使用Java Restful服務進行身份驗證

Question

我正嘗試使用Glassfish v3上的基本身份驗證來獲得Java EE球衣平安服務。

目前，該服務要求用戶進行身份驗證，並且如果提供了正確的憑據，則允許該領域內（任何角色）的任何用戶訪問該服務。它應該只允許管理員角色訪問。

此外，如果我嘗試限制使用@RolesAllowed註釋，這也被忽略。

其餘代碼：

@Path("/file") 
public class FileResource { 

    @GET 
    @Produces("application/json") 
    public Response getJson() { 
     String result = "{\"data\":\"test\"}"; 
     return Response.ok(result, MediaType.APPLICATION_JSON).build(); 
    } 

    @GET 
    @Produces(MediaType.TEXT_PLAIN) 
    @RolesAllowed("admin") 
    public Response getOther() { 
     String result = "{\"employee\":[{\"email\":\"jdoe@example.com\",\"firstName\":\"John\",\"lastName\":\"Doe\"},{\"email\":\"mmajor@example.com\",\"firstName\":\"Mary\",\"lastName\":\"Major\"}]}"; 
     return Response.ok(result, MediaType.APPLICATION_JSON).build(); 
    } 
} 

的web.xml文件代碼：

<?xml version="1.0" encoding="UTF-8"?> 
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" 
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" 
    id="WebApp_ID" version="3.0"> 
    <display-name>org.examples.secure</display-name> 
    <welcome-file-list> 
     <welcome-file>index.xhtml</welcome-file> 
    </welcome-file-list> 

    <servlet> 
     <servlet-name>JAX-RS Servlet</servlet-name> 
     <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class> 
     <load-on-startup>1</load-on-startup> 
    </servlet> 
    <servlet> 
     <servlet-name>Faces Servlet</servlet-name> 
     <servlet-class>javax.faces.webapp.FacesServlet</servlet-class> 
     <load-on-startup>1</load-on-startup> 
    </servlet> 

    <servlet-mapping> 
     <servlet-name>JAX-RS Servlet</servlet-name> 
     <url-pattern>/rs/*</url-pattern> 
    </servlet-mapping> 
    <servlet-mapping> 
     <servlet-name>Faces Servlet</servlet-name> 
     <url-pattern>*.xhtml</url-pattern> 
    </servlet-mapping> 

    <login-config> 
     <auth-method>BASIC</auth-method> 
     <realm-name>DBRealm</realm-name> 
    </login-config> 

    <security-constraint> 
     <web-resource-collection> 
      <web-resource-name>users</web-resource-name> 
      <url-pattern>/rs/*</url-pattern> 
     </web-resource-collection> 
     <auth-constraint> 
      <description/> 
      <role-name>admin</role-name> 
     </auth-constraint> 
     <!-- <user-data-constraint> 
      <description>SSL</description> 
      <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
     </user-data-constraint> --> 
    </security-constraint> 

    <security-role> 
     <role-name>admin</role-name> 
    </security-role> 

</web-app> 

的sun-web.xml代碼：

<?xml version="1.0" encoding="UTF-8"?> 
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd"> 
<sun-web-app error-url=""> 
    <context-root>/org.examples.secure</context-root> 
    <security-role-mapping> 
    <role-name>admin</role-name> 
    <group-name>admin</group-name> 
    </security-role-mapping> 
    <class-loader delegate="true"/> 
    <jsp-config> 
    <property name="keepgenerated" value="true"> 
     <description>Keep a copy of the generated servlet class java code.</description> 
    </property> 
    </jsp-config> 
</sun-web-app> 

任何幫助，將不勝感激

Answer 1

您需要添加RolesAllowedResourceFilterFactory添加到您的Web應用程序（請參閱鏈接的javadoc）以使@RolesAllowed註釋生效。