2014-11-04 42 views
3

我一直有這樣的東西事情的真正問題,我通常不會在這裏發佈問題,除非我已經完全耗盡我的資源(Internet搜索和同行幫助)。使用JSF 2.2的表單身份驗證方法Glassfish 4.1失敗

我想運行一個演示應用程序,通過j_security_check操作提供表單驗證。

我相信這個方法的一切都正確配置。

,我得到的主要警告:

Warning: Unable to find component with ID j_username in view. 
Warning: Unable to find component with ID j_password in view. 
Severe: jdbcrealm.grouperror 
Warning: WEB9102: Web Login Failed: com.sun.enterprise.security.auth.login.common.LoginException: Login failed: Security Exception 

我的index.xhtml頁面重定向到登錄頁面,如果未經授權的觀點是即將發生。
我知道我的信用是正確的,因爲我創造了他們。

我知道這絕對不是進行身份驗證的最佳方法,但我被要求這樣做,並且現在已經沮喪了很多個小時。

繼承人一些參考

的web.xml

<?xml version="1.0" encoding="UTF-8"?> 
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee"                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"> 
<context-param> 
    <param-name>javax.faces.PROJECT_STAGE</param-name> 
    <param-value>Development</param-value> 
</context-param> 
<servlet> 
    <servlet-name>Faces Servlet</servlet-name> 
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class> 
    <load-on-startup>1</load-on-startup> 
</servlet> 
<servlet-mapping> 
    <servlet-name>Faces Servlet</servlet-name> 
    <url-pattern>/faces/*</url-pattern> 
</servlet-mapping> 
<login-config> 
    <auth-method>FORM</auth-method> 
    <realm-name>jdbcRealm</realm-name> 
    <form-login-config> 
     <form-login-page>/faces/login.xhtml</form-login-page> 
     <form-error-page>/faces/loginError.xhtml</form-error-page> 
    </form-login-config> 
</login-config> 
<session-config> 
    <session-timeout> 
     30 
    </session-timeout> 
</session-config> 
<security-constraint> 
    <web-resource-collection> 
     <web-resource-name>Admin user</web-resource-name> 
     <url-pattern>/faces/admin/*</url-pattern> 
     <http-method>GET</http-method> 
     <http-method>POST</http-method> 
    </web-resource-collection> 
    <auth-constraint> 
     <role-name>ADMIN</role-name> 
    </auth-constraint> 
</security-constraint> 
<security-constraint> 
    <web-resource-collection> 
     <web-resource-name>User</web-resource-name> 
     <description/> 
     <url-pattern>/faces/users/*</url-pattern> 
     <http-method>GET</http-method> 
     <http-method>POST</http-method> 
    </web-resource-collection> 
    <auth-constraint> 
     <role-name>ADMIN</role-name> 
     <role-name>USER</role-name> 
    </auth-constraint> 
</security-constraint> 
<welcome-file-list> 
    <welcome-file>faces/index.xhtml</welcome-file> 
</welcome-file-list> 

的glassfish-web.xml中

<?xml version="1.0" encoding="UTF-8"?> 
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd"> 
<glassfish-web-app error-url=""> 
<class-loader delegate="true"/> 
<jsp-config> 
    <property name="keepgenerated" value="true"> 
     <description>Keep a copy of the generated servlet class' java code.</description> 
    </property> 
    <security-role-mapping> 
     <role-name>ADMIN</role-name> 
     <group-name>ADMIN</group-name> 
    </security-role-mapping> 
    <security-role-mapping> 
     <role-name>USER</role-name> 
     <group-name>USER</group-name> 
    </security-role-mapping> 
</jsp-config> 

login.xhtml

<?xml version='1.0' encoding='UTF-8' ?> 
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
<html xmlns="http://www.w3.org/1999/xhtml" 
    xmlns:h="http://xmlns.jcp.org/jsf/html"> 
<h:head> 
    <title>Facelet Title</title> 
</h:head> 
<h:body> 
    <p>Login to access secure pages:</p> 
    <form method="POST" action="j_security_check"> 
     <h:panelGroup> 
     <h:panelGrid columns="2"> 
      <h:outputLabel for="j_username" value="Username" /> 
      <input type="text" name="j_username" /> 

      <h:outputLabel for="j_password" value="Password" /> 
      <input type="password" name="j_password" /> 

      <h:outputText value="" /> 
      <h:panelGrid columns="2"> 
       <input type="submit" name="submit" value="Login" /> 
       <h:button outcome="index.xhtml" value="Cancel" /> 
      </h:panelGrid> 
     </h:panelGrid> 
      </h:panelGroup> 
    </form> 
</h:body> 

