四郎授權填充授權遠程角色

Question

我使用Tapestry，安全，它使用的Apache四郎

我有處理授權和認證的自定義境界。我們的認證技術上是使用遠程服務發生的，遠程服務返回一個用戶名和一組角色。我只是將用戶名傳遞給我的自定義AuthenticationToken，它允許我查詢我們的本地數據庫並設置SimpleAuthenticationInfo。

我無法弄清楚如何填充使用角色列表中AuthorizationInfo doGetAuthorizationInfo方法從我們的遠程服務還給我。以下是我用來填充領域的代碼。

Login.class

//Remote authentication service 
RemoteLoginClient client = new RemoteLoginClient(); 
RemoteSubject authenticate = client.authenticate(username, password); 

//tapestry security authentication 
Subject currentUser = SecurityUtils.getSubject(); 
CustomAuthenticationToken token = new 
    CustomAuthenticationToken(authenticate.getUsername()); 
System.out.println("roles" + authenticate.getRoles()); 

currentUser.login(token); 

customRealm 公共類CustomRealm內AuthorizationInfo方法擴展AuthorizingRealm {

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { 
    CustomAuthenticationToken upToken = (CustomAuthenticationToken) token; 
    String email = upToken.getUsername(); 

    ApplicationUser applicationUser = (ApplicationUser) session.createCriteria(ApplicationUser.class) 
      .add(Restrictions.like("email", email + "%")) 
      .uniqueResult(); 

    if (applicationUser == null) { 
     throw new UnknownAccountException("User doesn't exist in EPRS database"); 
    } 

    return buildAuthenticationInfo(applicationUser.getId()); 
} 

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { 
//Not sure how to populate the principle or 
//read the principle to populate the SimpleAuthorizationInfo 
    return new SimpleAuthorizationInfo(roleNames); 
} 

Answer 1

擴展AuthorizingRealm是，如果你需要的驗證和授權，以一個良好的開端。此外，作爲PepperBob已經說過，當你在它的Account接口及其SimpleAccount實施支持身份驗證和授權在一個單一的界面，所以你並不需要太多的單獨的代碼爲doGetAuthenticationInfo()和doGetAuthorizationInfo()，可以只返回來自兩種方法的相同對象。

獲取授權信息，你需要做兩件事情：

• 獲得從作爲參數（在大多數情況下，只包含一個主反正）通過主體收集通過可用的主要getAvailablePrincipal()方法（在AuthorizingRealm中整齊地預定義）。
• 加載您的角色並將它們傳遞到您帳戶對象上的setRoles()。

...你就大功告成了。

編輯補充：

這將是存儲的角色，直到你需要他們一個非常簡單的方法。請注意，實際身份驗證在域中完成，該域依賴於RemoteLoginClient。

public class MyRealm extends AuthorizingRealm { 

    private RemoteLoginClient client = ...; 

    private final Map<String, Set<String>> emailToRoles = new ConcurrentHashMap<>(); 

    @Override 
    protected AuthenticationInfo doGetAuthenticationInfo(
      AuthenticationToken token) { 
     final UsernamePasswordToken userPass = (UsernamePasswordToken) token; 

     final RemoteSubject authenticate = this.client.authenticate(
      userPass.getUserName(), userPass.getPassword()); 
     if (authenticate != null) { //assuming this means success 
      this.emailToRoles.put(userPass.getUserName(), authenticate.getRoles()); 
      return new SimpleAuthenticationInfo(...); 
     } else { 
      return null; 
     } 
    } 

    @Override 
    protected AuthorizationInfo doGetAuthorizationInfo(
      PrincipalCollection principals) { 
     final String username = (String) principals.getPrimaryPrincipal(); 
     final Set<String> roles = this.emailToRoles.get(username); 
     return new SimpleAuthorizationInfo(roles); 
    } 

} 

Answer 2

我回答了我自己的問題，並希望發佈此信息以防其他人需要幫助或可能改進我的解決方案。

Login.class方法

Object onSubmit() { 
    try { 
     //Remote Authentication 
     RemoteLoginClient client = new RemoteLoginClient(); 
     RemoteSubject authenticate = client.authenticate(formatUsername(username), password); 

     //tapestry security authentication 
     Subject currentUser = SecurityUtils.getSubject(); 
     CustomAuthenticationToken token = new CustomAuthenticationToken(authenticate.getUsername(), authenticate.getRoles()); 

     currentUser.login(token); 
    } //catch errors 
} 

//自定義令牌用於保存用戶名和其由遠程認證服務集角色。

public class CustomAuthenticationToken implements AuthenticationToken { 

private String username; 
private Set<String> roles; 

public CustomAuthenticationToken(String username, Set<String> roles) { 
    this.username = username; 
    this.roles = roles; 
} 

getters/setters 

//自定義域用於處理本地認證和授權。

public class CustomRealm extends AuthorizingRealm { 

//Hibernate Session 
private final Session session; 
public static final String EMPTY_PASSWORD = ""; 

public CustomRealm(Session session) { 
    this.session = session; 
    setCredentialsMatcher(new AllowAllCredentialsMatcher()); 
    setAuthenticationTokenClass(CustomAuthenticationToken.class); 
} 

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { 
    CustomAuthenticationToken customToken = (CustomAuthenticationToken) token; 
    String email = customToken.getUsername(); 

    User user = (User) session.createCriteria(User.class) 
      .add(Restrictions.like("email", email+ "%")) 
      .uniqueResult(); 

    if (user == null) { 
     throw new UnknownAccountException("User doesn't exist in local database"); 
    } 

    return new SimpleAuthenticationInfo(new CustomPrincipal(user, customToken.getRoles()), EMPTY_PASSWORD, getName()); 
} 

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { 
    return new SimpleAuthorizationInfo(((CustomPrincipal) principals.getPrimaryPrincipal()).getRoles()); 
} 

}

用於保存用戶對象和角色 公共類CustomPrincipal //定義主體{

private User user; 
private Set<String> roles; 

public CustomPrincipal() { 
} 

public CustomPrincipal(User user, Set<String> roles) { 
    this.user = user; 
    this.roles = roles; 
} 

getters/setters