JAAS 为人类服务
我很难理解 JAAS。 这一切似乎比应有的更复杂（尤其是 Sun 教程）。 我需要一个简单的教程或示例，介绍如何在基于 Struts + Spring + Hibernate 和自定义用户存储库的 java 应用程序中实现安全性（身份验证 + 授权）。 可以使用ACEGI来实现。
I am having a hard time understanding JAAS. It all seems more complicated than it should be (especially the Sun tutorials). I need a simple tutorial or example on how to implement security (authentication + authorization) in java application based on Struts + Spring + Hibernate with custom user repository. Can be implemented using ACEGI.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
其他用户在上面提供了一些非常有用的链接，因此我不会费心链接。 我对 Web 应用程序的 JAAS 进行了类似的研究，但遇到了“思想障碍”，直到我最终意识到 JAAS 是一个在与 Java 世界中的 Web 应用程序不同“层”处理安全问题的框架。 它的构建是为了解决 Java SE 中的安全问题，而不是 Java EE 中的安全问题。
JAAS 是一个安全框架，旨在保护比 Web 应用程序低得多的级别的事物。 其中一些示例是 JVM 级别可用的代码和资源，因此所有这些功能都可以在 JVM 级别设置策略文件。
然而，由于 Java EE 构建在 Java SE 之上，因此 JAAS 中的一些模块在 Java EE 安全性中被重用，例如 LoginModules 和 Callbacks。
请注意，除了 Java EE 安全性之外，还有 Spring 安全性（以前称为 Acegi），它与本机 Java EE 安全性类似，解决了保护 Web 应用程序问题中更高的“层”。 它是一个单独的安全实现，并不是构建在标准 Java EE 安全之上，尽管它在许多方面的行为相似。
总而言之，除非您希望保护 Java SE 级别的资源（类、系统资源），否则除了使用公共类和接口之外，我看不到 JAAS 的任何实际用途。 只需专注于使用 Spring Security 或普通的旧 Java EE 安全性，它们都可以解决许多常见的 Web 应用程序安全问题。
Other users have provide some very useful links above so I am not going to bother with links. I have done a similar research in JAAS for web application and has ran into a "mind roadblock" until I finally realize JAAS is a framework tackling security at a different "layer" then web applications in the Java World. It is build to tackle security issues in Java SE not Java EE.
JAAS is a security framework built for securing things at a much lower level then web-application. Some example of these things are code and resources available at the JVM level, hence all these ability to set policy files in the JVM level.
However, since Java EE is built on top of Java SE, a few modules from JAAS were reused in Java EE security such as the LoginModules and Callbacks.
Note that in addition to Java EE security, there is also Spring security (formerly known as Acegi), which similar to native Java EE security tackles a much higher "layer" in the securing web-application problem. It is a separate security implementation and is not built on top of standard Java EE security, although it behaves similarly in many regards.
To summarize, unless you are looking to secure resources in the Java SE level (classes, System resources), I don't see any real use of JAAS other than the using the common class and interfaces. Just focus on using Spring Security or plain old Java EE security which both solve a lot of common web application security problems.
以下是我用来帮助理解 JAAS 的一些链接：
http://www.owasp.org /index.php/JAAS_Tomcat_Login_Module
http:// www.javaworld.com/jw-09-2002/jw-0913-jaas.html
http:// jaasbook.wordpress.com/
http://roneiv.wordpress.com/2008/02/18/jaas-authentication-mechanism-is-it-possible-to-force -j_security_check-to-go-to-a-specific-page/
另请参阅 Apache tomcat 领域配置方法：
http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html
Here are some of the links I used to help understand JAAS:
http://www.owasp.org/index.php/JAAS_Tomcat_Login_Module
http://www.javaworld.com/jw-09-2002/jw-0913-jaas.html
http://jaasbook.wordpress.com/
http://roneiv.wordpress.com/2008/02/18/jaas-authentication-mechanism-is-it-possible-to-force-j_security_check-to-go-to-a-specific-page/
Also have a look at the Apache tomcat realms configuration how-to:
http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html
javax.security 是一个过于复杂的 API。 因此，不仅有 LoginModules 的实现者，还有整个身份验证和授权 api 的实现者，它们在上面创建了抽象层，例如 Authentication 和 Authenticator。 授权经理。
对于初学者来说，最好打印 this< /a>进入你的记忆。
其次，恕我直言，最简单的是设置和设置。 JAAS 的 go 库是 Jboss PicketBox。 它说明了如何通过 JBossAuthenticationManager 和 JBossAuthorizationManager 进行身份验证和授权...通过 XML 或注释轻松配置。 您可以使用它来管理网络应用程序和独立应用程序。
如果您需要授权部分来管理存储库访问，就资源的 ACL 而言，这就是您所需要的。
安全性问题是，通常您需要根据您的需要对其进行自定义，因此您最终可能会实现：
LoginModule - 验证用户名+密码
CallbackHandler像这样使用< code>new LoginContext("Sample", new MyCallbackHandler());
CallbackHandler 被传递到底层 LoginModule，以便它们可以与用户通信和交互 - 例如，通过图形用户界面提示输入用户名和密码。 因此，在处理程序内部，您从用户那里获取用户名和密码，并将其传递给 LoginModule。
LoginContext - 然后你只需调用 lc.login(); 并验证凭据。 LoginContext 填充有经过身份验证的主题。
然而，Jboss picketbox 为您提供了一种非常简单的方法，除非您需要特定的东西。
javax.security is imho overcomplicated API. As a result there are implementors of not only LoginModules, but the entire authentication and authorization api, that creates abstraction layer above, like Authentication & Authorization managers.
