JSP和OAUTH2身份验证

Question

I hope this is not a "too open" question but I am really not sure of how to handle it. 我希望这不是一个“太开放”的问题，但我真的不确定如何处理。

I have a working web application written in Java JSPs and some Rest interfaces with Jersey, running on Tomcat 7 and a MySQL DB. 我有一个用Java JSP编写的工作Web应用程序，并且与Jersey的Rest接口相连，并在Tomcat 7和MySQL DB上运行。 It is a quite simple, form based application. 这是一个非常简单的基于表单的应用程序。 Currently I have it runnign on AWS. 目前，我在AWS上运行它。

The JSPs are something like this: JSP是这样的：

<%
String inmsg = request.getParameter("msg");
 %>
<html>
<head>
...

And the Rest classes like this: 其余的类是这样的：

@Path("/operation")
public class IntrfcOperation {

String response="";
int retcode=0;
String id;
String name;

@GET
@Produces(MediaType.APPLICATION_JSON)
public Response baserest(
          @Context HttpServletRequest hsreq,
          @Context HttpServletResponse hsresp)
  {
        response ="";
        ...
        String outjson = "{\"retcode\":\"" + retcode + "\",\"name\":\"" + name + "\",\"msg\":\"" + response + "\"}";
        return Response.status(200).entity(outjson).build();
  }

I want to incorporate an authentication layer and I am thinking of using an OpenID/Oauth2 server, probably the AWS one (IAM?). 我想合并一个身份验证层，并且正在考虑使用OpenID / Oauth2服务器，可能是AWS服务器（IAM？）。 The problem I see is that this protocol (as far as I have tried it) requires a single/unique redirect url, being this the return point for every request sent to the Identity Manager. 我看到的问题是，该协议（就我所尝试的而言）需要一个/唯一的重定向URL，这是发送到Identity Manager的每个请求的返回点。 My problem is that I don't have a single URL but a bunch of them, one per JSP and Rest entry point. 我的问题是我没有一个URL，而是一堆URL，每个JSP和Rest入口点都有一个URL。

What should be the correct approach to transform this? 改变这种状况的正确方法应该是什么？ The only way I see (and don't see it as an option at moment) is to rewrite the whole application to be a single JSP script where all the different actions and pages are identified as parameters of the single entry point. 我看到的唯一方法（并且暂时不将其视为一种选择）是将整个应用程序重写为单个JSP脚本，其中所有不同的动作和页面都被标识为单个入口点的参数。 Is there another simpler way? 还有另一种更简单的方法吗？

Answer 1

OAuth2 requires you to have a URI which will accept redirects from the authentication server. OAuth2要求您具有一个URI，它将接受来自身份验证服务器的重定向。 Just one URI for the whole application. 整个应用程序只有一个URI。 The code handling this URI should get values from URL parameters, save the tokens (or get them from the /token endpoint) and redirect to an application page you already have. 处理此URI的代码应从URL参数获取值，保存令牌（或从/token端点获取），然后重定向到您已有的应用程序页面。

So there is no need for rewriting your application. 因此，无需重写您的应用程序。 For example, if you have a login page and an initial dashboard for authenticated users, the flow will be like this: 例如，如果您具有登录页面和用于身份验证用户的初始仪表板，则流程将如下所示：

User gets to the login page and clicks "Authenticate by OAuth2" 用户进入登录页面，然后单击“通过OAuth2进行身份验证”
User gets redirected to OAuth2 authentication server 用户被重定向到OAuth2身份验证服务器
User passes the authentication and gets redirected to your new authentication handling URI with the results of the authentication 用户通过身份验证，并通过身份验证结果重定向到新的身份验证处理URI
Your application saves the results, considers the user authenticated and redirects him to the initial dashboard page. 您的应用程序将保存结果，认为用户已通过身份验证并将其重定向到初始仪表板页面。

You need to decide what kind of OAuth2 flow you want to use, where to store the tokens and which part of your application will have the OAuth2 client role (the Java backend or the HTML/JavaScript frontend). 您需要确定要使用哪种OAuth2流，在哪里存储令牌以及应用程序的哪一部分将具有OAuth2客户端角色（Java后端或HTML / JavaScript前端）。 If you need just authentication (getting users identity), you probably need just an ID token (from the OpenID Connect extension). 如果只需要身份验证（获取用户身份），则可能只需要一个ID令牌（来自OpenID Connect扩展名）。

For more info, you can read the well written OAuth2 RFC or some articles/tutorials than can give you a simplified view at the topic. 有关更多信息，您可以阅读编写良好的OAuth2 RFC或一些文章/教程，而不是为该主题提供简化的视图。

Edit: After successful authentication, if you want to get back to the originally requested page, include the requested URL in the state param of the authentication request. 编辑：认证成功后，如果要返回到最初请求的页面，请将请求的URL包括在认证请求的state参数中。 Your new authentication handler will get the state value unchanged (again as a state URL parameter) and you can redirect the user to that URL, instead of a hard-coded one (the dashboard). 新的身份验证处理程序将保持state值不变（再次作为state URL参数），并且您可以将用户重定向到该URL，而不是硬编码的用户（仪表板）。 Note that the state value should also contain a value used for preventing cross-site request forgery as described in the OAuth2 RFC. 请注意， state值还应包含一个用于防止跨站点请求伪造的值，如OAuth2 RFC中所述。

JSP和OAUTH2身份验证

问题描述

1 个解决方案

解决方案1
1 已采纳 2017-08-04 08:34:11

JSP和OAUTH2身份验证

问题描述

1 个解决方案

解决方案1 1 已采纳 2017-08-04 08:34:11

解决方案1
1 已采纳 2017-08-04 08:34:11