Java认证和授权服务 JAAS 之 认证

LoginModule

    它是认证服务器端的实现，用于验证客户端的信息，实现者实现 javax.security.auth.spi.LoginModule 接口的 login、commit、abort、logout 方法来完成用户的登录和登出操作，示例代码：

package jaas;

import javax.security.auth.Subject;
import javax.security.auth.callback.*;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
import java.security.Principal;
import java.util.Map;

public class MyLoginModule implements LoginModule {

    // username and password
    private String username;
    private char[] password;

    // the authentication status
    private boolean userPwdSucceeded = false;
    private boolean commitSucceeded = false;

    // user's Principal
    private Principal userPrincipal;


    // initial state
    private Subject subject;
    private CallbackHandler callbackHandler;


    /**
     * Initialize this <code>LoginModule</code>.
     */
    public void initialize(Subject subject,
                           CallbackHandler callbackHandler,
                           Map<java.lang.String, ?> sharedState,
                           Map<java.lang.String, ?> options) {

        this.subject = subject;
        this.callbackHandler = callbackHandler;
    }

    /**
     * Authenticate the user by prompting for a user name and password.
     */
    public boolean login() throws LoginException {
        // prompt for a user name and password
        if (callbackHandler == null)
            throw new LoginException("Error: no CallbackHandler available " +
                    "to garner authentication information from the user");

        Callback[] callbacks = new Callback[4];
        callbacks[0] = new NameCallback("user name");
        callbacks[1] = new PasswordCallback("password", false);
        callbacks[2] = new TextOutputCallback(TextOutputCallback.INFORMATION, "hello, just a msg!");
        callbacks[3] = new TextOutputCallback(TextOutputCallback.WARNING, "just warn you!");

        try {
            callbackHandler.handle(callbacks);
            NameCallback nameCallback = (NameCallback) callbacks[0];
            PasswordCallback passwordCallback = (PasswordCallback) callbacks[1];

            username = nameCallback.getName();

            char[] tmpPassword = passwordCallback.getPassword();
            passwordCallback.clearPassword();// clean password in memory space
            if (tmpPassword == null) {
                tmpPassword = new char[0];// treat a NULL password as an empty password
            }
            password = new char[tmpPassword.length];
            System.arraycopy(tmpPassword, 0, password, 0, tmpPassword.length);
        } catch (Exception e) {
            e.printStackTrace();
        }


        // verify the username/password
        boolean usernameCorrect = false;
        if (username.equals("user")) usernameCorrect = true;

        if (usernameCorrect &&
                password.length == 3 &&
                password[0] == 'p' &&
                password[1] == 'w' &&
                password[2] == 'd') {

            userPwdSucceeded = true;
        } else {
            userPwdSucceeded = false;
            cleanUserAndPwdData();
            if (!usernameCorrect) {
                throw new FailedLoginException("User Name Incorrect");
            } else {
                throw new FailedLoginException("Password Incorrect");
            }
        }
        return userPwdSucceeded;
    }

    public boolean commit() throws LoginException {
        if (!userPwdSucceeded) return false;

        // add a Principal (authenticated identity) to the Subject
        userPrincipal = new SamplePrincipal(username);
        subject.getPrincipals().add(userPrincipal);

        // in any case, clean out state
        cleanUserAndPwdData();

        return commitSucceeded = true;
    }

    public boolean abort() throws LoginException {
        if (!userPwdSucceeded) return false;

        if (commitSucceeded) {
            logout();
        } else {
            cleanState();
        }

        return true;
    }

    public boolean logout() throws LoginException {
        subject.getPrincipals().remove(userPrincipal);
        cleanState();
        userPwdSucceeded = commitSucceeded;
        return true;
    }

    private void cleanState() {
        userPwdSucceeded = false;
        cleanUserAndPwdData();
        userPrincipal = null;
    }

    private void cleanUserAndPwdData() {
        username = null;
        if (password != null) {
            for (int i = 0; i < password.length; i++)
                password[i] = ' ';
            password = null;
        }
    }
}

test_jaas.config 登录配置文件

/** 登录配置 **/
Sample {
   jaas.MyLoginModule required debug=true;
};

