web 安全认证-角色 权限 模块分配

所有的web的认证在验证的配置的web.xml文件基本上一致：

1.配置web.xml

<!--登录方式-->

 <login-config>
   <auth-method>BASIC</auth-method>   <!--BASIC基本的弹出输入框-->
 </login-config>
 <!--  定义角色 -->
 <security-role>
  <role-name>leader</role-name>
 </security-role>
 <security-role>
  <role-name>employs</role-name>
 </security-role>
 <!-- 管理模块和角色绑定 -->
 <security-constraint>
  <web-resource-collection>
   <web-resource-name>list module</web-resource-name>  <!--起名-->
   <url-pattern>/list/*</url-pattern>

                                           <!--使用区域[可以配置多个,从而使你做的更精确]-->
   <http-method>GET</http-method>                                  <!--请求方式-->
   <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>                                        <!--使用哪种角色-->
   <role-name>leader</role-name>
   <role-name>employs</role-name>
  </auth-constraint>
 </security-constraint>
 <security-constraint>
  <web-resource-collection>
   <web-resource-name>manager module</web-resource-name>
   <url-pattern>/manager/*</url-pattern>
   <http-method>GET</http-method>
   <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>
   <role-name>leader</role-name>
  </auth-constraint>
 </security-constraint>

2.创建文件

      在webRoot下建立list和manager文件夹，并在其建立几个jsp页面.

      insert.jsp写几个超链接，分别连接到各个文件夹下的jsp页面.

 

 

<!----------------------------------jboss和tomcat的使用------------------------------->

 

1.JOBSS的文件认证配置,默认的domain：other：读取src的下面两个配置文件

    users.properties

                         username=password

                                   zhouhr=888888

                                   eylen=888888 

                                   zhr=888888

    roles.properties

                         username=roles

                                   zhouhr=leader

                                   eylen=employs 

                                   zhr=employs

 

2.tomcat使用数据库：

      配置tomcat/conf/server.xml

      整个tomcat只能使用一种方式认证：要不配置文件，要不连接数据库。所以要将之前的方式注释：

        <!--
   <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
             resourceName="UserDatabase"/>
   -->

    配置已数据库相关的realm，再此我使用mysql数据库,[oracle数据库也类似,直接改它提供的(注释)]

         <Realm  className="org.apache.catalina.realm.JDBCRealm"
             driverName="org.gjt.mm.mysql.Driver"
          connectionURL="jdbc:mysql://localhost/web"
         connectionName="root" connectionPassword="919"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />

 

 

在Mysql数据库中建数据库:create database web;

建表：create table users(user_name varchar(20),user_pass varchar(20));

         create table user_roles(user_name varchar(20),role_name varchar(20));

插入数据:

          insert into users values('zhouhr','888888');

          insert into users values('eylen','888888');

          insert into users values('zhr','888888');

          insert into user_roles values('zhouhr','leader');

          insert into user_roles values('eylen',employs');

          insert into user_roles values('zhr','employs');

                                 

二、jboss配置domain使用数据源

 

   

一.

jboss默认的domain是other：

默认读取src下的users.properties;roles.peroperties

为了我们根据自己的数据去角色分配我们要定义自己的domain

jboss-4.2.0.GA/server/default/conf

login-config.xml

<application-policy name = "myDomain">

<authentication>

<login-module

code = "org.jboss.security.auth.spi.DatabaseServerLoginModule"

flag = "required">

<module-option

name = "unauthenticatedIdentity">guest</module-option>

<module-option

name = "dsJndiName">java:/DefaultDS</module-option>

<module-option name = "principalsQuery">

SELECT PASSWD FROM USERS WHERE USERID=?

</module-option>

<module-option name = "rolesQuery">

SELECT ROLEID, 'Roles' FROM ROLES WHERE USERID=?

</module-option>

</login-module>

</authentication>

</application-policy>

该java:/DefaultDS 是jboss的指定的数据源：找到：

JMX Console  àdatabase=localDB,service=Hypersonic à

void startDatabaseManager()

MBean Operation.