與GlassFish resources.xml中

<?xml version="1.0" encoding="UTF-8"?> 
<!DOCTYPE resources PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Resource Definitions//EN" "http://glassfish.org/dtds/glassfish-resources_1_5.dtd"> 
<resources> 
<jdbc-resource enabled="true" jndi-name="jdbc/jdbcRealm" object-type="user" pool-name="RealmConnectionPool"> 
<description/> 
</jdbc-resource> 
<jdbc-connection-pool allow-non-component-callers="false" associate-with-thread="false" connection- creation-retry-attempts="0" connection-creation-retry-interval-in-seconds="10" connection-leak-reclaim="false" connection-leak-timeout-in-seconds="0" connection-validation-method="auto-commit" datasource-classname="com.mysql.jdbc.jdbc2.optional.MysqlDataSource" fail-all-connections="false" idle-timeout-in-seconds="300" is-connection-validation-required="false" is-isolation-level-guaranteed="true" lazy-connection-association="false" lazy-connection-enlistment="false" match-connections="false" max-connection-usage-count="0" max-pool-size="32" max-wait-time-in-millis="60000" name="RealmConnectionPool" non-transactional-connections="false" pool-resize-quantity="2" res-type="javax.sql.DataSource" statement-timeout-in-seconds="-1" steady-pool-size="8" validate-atmost-once-period-in-seconds="0" wrap-jdbc-objects="false"> 
<property name="URL" value="jdbc:mysql://localhost:3306/jdbcrealmdemo?zeroDateTimeBehavior=convertToNull"/> 
<property name="User" value="root"/> 
<property name="Password" value=""/> 
</jdbc-connection-pool> 
</resources> 

感謝您的幫助,請我需要得到認證形式這樣的工作,我寧願它programmically,但我手束在此刻。

歡呼

+0

因此,我縮小到由於某種原因而不起作用,用戶名和密碼正在驗證,但是它將引發HTTP 403並且在重定向到login.xhtml頁面之前不加載請求的頁面。我從中得到的結果是,的作用與類似,它允許任何人進入請求的頁面。接近我想。 – codeMonkey 2014-11-05 18:00:00

回答

0

看來這是問題

<?xml version="1.0" encoding="UTF-8"?> 
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd"> 
<glassfish-web-app error-url=""> 
    <class-loader delegate="true"/> 
    <jsp-config> 
     <property name="keepgenerated" value="true"> 
      <description>Keep a copy of the generated servlet class' java code.</description> 
     </property> 
     <security-role-mapping> 
      <role-name>ADMIN</role-name> 
      <group-name>ADMIN</group-name> 
     </security-role-mapping> 
     <security-role-mapping> 
      <role-name>USER</role-name> 
      <group-name>USER</group-name> 
     </security-role-mapping> 
    </jsp-config> 
</glassfish-web-app> 

應該是這樣

<?xml version="1.0" encoding="UTF-8"?> 
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd"> 
<glassfish-web-app error-url=""> 
    <class-loader delegate="true"/> 
    <jsp-config> 
     <property name="keepgenerated" value="true"> 
      <description>Keep a copy of the generated servlet class' java code.</description> 
     </property> 
    </jsp-config> 
    <security-role-mapping> 
     <role-name>ADMIN</role-name> 
     <group-name>ADMIN</group-name> 
    </security-role-mapping> 
    <security-role-mapping> 
     <role-name>USER</role-name> 
     <group-name>USER</group-name> 
    </security-role-mapping> 
</glassfish-web-app> 

我有嵌套在這樣該應用程序基本沒有角色,導致HTTP 403錯誤。

我希望這可以幫助別人在將來遇到類似的問題。

+0

我有同樣的問題什麼是您爲表中的用戶,密碼信息所做的數據輸入。 – Bikram 2016-11-26 07:26:29

0

從您發佈的東西,看起來像你的jdbcRealm一個問題。你應該確保你的表格配置合理。參考答案在這個崗位既解決了領域驗證設置表GlassFish JDBC Realm Group Membership

+0

對不起,我應該發佈表的SQL。我確信他們配置正確,因爲我正在使用一個視圖來訪問包含user_id group_id和group_name的表,但我會研究它並獲取發佈SQL – codeMonkey 2014-11-05 11:38:00

+0

是的,你應該發佈它。可能會進一步幫助 – ollaollu 2014-11-05 17:55:38

0

請參閱JIRA的GLASSFISH-18901門票。我也有這個問題,並能夠糾正失敗的代碼(掃描安全規則的結果無效)。隨後重定向到目標頁面也失敗,這是上述票據的重點。

我應該注意到上面的票據是針對版本3.1.2的,並且針對該問題的修復最初針對版本4.0.1(它不會出現的版本將會被釋放)。

票現在被標記爲「將來的版本」,這可能意味着它不會很快被修復。

我寫的糾正認證過程的補丁可能不適用於4.1代碼庫,因爲我相信他們重寫了整個過程(將bug留在原地)。