是否基於JSF的支持形式的擔保

Question

我跟着這個教程 security在本教程中提到，基於表單的安全

<form action="j_security_check" method=post> 
    <p>username: <input type="text" name="j_username"></p> 
    <p>password: <input type="password" name="j_password"></p> 
    <p><input type="submit" value="submit"></p> 
</form> 

但是在JSF的形式我在H無動作attributr添加如下內容：形式，我設置爲j_security_check。還需要使用j_username和j_password才能在JSF中使用基於表單的安全性？

感謝

Answer 1

是的，這個動作URL和字段的名稱是強制性的form based authentication。這是在servlet規範中指定的。您可以直接在JSF頁面中使用它。唯一的區別是表單提交和身份驗證完全由容器處理，而不是由JSF處理。你不需要擔心這一點。如果你希望對錶單提交過程更細化的控制，或者想要利用JSF內置驗證和ajax權力等等，那麼你總是可以在JSF託管bean中接管programmatic authentication。爲此，您必須在操作方法中使用HttpServletRequest#login()。身份驗證仍由容器處理。

E.g.

<h:form> 
    <h:inputText value="#{login.username}" required="true" /> 
    <h:inputSecret value="#{login.password}" required="true" /> 
    <h:commandButton value="login" action="#{login.submit}"> 
     <f:ajax execute="@form" render="@form" /> 
    </h:commandButton> 
    <h:messages /> 
</h:form> 

與

public String submit() { 
    FacesContext context = FacesContext.getCurrentInstance(); 
    HttpServletRequest request = (HttpServletRequest) context.getExternalContext().getRequest(); 

    try { 
     request.login(username, password); 
     return "home?faces-redirect-true"; 
    } catch (ServletException e) { 
     context.addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR, "Unknown login", null)); 
     return null; 
    } 
} 

Answer 2

這裏是我是如何實現j_security_check（容器管理的安全性）在WebSphere 7上運行我的JSF應用程序不幸的是，我使用Servlet API的版本沒有

request.login() 

登錄過濾器類被創建用於攔截j_security_check調用。 ResponseWrapper記住登錄後要重定向的URL。

public class LoginFilter implements Filter { 
     private static String loginPage = "login.xhtml"; // read it from init config 
    public void doFilter(ServletRequest request, ServletResponse response, 
      FilterChain chain) throws IOException, ServletException { 
     // TODO Auto-generated method stub 
     // create wrapper 
     HttpServletRequest req = (HttpServletRequest) request; 
     MyWrapper myRes = new MyWrapper((HttpServletResponse) response); 
     // call authentication 
     chain.doFilter(request, myRes); 
     // check for login error 
       String redirectURL = myRes.getOriginalRedirect(); 
      if (StringUtils.isBlank(redirectURL) || redirectURL.contains(loginPage)) { 
        myRes.setOriginalRedirect(homePage); 
       } 
    myRes.sendMyRedirect(); 

} 
    class MyWrapper extends HttpServletResponseWrapper { 
     String originalRedirect; 

     public MyWrapper(HttpServletResponse response) { 
      super(response); 
     } 

     @Override 
     public void sendRedirect(String location) throws IOException { 
      // just store location, don’t send redirect to avoid 
      // committing response 
      originalRedirect = location; 
     } 

     // use this method to send redirect after modifying response 
     public void sendMyRedirect() throws IOException { 
      super.sendRedirect(originalRedirect); 
     } 

     public String getOriginalRedirect() { 
      return originalRedirect; 
     } 

     public void setOriginalRedirect(String originalRedirect) { 
      this.originalRedirect = originalRedirect; 
     } 


    } 

web.xml如下所示。

<filter> 
    <filter-name>LoginFilter</filter-name> 
    <filter-class>com.servlet.filter.LoginFilter</filter-class> 
</filter> 

<filter-mapping> 
    <filter-name>LoginFilter</filter-name> 
    <url-pattern>/j_security_check</url-pattern> 
</filter-mapping> 
<filter> 
    <filter-name>RequestJSFFilter</filter-name 
     <filter-class>com.servlet.filter.RequestJSFFilter</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>RequestJSFFilter</filter-name> 
    <url-pattern>*.xhtml</url-pattern> 
</filter-mapping> 

另一個攔截所有* .xhtml並指向login.xhtml的過濾器。在login.xhtml中，表單可以如下所示

<form action="j_security_check" method=post> 
    <p>username: <input type="text" name="j_username"></p> 
    <p>password: <input type="password" name="j_password"></p> 
    <p><input type="submit" value="submit"></p> 
</form> 

希望這有助於。