如何使用DatabaseCertificate登錄模塊

Question

我想使用DatabaseCertificate登錄模塊從數據庫加載組。

當前配置：

> <security-domain name="LDAPAuth">
>       <authentication>
>           <login-module code="LdapExtended" flag="required">
>               <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
>               <module-option name="java.naming.provider.url" value="***************"/>
>               <module-option name="java.naming.security.authentication" value="simple"/>
>               <module-option name="bindDN" value="*************"/>
>               <module-option name="bindCredential" value="*********"/>
>               <module-option name="baseCtxDN" value="**************"/>
>               <module-option name="baseFilter" value="(samAccountName={0})"/>
>               <module-option name="rolesCtxDN" value="********************"/>
>               <module-option name="roleFilter" value="(member={1})"/>
>               <module-option name="roleAttributeID" value="cn"/>
>               <module-option name="searchScope" value="ONELEVEL_SCOPE"/>
>               <module-option name="allowEmptyPasswords" value="true"/>
>               <module-option name="roleRecursion" value="1"/>
>           </login-module>
>           <login-module code="DatabaseCertificate" flag="sufficient">
>               <module-option name="dsJndiName" value="java:jboss/jdbc/mmDS"/>
>               <module-option name="rolesQuery" value="select Roles from users where username=?"/>
>           </login-module>
>       </authentication>
>     </security-domain>

日志：

2015-05-19 08:27:13,275 TRACE [org.jboss.security] (default task-2) PBOX000200: Begin isValid, principal:   org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@dca033e0, cache entry: null
2015-05-19 08:27:13,276 TRACE [org.jboss.security] (default task-2) PBOX000209: defaultLogin, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@dca033e0
2015-05-19 08:27:13,278 TRACE [org.jboss.security] (default task-2) PBOX000221: Begin getAppConfigurationEntry(LDAPAuth), size: 4
2015-05-19 08:27:13,282 TRACE [org.jboss.security] (default task-2) PBOX000224: End getAppConfigurationEntry(LDAPAuth), AuthInfo: AppConfigurationEntry[]:
[0]
LoginModule Class: org.jboss.security.auth.spi.LdapExtLoginModule
ControlFlag: LoginModuleControlFlag: required
Options:
name=searchScope, value=ONELEVEL_SCOPE
name=java.naming.factory.initial, value=com.sun.jndi.ldap.LdapCtxFactory
name=java.naming.provider.url, value=****************
name=rolesCtxDN, value=************************
name=roleFilter, value=(member={1})
name=roleAttributeID, value=cn
name=java.naming.security.authentication, value=simple
name=roleRecursion, value=1
name=bindDN, value=*****************************
name=bindCredential, value=****
name=baseCtxDN, value=*****************************
name=allowEmptyPasswords, value=true
name=baseFilter, value=(samAccountName={0})
[1]
LoginModule Class: org.jboss.security.auth.spi.DatabaseCertLoginModule
ControlFlag: LoginModuleControlFlag: sufficient
Options:
name=dsJndiName, value=java:jboss/jdbc/mmDS
name=rolesQuery, value=select Roles from users where username=?

