根據Java EE 6中的用戶角色重定向到兩個不同的歡迎頁面/ Glassfish

Question

我已經使用Glassfish 3.1 + JDBCRealm + MySQL（MD5）實現了基於FORM的身份驗證。我只有兩個角色，用戶和管理員。一切都進行得很順利，我可以從認證在這兩種情況下作爲一個USET和管理員工作日誌中看到（請觀看以下日誌）

Q1：是否有可能使兩個不同的索引文件，以便當用戶是管理員時，他/她轉到/admin/index.xhtml，當用戶處於角色用戶時，他直接轉到faces/user/index.xhtml？

Q2：現在，當我以用戶身份登錄時，我仍然可以直接在瀏覽器中直接寫入整個鏈接到「管理員端」，爲什麼要如何避免這種情況？

Q3：當我登錄的用戶，我只有面臨/管理/的index.xhtml在歡迎文件列表，它重定向我到文件，即使XML文件告訴別的東西，爲什麼呢？

<welcome-file-list> 
     <welcome-file>faces/admin/index.xhtml</welcome-file> *?? ----> it goes always here, cause it is the first one I think?* 
     <welcome-file>faces/user/index.xhtml</welcome-file> 
    </welcome-file-list> 

    <security-constraint> 
     <display-name>Admin Pages</display-name> 
     <web-resource-collection> 
      <web-resource-name>Protected Admin Area</web-resource-name> 
      <description/> 
      <url-pattern>/faces/admin/*</url-pattern> 
      <http-method>GET</http-method> 
      <http-method>POST</http-method> 
      <http-method>HEAD</http-method> 
      <http-method>PUT</http-method> 
      <http-method>OPTIONS</http-method> 
      <http-method>TRACE</http-method> 
      <http-method>DELETE</http-method> 
     </web-resource-collection> 
     <auth-constraint> 
      <description/> 
      <role-name>admin</role-name> 
     </auth-constraint> 
    </security-constraint> 
    <security-constraint> 
     <display-name>User Pages</display-name> 
     <web-resource-collection> 
      <web-resource-name>Protected Users Area</web-resource-name> 
      <description/> 
      <url-pattern>/faces/users/*</url-pattern> 
      <!--url-pattern>/faces/users/index.xhtml</url-pattern--> 
      <http-method>GET</http-method> 
      <http-method>POST</http-method> 
      <http-method>HEAD</http-method> 
      <http-method>PUT</http-method> 
      <http-method>OPTIONS</http-method> 
      <http-method>TRACE</http-method> 
      <http-method>DELETE</http-method> 
     </web-resource-collection> 
     <auth-constraint> 
      <description/> 
      <role-name>user</role-name> 
     </auth-constraint> 
    </security-constraint> 

    <login-config> 
     <auth-method>FORM</auth-method> 
     <realm-name>JDBCRealm</realm-name> 
     <form-login-config> 
      <form-login-page>/faces/loginForm.xhtml</form-login-page> 
      <form-error-page>/faces/loginError.xhtml</form-error-page> 
     </form-login-config> 

    </login-config> 
</web-app> 

LOG：

FINE: Login module initialized: class com.sun.enterprise.security.auth.login.JDBCLoginModule 
FINEST: JDBC login succeeded for: admin groups:[admin, user] 
FINE: JAAS login complete. 
FINE: JAAS authentication committed. 
FINE: Password login succeeded for : admin 
FINE: Set security context as user: admin 
FINE: [Web-Security] Setting Policy Context ID: old = null ctxID = jdbcrealm/jdbcrealm 
FINE: [Web-Security] hasUserDataPermission perm: (javax.security.jacc.WebUserDataPermission GET) 
FINE: [Web-Security] hasUserDataPermission isGranted: true 
FINE: [Web-Security] Policy Context ID was: jdbcrealm/jdbcrealm 
FINE: [Web-Security] Codesource with Web URL: file:/jdbcrealm/jdbcrealm 
FINE: [Web-Security] Checking Web Permission with Principals : null 

（myfear的答案後編輯） -----在GlassFish中-web.xml中我有這樣的角色。如果我正確理解它，則意味着管理員屬於組：admin，客戶和用戶。客戶屬於組：客戶和用戶，用戶屬於組用戶。我理解正確嗎？

<security-role-mapping> 
    <role-name>admin</role-name> 
    <group-name>admin</group-name> 
    <group-name>customer</group-name> 
    <group-name>user</group-name> 
    </security-role-mapping> 
    <security-role-mapping> 
    <role-name>customer</role-name> 
    <group-name>customer</group-name> 
    <group-name>user</group-name> 
    </security-role-mapping> 
    <security-role-mapping> 
    <role-name>user</role-name> 
    <group-name>user</group-name> 
    </security-role-mapping> 

</glassfish-web-app> 

謝謝！ Sami

Answer 1

A1）歡迎文件與角色無關。如果你需要做任何派遣用戶的邏輯，你需要考慮使用boolean HttpServletRequest.isUserInRole（String role）或類似的東西來找出用戶在哪個角色中。

A2）不會發生。您需要檢查您的JDBCRealm中的角色。根據我在這裏看到的，一切都以正確的方式配置。 A3）我不確定我是否理解你的評論「XML」文件是正確的。但歡迎，文件沒有必然的角色和..見A1）

感謝， 中號

Answer 2

對於你的問題1：使用從那裏你可以將用戶重定向到指定頁面或者用戶登陸的過濾器。 xhtml或adminlogin.xhtml

public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { 
    String userName = SecurityAssociation.getPrincipal().getName(); 
    String userNameSubject = SecurityAssociation.getSubject().toString(); 

    System.out.println("Yeeey! Get me here and find me in the database: " + userName+ " Subject : "+userNameSubject); 

    filterChain.doFilter(servletRequest, servletResponse); 
}