点击invoke将弹出数据库管理器，

DefaultDS数据源指向就是这里的数据库，根据上面的角色分配建立表：

 create table users(userid varchar2(20),passwd varchar2(20));

create table roles(userid varchar2(20),roleid varhcar2(20));

 

增加dtd文件jboss-wed_4_2.dtd ；jboss-service_4_2.dtd;jboss_4_2.dtd

 

       Location:文件位置

Key Type:  -//JBoss//DTD Web Application 4.2//EN

Key: http://www.jboss.org/j2ee/dtd/jboss-web_4_2.dtd

在META-INF下建立jboss-web.xml,jboss.xml

============jboss-web.xml=================

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE jboss-web PUBLIC "http://www.jboss.org/j2ee/dtd/jboss-web_4_2.dtd" "jboss-web_4_2.dtd" >

<jboss-web>

<security-domain>

java:JAAS/myDomain

</security-domain>

</jboss-web>

============jboss.xml=================

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE jboss PUBLIC "http://www.jboss.org/j2ee/dtd/jboss_4_2.dtd" "jboss_4_2.dtd" >

<jboss>

<security-domain>myDomain</security-domain>

<unauthenticated-principal>guest</unauthenticated-principa>

</jboss>

二、自己定义的myDomaim使用自己定义的数据源:

1)    将驱动jar复制到jboss-4.2.0.GA/server/default/lib下

2)    到jboss-4.2.0.GA/docs/examples/jca     找到你要需要的数据库配置数据源的模版,[mysql-ds.xml]到

/jboss-4.2.0.GA/server/default/deploy

 修改数据源配置

<?xml version="1.0" encoding="UTF-8"?>

<datasources>

<local-tx-datasource>

<jndi-name>MySQL</jndi-name>

<connection-url>jdbc:mysql://127.0.0.1:3306/test

</connection-url>

<driver-class>com.mysql.jdbc.Driver</driver-class>

<user-name>root</user-name>

<password>919</password>

<exception-sorter-class-name>

org.jboss.resource.adapter.jdbc.vendor.MySQLExceptionSorter

</exception-sorter-class-name>

<metadata>

<type-mapping>mySQL</type-mapping>

</metadata>

</local-tx-datasource>

</datasources>

==============================================================

配置完成：

create table users(userid varchar2(20),passwd varchar2(20));

create table roles(userid varchar2(20),roleid varhcar2(20));

insert into users(‘zhouhr’,’8888’);

insert into users(‘eylen’,’8888’);

insert into users(‘zhr’,’8888’);

insert into roles(‘zhouhr’,’leader’);

insert into roles(‘eylen’,’employs’);

insert into roles(‘zhr’,’employs’);

 

 

 

在方法上的配置角色-权限:

import javax.annotation.security.DeclareRoles;

import javax.annotation.security.PermitAll;

import javax.annotation.security.RolesAllowed;

import javax.ejb.Stateless;

@Stateless

@DeclareRoles(value={"leader","employs"})

public class Security implements SecurityRemote {

@PermitAll

public String all(){

       return "all";

    }

    @RolesAllowed(value={"leader","employs"})

    public String list(){

       return "list";

    }

    @RolesAllowed("leader")

    public String manager(){

       return "manager";

    }

}

====================================================================

import javax.naming.Context;

import javax.naming.InitialContext;

import javax.naming.NamingException;

import org.jboss.security.SecurityAssociation;

import org.jboss.security.SimplePrincipal;

public class SecurityTest {

    public static void main(String[] args) throws NamingException {

       Context ctx=new InitialContext();

       SecurityRemote sr=(SecurityRemote) ctx.lookup("Security/remote");

       SecurityAssociation.setPrincipal(new SimplePrincipal("eylen"));

       SecurityAssociation.setCredential("8888");

       try {

           System.out.println(sr.all());

           System.out.println(sr.list());

           System.out.println(sr.manager());

       } catch (Exception e) {

       }

    }

}