2015-05-19 08:27:13,288 TRACE [org.jboss.security] (default task-2) PBOX000236: Begin initialize method
2015-05-19 08:27:13,289 TRACE [org.jboss.security] (default task-2) PBOX000240: Begin login method
2015-05-19 08:27:13,297 TRACE [org.jboss.security] (default task-2) PBOX000220: Logging into LDAP server with env {java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, searchScope=ONELEVEL_SCOPE, ...........
2015-05-19 08:27:13,452 TRACE [org.jboss.security] (default task-2) PBOX000220: Logging into LDAP server with env {java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, searchScope=ONELEVEL_SCOPE, ...........
2015-05-19 08:27:14,081 TRACE [org.jboss.security] (default task-2) PBOX000268: Assigning user to role **LDAPRole**
2015-05-19 08:27:14,125 TRACE [org.jboss.security] (default task-2) PBOX000241: End login method, isValid: true
2015-05-19 08:27:14,127 TRACE [org.jboss.security] (default task-2) PBOX000236: Begin initialize method
2015-05-19 08:27:14,135 ERROR [org.jboss.security] (default task-2) PBOX000246: The JSSE security domain other is not valid. All authentication using this login module will fail!
2015-05-19 08:27:14,136 TRACE [org.jboss.security] (default task-2) PBOX000239: End initialize method
2015-05-19 08:27:14,136 TRACE [org.jboss.security] (default task-2) PBOX000262: Module options [dsJndiName: java:jboss/jdbc/mmDS, principalsQuery: , rolesQuery: select Roles from users where username=?, suspendResume: true]
2015-05-19 08:27:14,136 TRACE [org.jboss.security] (default task-2) PBOX000240: Begin login method
2015-05-19 08:27:14,136 TRACE [org.jboss.security] (default task-2) PBOX000240: Begin login method
2015-05-19 08:27:14,136 TRACE [org.jboss.security] (default task-2) PBOX000252: Begin getAliasAndCert method
2015-05-19 08:27:14,138 TRACE [org.jboss.security] (default task-2) PBOX000242: Begin commit method, overall result: true
2015-05-19 08:27:14,140 TRACE [org.jboss.security] (default task-2) PBOX000242: Begin commit method, overall result: false
2015-05-19 08:27:14,140 TRACE [org.jboss.security] (default task-2) PBOX000210: defaultLogin, login context: javax.security.auth.login.LoginContext@57a0ce24, subject: Subject(33333333333).principals=org.jboss.security.SimplePrincipal@1734384605(user)org.jboss.security.SimpleGroup@1167694681(Roles(members:**LDAPRole**))org.jboss.security.SimpleGroup@1167694681(CallerPrincipal(members:user))
2015-05-19 08:27:14,142 TRACE [org.jboss.security] (default task-2) PBOX000201: End isValid, result = true
2015-05-19 08:27:14,151 TRACE [org.jboss.security] (default task-2) PBOX000354: Setting security roles ThreadLocal: null

如您所見，LDAP登錄模塊有效。 我沒有從DatabaseCertificate看到任何錯誤，但是沒有覆蓋/添加組。 你能幫我嗎？ 我不知道該怎么辦。

Answer 1

我在這里看到2個問題。

1. 如果只想使用數據庫來加載角色，則在兩個登錄模塊中都使用密碼堆棧 。 它對后續的登錄模塊說不檢查憑據，而僅加載角色。

2. DatabaseCertificate登錄模塊應與SSL / TLS和CLIENT-CERT身份驗證一起使用，如果我理解正確的話，這不是您的情況。

   只需使用簡單的數據庫登錄模塊即可 。

您的配置如下所示：

<security-domain name="LDAPAuth">
  <authentication>
    <login-module code="LdapExtended" flag="required">
      <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory" />
      <module-option name="java.naming.provider.url" value="***************" />
      <module-option name="java.naming.security.authentication" value="simple" />
      <module-option name="bindDN" value="*************" />
      <module-option name="bindCredential" value="*********" />
      <module-option name="baseCtxDN" value="**************" />
      <module-option name="baseFilter" value="(samAccountName={0})" />
      <module-option name="rolesCtxDN" value="********************" />
      <module-option name="roleFilter" value="(member={1})" />
      <module-option name="roleAttributeID" value="cn" />
      <module-option name="searchScope" value="ONELEVEL_SCOPE" />
      <module-option name="allowEmptyPasswords" value="true" />
      <module-option name="roleRecursion" value="1" />
      <module-option name="password-stacking" value="useFirstPass" />
    </login-module>
    <login-module code="Database" flag="required">
      <module-option name="password-stacking" value="useFirstPass" />
      <module-option name="dsJndiName" value="java:jboss/datasources/mmDS" />
      <module-option name="rolesQuery" value="select Roles, 'Roles' from users where username=?"/>
    </login-module>
  </authentication>
</security-domain>