For starters, it is good to print this into your memory.
Secondly, imho the most simple, setup & go library for JAAS is Jboss PicketBox. It says how to do authentication and authorization via JBossAuthenticationManager and JBossAuthorizationManager ... Easily configurable via XML or Annotations. You can use it for managing both webapps and standalone applications.
If you need the authorization part for managing repository access, in terms of ACL for resources, this is what you are looking for sure.
Problem with the security is, that usually you need to customize it to your needs, so you may end up implementing :
LoginModule - verifies userName + Password
CallbackHandler is used like this
new LoginContext("Sample", new MyCallbackHandler());CallbackHandler is passed to the underlying LoginModules so they may communicate and interact with users - prompting for a username and password via a graphical user interface, for example. So inside of the Handler you get the username and password from user and it is passed to the LoginModule.
LoginContext - then you just call lc.login(); and authenticate the credentials. LoginContext is populated with the authenticated Subject.
However Jboss picketbox gives you a really easy way to go, unless you need something specific.
lsiu 的答案是这里真正“明白”的少数几个答案之一；）
除此之外，关于此主题的一个非常好的参考是 JAAS 发生了什么？。
它解释了 JASPIC 如何成为 Java EE 中 Servlet 和 EJB 安全模型以及潜在的 JAAS 登录模块之间的链接，但在许多情况下，JAAS 的角色被简化为 Java EE 中相对简单的用户名和角色提供者。
来自同一作者的JAAS in the Enterprise，这是一篇较旧的文章，但提供了很多内容关于 Java SE (JAAS) 和 Java EE 模型为何如此不同的历史背景。
总的来说，JAAS 中的一些类型直接在 Java EE 中使用，基本上是
Principal、Subject和CallbackHandler。 后两者主要由JASPIC 使用。 我在文章 在 Java EE 中实现容器身份验证中解释了 JASPIC贾斯皮克。lsiu's answer is one the few answers here that really "get it" ;)
Adding to that answer, a really good reference on this topic is Whatever Happened to JAAS?.
It explains how JASPIC is the link in Java EE between the Servlet and EJB security models and potentially a JAAS login module, but that in many cases JAAS' role is reduced to that of a relatively simple username and roles provider in Java EE.
From the same author is JAAS in the Enterprise, which is an older article but provides a lot of historical background on why the Java SE (JAAS) and Java EE models diverged the way they did.
Overall but a few types from JAAS are directly used in Java EE, basically
Principal,Subject, andCallbackHandler. The latter two are mainly used by JASPIC. I've explained JASPIC in the article Implementing container authentication in Java EE with JASPIC.我不能对 JAAS 本身说太多，但是这个 " 建议的步骤“ Spring Security 指南和参考手册是关于 Spring Security 的两个非常好的资源 - 如果您的设置非常简单，那么除了阅读这些之外，您实际上不需要做更多的事情。
I can't speak too much to JAAS itself, but this "suggested steps" guide on Spring Security and the reference manual are both pretty good resources on Spring Security - if your setup is anything close to simple, you don't really need to do much more than read these.
有关纯粹的 JAAS 教程，请查看此 。 它很旧，但应该有助于 JAAS 基础知识。
For a purely JAAS tutorial check out this. It's old but should help with the JAAS basics.