堆棧內存溢出
  簡體   English   中英

Apache Shiro無狀態 - 無會話JWT令牌認證問題

[英]Apache Shiro Stateless - Sessionless JWT Token Authentication Problem

 原文  2019-06-07 14:41:53  7   1    java/ jwt/ token/ shiro/ stateless

問題描述

我正在使用Java Restful Jersey和Apache Shiro實現一個在線平台，用於身份驗證授權。 我的安全實現基於使用Apache Shiro的文章JSON Web Token 。 以下是我的shiro.ini並實現了Classes。

shiro.ini 

[main]
jwtg = gr.histopath.platform.lib.JWTGuard
jwtv =  gr.histopath.platform.lib.JWTVerifyingFilter

ds = com.mysql.cj.jdbc.MysqlDataSource
ds.serverName = 127.0.0.1
ds.port = 3306
ds.user = histopathUser
ds.password = H1s+0p@+h.U$er
ds.databaseName = histopath

jdbcRealm = gr.histopath.platform.lib.MyRealm
jdbcRealm.dataSource = $ds


credentialsMatcher = org.apache.shiro.authc.credential.Sha512CredentialsMatcher
credentialsMatcher.hashIterations = 50000
credentialsMatcher.hashSalted = true
credentialsMatcher.storedCredentialsHexEncoded = false
jdbcRealm.credentialsMatcher = $credentialsMatcher

jdbcRealm.permissionsLookupEnabled = false

shiro.loginUrl = /authentication/login

#cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
cacheManager = org.apache.shiro.cache.ehcache.EhCacheManager
securityManager.cacheManager = $cacheManager

sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 172800000

# ssl.enabled = false

securityManager.realms = $jdbcRealm

[users]

[roles]

[urls]

/authentication/login = authc
# /authentication/logout = logout

/search/* = noSessionCreation, jwtv
/statistics/* = noSessionCreation, jwtv
/clinics/* = noSessionCreation, jwtv
/patients/* = noSessionCreation, jwtv
/incidents/* = noSessionCreation, jwtv
/doctors/* = noSessionCreation, jwtv

/users/new = noSessionCreation, anon
/users/details/* = noSessionCreation, anon
/users/* = noSessionCreation, jwtv

/* = anon

MyRealm.java 

package gr.histopath.platform.lib;

import gr.histopath.platform.model.DAO.UserDAO;
import gr.histopath.platform.model.TransferObjects.User;
import org.apache.shiro.authc.*;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.util.ByteSource;

    public class  MyRealm extends JdbcRealm {

        private UserDAO userDAO;
        private User user;
        private String password;
        private ByteSource salt;


        public MyRealm() {
            this.userDAO = new UserDAO();
            setSaltStyle(SaltStyle.COLUMN);
        }

        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            // identify account to log to
            UsernamePasswordToken userPassToken = (UsernamePasswordToken) token;
            String username = userPassToken.getUsername();

            System.out.println("GMOTO: " + userPassToken.getUsername());

            if (username.equals(null)) {
                System.out.println("Username is null.");
                return null;
            }

            // read password hash and salt from db
    //        System.out.println("Username: " + username);

            if(!userDAO.isOpen()){
                userDAO = new UserDAO();
            }

            this.user = userDAO.getByUsername(username);
            this.userDAO.closeEntityManager();
            System.out.println("user's email: " + this.user.getUsername());

            if (this.user == null) {
                System.out.println("No account found for user [" + username + "]");
                return null;
            }
            this.password = this.user.getPassword();
            this.salt = ByteSource.Util.bytes(Base64.decode(this.user.getSalt()));

            SaltedAuthenticationInfo info = new SimpleAuthenticationInfo(user, password, salt, getName());

            return info;
        }

    }

我的JWT驗證過濾器： 

package gr.histopath.platform.lib;

import gr.histopath.platform.model.TransferObjects.User;
import io.jsonwebtoken.*;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.AccessControlFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.xml.bind.DatatypeConverter;

public class JWTVerifyingFilter extends AccessControlFilter {

    private static final Logger logger = LoggerFactory.getLogger(JWTVerifyingFilter.class);

    @Override
    protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) {
        logger.debug("Verifying Filter Execution");

        HttpServletRequest httpRequest = (HttpServletRequest) servletRequest;
        String jwt = httpRequest.getHeader("Authorization");
        logger.debug("JWT Found");

        if (jwt == null || !jwt.startsWith("Bearer ")) {
//            System.out.println("DEn  Brika Tipota: ");
            logger.debug("No Token Found...");
//            servletResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        }

        jwt = jwt.substring(jwt.indexOf(" "));
        Subject subject = SecurityUtils.getSubject();

//        System.out.println("Token Found");
//        System.out.println("JWT: " + jwt);
//        System.out.println("Authenticated? " + subject.isAuthenticated());
//        System.out.println(" session " + subject.getSession().getId());
//        System.out.println(" salt " + ((User) subject.getPrincipal()).getSalt());
//        System.out.println(" who-is " + ((User) subject.getPrincipal()).getUsername());

        User user = null;
        if (subject.isAuthenticated()) {

            user = (User) subject.getPrincipal();
            String username = null;


            try {
                Jws<Claims> claimsJws = Jwts.parser()
                        .setSigningKey(DatatypeConverter.parseBase64Binary(user.getSalt()))
                        .parseClaimsJws(jwt);

