[英]JAAS configuration and LDAP login module in JavaEE 6
I'm writing a question here because I haven't been able to find the solution myself for months. 我在这里写了一个问题因为我自己几个月都找不到解决方案了。 My situation: I have a client-server application written on java which uses Java2ee 6 and EJB3.0.
我的情况:我有一个用java编写的客户端服务器应用程序,它使用Java2ee 6和EJB3.0。 The server side is deployed on the glassfish 3.0.
服务器端部署在glassfish 3.0上。 I need to develop/implement the login module for application.
我需要为应用程序开发/实现登录模块。 Authentification must be done using ldap server and authorisation will be handled inside application.
必须使用ldap服务器进行身份验证,并在应用程序内部处理授权。 Therefore I want to hire JAAS technology to mix authentification and authorisation.
因此,我想聘请JAAS技术来进行身份验证和授权。 I'm doing it for example like here .
我这样做是为了例如像在这里 。 Then I follow this tutorial and official documentation to perform login.
然后我按照本教程和官方文档进行登录。 My problem is that ldap login doesn't work.
我的问题是ldap登录不起作用。
My code: 我的代码:
LoginContext lc = null;
try {
CallbackHandler handler = new CallbackHandler() {
public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
for( int i = 0; i < callbacks.length; i++ ) {
if( callbacks[i] instanceof NameCallback ) {
// prompt the user for a username
NameCallback nc = (NameCallback)callbacks[i];
nc.setName("admin");
System.out.println("Login done.");
} else if( callbacks[i] instanceof PasswordCallback ) {
// prompt the user for sensitive information
PasswordCallback pc = (PasswordCallback)callbacks[i];
pc.setPassword("mypassword".toCharArray());
System.out.println("Password done.");
} else {
throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback");
} //end if/else
} //end for()
}
};
lc = new LoginContext("myAuth", handler);
lc.login();
Subject subject = lc.getSubject();
} catch (LoginException e) {
e.printStackTrace();
}
My JAAS configuration file: 我的JAAS配置文件:
myAuth {
com.sun.enterprise.security.auth.login.LDAPLoginModule REQUIRED
userProvider="ldap://mydomain:389/OU=users,DC=my,DC=domain,DC=com"
authIdentity="{USERNAME}"
useSSL=false
debug=true;
};
The client part of application is run with the following jvm options: 应用程序的客户端部分使用以下jvm选项运行:
-Djava.security.auth.login.config=./jaas.conf -Dorg.omg.CORBA.ORBInitialHost=localhost
On the glassfish site I set the jvm properties 在glassfish网站上我设置了jvm属性
-Djava.security.auth.login.config=${com.sun.aas.instanceRoot}/config/login.conf
-Djava.naming.referral=follow
The login.conf file on the glassfish side contains the following lines (ADRealm is the default realm of my glassfish) glassfish端的login.conf文件包含以下行(ADRealm是我的glassfish的默认域)
ADRealm {
com.sun.enterprise.security.auth.login.LDAPLoginModule REQUIRED;
};
Settings for ADRealm: ADRealm的设置:
<property name="jaas-context" value="ldapRealm" />
<property name="base-dn" value="CN=users,DC=my,DC=domain,DC=com" />
<property name="directory" value="ldap://mydomain:3268" />
<property name="search-bind-password" value="mypassword" />
<property name="search-bind-dn" value="admin@my.domain.com" />
I want to stress your attention that I'm trying to perform ldap login at least to be sure that it works. 我想强调你的注意力,我正在尝试执行ldap登录,至少确保它有效。
When I run the client I get the following error: 当我运行客户端时,我收到以下错误:
Mar 1, 2013 1:36:44 PM com.sun.appserv.security.AppservPasswordLoginModule extractCredentials
SEVERE: passwordlm.nopwdcred
javax.security.auth.login.LoginException: No credentials.
What is strange that is worked once(!), ie I could obtain subject
from lc.getSubject()
method. 什么是奇怪的一次(!),即我可以从
lc.getSubject()
方法获得subject
。 Also I assume that handle()
method above is not invoked since I don't see 另外我假设上面的
handle()
方法没有被调用,因为我没有看到
Login done.
Password done.
in the output. 在输出中。
Please could anybody help me??? 请有人帮帮我吗???
1st - On LDAP you don't use an admin user, but create another user with necessary criteria to search and/or bind if necessary. 1st - 在LDAP上,您不使用管理员用户,而是创建另一个具有必要条件的用户,以便在必要时进行搜索和/或绑定。 An admin user isn't secure and not recommended, especially in a Java EE context.
管理员用户不安全,不推荐使用,尤其是在Java EE环境中。
2nd - What kind of LDAP server do you try to connect to? 第二 - 您尝试连接哪种LDAP服务器? OpenLDAP or an Exchange server?
OpenLDAP还是Exchange服务器?
I'm referring you to these links, while waiting for your response: 在等待您的回复时,我指的是这些链接:
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jaas/JAASLMDevGuide.html http://docs.oracle.com/javase/6/docs/technotes/guides/security/jaas/JAASLMDevGuide.html
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jaas/tutorials/GeneralAcnOnly.html http://docs.oracle.com/javase/6/docs/technotes/guides/security/jaas/tutorials/GeneralAcnOnly.html
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.