Jetty配置jaas访问权限以及密码
jaas简介
- Jaas定义:JavaAuthentication Authorization Service(JAAS,Java验证和授权API)提供了灵活和可伸缩的机制来保证客户端或服务器端的Java程序。简单来说就用户对某程序的访问权限控制。
- 简单来说,就是通过jaas,可以对我们的java应用进行登录验证,而无需编写登录拦截等。
需要修改或添加的文件
- web.xml (web项目的配置文件)
- jetty.xml (jetty运行配置文件)
- realm.properties (账号密码)
web.xml
代码块语法遵循标准markdown代码,例如:
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
<display-name>jspJetty</display-name>
<security-constraint>
<web-resource-collection>
<web-resource-name>Web Test Actions</web-resource-name>
<url-pattern>/*</url-pattern>
<!--<url-pattern>*.jsp</url-pattern> -->
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<!-- javaEE规范,可设置自定制页面 -->
<!-- <auth-method>FORM</auth-method> -->
<auth-method>BASIC</auth-method>
<realm-name>java:/jaas/jvwl-sso</realm-name>
<!-- <form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login.jsp</form-error-page>
</form-login-config> -->
</login-config>
<security-role>
<role-name>admin</role-name>
</security-role>
</web-app>
jetty.xml
添加以下内容
<Call name="addBean">
<Arg>
<New class="org.eclipse.jetty.security.HashLoginService">
<Set name="name">java:/jaas/jvwl-sso</Set>
<Set name="config"><Property name="jetty.home" default="."/>/doc/jetty/etc/realm.properties</Set>
<Set name="refreshInterval">5</Set>
</New>
</Arg>
</Call>
realm.properties
realm.properties须添加一下内容
#realm账号形式:# <username>: <password>[,<rolename> ...]
# The format is
# <username>: <password>[,<rolename> ...]
#
# Passwords may be clear text, obfuscated or checksummed. The class
# org.eclipse.util.Password should be used to generate obfuscated
# passwords or password checksums
#
# If DIGEST Authentication is used, the password must be in a recoverable
# format, either plain text or OBF:.
user: plain,admin
user: password,user
使用之后的效果:
以为这里的auth-method为BASIC所以为这里的定义界面,若为FORM属性则可以自定义界面
注意:
realm.propertie中,用户的权限参数须与web.xml保持一致,否则用户将无法登录
PS:web.xml中的
web.xml
login-config中的auth-method属性有以下几种
<auth-method>BASIC</auth-method>
BASIC:HTTP规范,Base64
<web-app>
......
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
......
</web-app>
DIGEST:HTTP规范,数据完整性强一些,但不是SSL
<web-app>
......
<login-config>
<auth-method>DIGEST</auth-method>
</login-config>
......
</web-app>
CLIENT-CERT:J2EE规范,数据完整性很强,公共钥匙(PKC)
<web-app>
......
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>
......
</web-app>
FORM:J2EE规范,可以自定义界面
<web-app>
......
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.html</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
......
</web-app>