces Servlet</servlet-name> 
    <url-pattern>/faces/*</url-pattern> 
</servlet-mapping> 
<session-config> 
    <session-timeout> 
     30 
    </session-timeout> 
</session-config> 
<welcome-file-list> 
    <welcome-file>faces/index.xhtml</welcome-file> 
</welcome-file-list> 
<security-constraint> 
    <display-name>Pagina di user</display-name> 
    <web-resource-collection> 
     <web-resource-name>index1</web-resource-name> 
     <description>ristretto a user</description> 
     <url-pattern>/faces/index.xhtml</url-pattern> 
    </web-resource-collection> 
    <auth-constraint> 
     <description>user only</description> 
     <role-name>AMP-User</role-name> 
    </auth-constraint> 
</security-constraint> 
<security-constraint> 
    <display-name>Pagina di profile</display-name> 
    <web-resource-collection> 
     <web-resource-name>index2</web-resource-name> 
     <description>risretto a profile</description> 
     <url-pattern>/faces/index_2.xhtml</url-pattern> 
    </web-resource-collection> 
    <auth-constraint> 
     <description>profile only</description> 
     <role-name>AMP-Profile</role-name> 
    </auth-constraint> 
</security-constraint> 
<security-role> 
    <description>utente generico</description> 
    <role-name>AMP-User</role-name> 
</security-role> 
<security-role> 
    <description>Utente di alto profilo</description> 
    <role-name>AMP-Profile</role-name> 
</security-role> 

那麼我指定的角色到我的LDAP組glassifh-web.xml中

<glassfish-web-app error-url=""> 
    <security-role-mapping> 
    <role-name>AMP-Profile</role-name> 
    <group-name>AMP-Profile</group-name> 
    </security-role-mapping> 
    <security-role-mapping> 
    <role-name>AMP-User</role-name> 
    <group-name>AMP-User</group-name> 
    </security-role-mapping> 
    <class-loader delegate="true"/> 
    <jsp-config> 
    <property name="keepgenerated" value="true"> 
     <description>Keep a copy of the generated servlet class' java code.</description> 
    </property> 
    </jsp-config> 
</glassfish-web-app> 

問題是，當我訪問頁面index.xhtml時，表單要求我進行身份驗證，但身份驗證應該由CAS服務器完成。無論如何，我無法驗證。 如何使用CAS認證並將LDAP組映射到角色？

Answer 1

您可以使用安全註釋（JSR 250，javax.security.annotations），定義基於角色的訪問控制：

@Stateless 
@DeclareRoles({"admin", "users"}) 
public class HelloEJB implements Hello { 
    @PermitAll 
    public String hello(String msg) { 
     return "Hello, " + msg; 
    } 

    @RolesAllowed("admin") 
    public String bye(String msg) { 
     return "Bye, " + msg; 
    } 
} 

稍微適應從第一個鏈接下面的例子

這裏我聲明瞭角色首先，使用@DeclareRoles。 @PermitAll授予對所有經過身份驗證的用戶的訪問權限，而@RolesAllowed只授予對所提及角色的訪問權限。

您需要在部署描述符和glassfish中設置角色。我發現這article非常有幫助。 Glassfish Server Security Guide審閱細節。你也可能想看看這question。如果遇到一些問題，請回到這裏。