Principal 用户身份信息

示例代码：

package jaas;

import java.security.Principal;

public class SamplePrincipal implements Principal {
    private String name;

    public SamplePrincipal(String name) {
        this.name = name;
    }

    public String getName() {
        return name;
    }

    public boolean equals(Object o) {
        if (o == null)
            return false;

        if (this == o)
            return true;

        if (!(o instanceof SamplePrincipal))
            return false;
        SamplePrincipal that = (SamplePrincipal) o;

        if (this.getName().equals(that.getName()))
            return true;
        return false;
    }

    public int hashCode() {
        return name.hashCode();
    }
}

CallbackHandler 用户交互回调接口

用户代码通过该回调可传入用户名、密码 或其它信息 供 验证服务器使用，java 预置了多种回调实现：

 * @see javax.security.auth.callback.ChoiceCallback
 * @see javax.security.auth.callback.ConfirmationCallback
 * @see javax.security.auth.callback.LanguageCallback
 * @see javax.security.auth.callback.NameCallback
 * @see javax.security.auth.callback.PasswordCallback
 * @see javax.security.auth.callback.TextInputCallback
 * @see javax.security.auth.callback.TextOutputCallback

示例代码：

package jaas;

import javax.security.auth.callback.*;
import java.io.IOException;

public class MyCallbackHandler implements CallbackHandler {

    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

        for (int i = 0; i < callbacks.length; i++) {
            if (callbacks[i] instanceof TextOutputCallback) {// display the message according to the specified type
                TextOutputCallback toc = (TextOutputCallback) callbacks[i];
                switch (toc.getMessageType()) {
                    case TextOutputCallback.INFORMATION:
                        System.out.println(toc.getMessage());
                        break;
                    case TextOutputCallback.ERROR:
                        System.err.println("ERROR: " + toc.getMessage());
                        break;
                    case TextOutputCallback.WARNING:
                        System.err.println("WARNING: " + toc.getMessage());
                        break;
                    default:
                        throw new IOException("Unsupported message type: " + toc.getMessageType());
                }

            } else if (callbacks[i] instanceof NameCallback) {// prompt the user for a username
                NameCallback nc = (NameCallback) callbacks[i];
                String name = "user";// TODO 这里可以实现为从控制台允许用户输入等方式接收用户参数。。。
                nc.setName(name);
            } else if (callbacks[i] instanceof PasswordCallback) {// prompt the user for sensitive information
                PasswordCallback pc = (PasswordCallback) callbacks[i];
                String pwd = "pwd";// TODO 这里可以实现为从控制台允许用户输入等方式接收用户参数。。。
                pc.setPassword(pwd.toCharArray());
            } else {
                throw new UnsupportedCallbackException
                        (callbacks[i], "Unrecognized Callback");
            }
        }
    }
}

测试

当登录模块和用户回调实现好以后，就可以进行测试，示例代码：

package jaas;

import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;

public class Main {
    public static void main(String[] args) throws LoginException {
        // 配置文件中查找 Sample 名字的 LoginModule，并指定 CallbackHandler
        LoginContext lc = new LoginContext("Sample", new MyCallbackHandler());

        try {
            lc.login();
            Subject subject = lc.getSubject();
//            System.out.println(subject);
            System.out.println("Authentication succeeded!");
        } catch (LoginException le) {
            System.err.println("Authentication failed:" + le.getMessage());
        }
    }
}

注意，上述的 new LoginContext("Sample", new MyCallbackHandler()); 是将 登录模块和用户回调关联起来，Sample为登录配置文件中指定的名字，java的jaas服务会通过 -D参数读取并初始化该登录模块，回调接口为用户自定义的交互对象，运行参数如下：

-Djava.security.auth.login.config=/xx/test/test_jaas.config

运行结果

由于示例代码中在 MyCallbackHandler 中硬编码指定了正确的用户名和密码，所以可以看到正确的输出：“Authentication succeeded!”

MyCallbackHandler 为自定义的交互类，可以实现为通过 web 请求中获取用户名和密码，或者从控制台 System.in  接收输入的用户名和密码等。