//                System.out.println("Claims: " + claimsJws);
                logger.debug("Expiration: " + claimsJws.getBody().getExpiration());
                username = Jwts.parser().setSigningKey(DatatypeConverter.parseBase64Binary(user.getSalt()))
                        .parseClaimsJws(jwt).getBody().getSubject();
            } catch (ExpiredJwtException expiredException) {
                logger.debug("Token Is Expired....");
                logger.debug(expiredException.getMessage(), expiredException);
//                System.out.println("Token IS Expired.....");
//                expiredException.printStackTrace();
                logger.debug("Logging out the user...");
//                System.out.println("Logging out the user...");
                SecurityUtils.getSubject().logout();
//                System.out.println("mmmnnnnn: " + SecurityUtils.getSubject().isAuthenticated());
                return false;
//                throw expiredException;
            } catch (SignatureException signatureException) {
                logger.debug(signatureException.getMessage(), signatureException);
//                signatureException.printStackTrace();
                return false;
            } catch (Exception e) {
                logger.debug(e.getMessage(), e);
//                e.printStackTrace();
                return false;
            }
//            System.out.println("Subject: " + user.getUsername());

            return username.equals(user.getUsername());

        }
//        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        return false;
    }

    @Override
    protected boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        return false;
    }
}

和JWT衛隊 

package gr.histopath.platform.lib;

import org.apache.shiro.web.filter.authc.AuthenticationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;

public class JWTGuard extends AuthenticationFilter {
    @Override
    protected boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) throws Exception {
//        System.out.println("JWT GUARD FIRED!!!!!");
        HttpServletResponse httpResponse = (HttpServletResponse) servletResponse;
        httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return false;
    }
}

一切都工作得很好，除了隨機/偶爾，盡管用戶已登錄，會話超時發生，系統注銷了用戶，盡管事實上，令牌有7天的有效期。

所以我決定嘗試讓系統無狀態，沒有任何會話。 為此我使用了命令： 

securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false

根據禁用主題狀態會話存儲

但是，現在我根本無法登錄。 我明白了 

java.lang.NullPointerException  at gr.histopath.platform.lib.MyRealm.doGetAuthenticationInfo(MyRealm.java:31)

即String username = userPassToken.getUsername（）; //這是null

現在我的shiri.ini看起來如下：

改變了shiro.ini 

[main]
jwtg = gr.histopath.platform.lib.JWTGuard
jwtv =  gr.histopath.platform.lib.JWTVerifyingFilter

ds = com.mysql.cj.jdbc.MysqlDataSource
ds.serverName = 127.0.0.1
ds.port = 3306
ds.user = histopathUser
ds.password = H1s+0p@+h.U$er
ds.databaseName = histopath

jdbcRealm = gr.histopath.platform.lib.MyRealm
jdbcRealm.dataSource = $ds


credentialsMatcher = org.apache.shiro.authc.credential.Sha512CredentialsMatcher
credentialsMatcher.hashIterations = 50000
credentialsMatcher.hashSalted = true
credentialsMatcher.storedCredentialsHexEncoded = false
jdbcRealm.credentialsMatcher = $credentialsMatcher

jdbcRealm.permissionsLookupEnabled = false

shiro.loginUrl = /authentication/login

#cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
cacheManager = org.apache.shiro.cache.ehcache.EhCacheManager
securityManager.cacheManager = $cacheManager

#sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
#securityManager.sessionManager = $sessionManager
#securityManager.sessionManager.globalSessionTimeout = 172800000

securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false

# ssl.enabled = false

securityManager.realms = $jdbcRealm

[users]

[roles]

[urls]

/authentication/login = authc
# /authentication/logout = logout

/search/* = noSessionCreation, jwtv
/statistics/* = noSessionCreation, jwtv
/clinics/* = noSessionCreation, jwtv
/patients/* = noSessionCreation, jwtv
/incidents/* = noSessionCreation, jwtv
/doctors/* = noSessionCreation, jwtv

/users/new = noSessionCreation, anon
/users/details/* = noSessionCreation, anon
/users/* = noSessionCreation, jwtv

/* = anon

我沒有找到任何完整的會話少shiro的例子。 我的代碼的任何建議，使其工作？ 我一定錯過了什么，但我不知道是什么。

  • 禁用會話后為什么MyRealm無法從UsernamePasswordToken讀取用戶名？
  • 為什么在我的第一次實現中偶爾會發生會話超時。 有什么想法？

1 個解決方案

解決方案1
 0  2019-06-07 20:06:10

你試過noSessionCreation嗎？

您是否正在請求會話的任何代碼（或調用任何代碼）？

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 在 apache shiro 中獲取令牌提交的異常身份驗證失敗 Apache Shiro +身份驗證問題 Apache shiro + kerberos身份驗證 Apache Shiro的身份驗證問題 Apache Shiro LDAP 配置（兩步驗證） 使用Java和Apache HttpClient進行Apache Shiro authcBasic身份驗證 使用 Spring 和 JWT 基於令牌的身份驗證 Shiro，提交令牌的身份驗證失敗 2021-01-08（更新） 如何使用Apache Shiro和LDAP身份驗證添加角色授權 用於基本身份驗證的Apache Shiro憑據匹配始終失敗
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM