java模拟使用Windows身份验证连接到sql服务器
现在我有以下使用经典 asp 和 Visual Basic 6 构建的架构
我有一个用 VB6 开发的 COM+ 组件，它连接到 dabatase。 我通过配置了集成安全性的 .udl 文件设置数据库配置。
在Web服务器（IIS）上，我使用com+管理器注册组件，并将其配置为在帐户名下运行，例如mydomain\appAccount...
授予mydomain\appAccount适当的权限
在sql 2005中，我从asp ，我只是使用 server.createobject 的组件...
我想用 java 开发一个类似的解决方案，问题如下：
可能吗？
如何配置域帐户以连接到 sql server 2005 数据库？
我应该在哪里存储数据库配置？ 我应该在哪里配置域帐户？ 在tomcat/jetty配置中？
我希望解决方案尽可能简单直接（我试图避免诸如 glassfish 或 jboss 之类的东西）
，非常感谢......
right now I have the following architecture built with classic asp and visual basic 6
I have a COM+ component developed in VB6 which connects to the dabatase. I set the DB conf thru an .udl file configured with integrated security.
At the web server (IIS) I register the componente with the com+ manager, and configure it to be run under an account name, something like mydomain\appAccount...
in sql 2005 I give the appropiate permissions the mydomain\appAccount
from asp, I just use the component with server.createobject...
I'd like to develop a similar solution with java, the question(s) is(are) the following:
is it possible?
how can I configure a domain account to connect to a sql server 2005 db?
where should I store the db conf? and where should I configure the domain account? in tomcat / jetty configuration?
I'd like the solution to be as simple and straight forward as possible (I'm trying to avoid things like glassfish or jboss)
well, thanks a lot...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您需要做的是确保 Tomcat JVM 进程由具有与数据库的可信连接的用户执行。
然后，您需要根据 Bhushan 的回答在 Tomcat 中配置数据源。
以下 MSDN 文章详细介绍了如何设置数据源以使用集成安全性：
What you'll need to do is make sure that the Tomcat JVM process is being executed by the user with the trusted connection to the database.
Then you'll need to configure the data source in Tomcat, per Bhushan's answer.
The following MSDN article details how you set up the data source to use integrated security:
所以这是一个非常棘手的问题，我现在正在经历同样的问题。 我还没有解决应用程序服务器内的模拟问题，但我的团队正在接近解决这个问题。
到目前为止，我们已经成功地使用 Kerberos 针对域控制器对用户进行了身份验证。 SourceForge SPNEGO 和 Spring Security Kerberos 扩展在这方面都非常有帮助。 我们还能够在连接到 SQL Server 时成功模拟运行 Java 应用程序的进程。 真正的问题是通过委派进行模拟，因为它要求您获取可以委派给另一个服务的 Kerberos 票证。 这是我们目前正在研究的问题。
如果要在 SQL Server 中模拟用户，则必须使用 NTLM 或 Kerberos 来完成。 Kerberos 提供了最好的安全性，说实话，我们甚至懒得尝试使用 NTLM。 有两个 JDBC 驱动程序（据我所知）允许您使用域帐户连接到 SQL Server：jTDS 和 DataDirect JDBC。 jTDS 是 Type-2 JDBC 驱动程序，这意味着它依赖本机库来获取用户的凭据。 jTDS 只会模拟运行该进程的用户，并且不允许您模拟其他帐户（而且，它只能在 Windows 上执行此操作）。 DataDirect 驱动程序（商业）是 Type-4 驱动程序，这意味着它是纯 Java 实现（并且可以在 *nix 上工作）。 这是我们正在使用的驱动程序，它工作得很好。
如果我找到了可行的解决方案，我会将其发布，因为我认为社区中的很多人都在这个问题上受到伤害。
祝你好运！
So this is a real tough issue, and I'm going through the same problems right now. I haven't solved impersonation within an app server yet, but my team is getting close.
So far, we've been successful in Authenticating a user against a Domain Controller with Kerberos. Both the SourceForge SPNEGO and Spring Security Kerberos Extension have been very helpful in that regard. We have also been able to successful impersonate the process running a Java application when connecting to SQL Server. The real problem is impersonation via delegation, since it requires you to obtain a Kerberos ticket that can be delegated to another service. This is the issue we are currently working on.
If you are going to impersonate a user in SQL Server, you've got to do it using NTLM or Kerberos. Kerberos offers the best security, and to be quite honest, we haven't even bothered to try using NTLM. There are two JDBC drivers (that I know of) that will allow you to connect to SQL Server using a Domain account: jTDS and DataDirect JDBC. jTDS is a Type-2 JDBC driver, which means it relies on a native library to grab credentials for the user. jTDS will only impersonate the user running the process, and will not allow you to impersonate other accounts (also, it can only do this on Windows). The DataDirect driver (Commercial) is a Type-4 driver, which means it's a pure Java implementation (and will work on *nix). This is the driver we are using and its working great.
If I get a solution working, I'm going to post it because I think a lot of people in the community are hurting on this issue.
Good Luck!
查看此 tomcat 文档了解如何配置数据源。
http://tomcat.apache.org/tomcat- 6.0-doc/jndi-datasource-examples-howto.html
Check this tomcat documentation about how to configure a datasource.
http://tomcat.apache.org/tomcat-6.0-doc/jndi-datasource-examples-howto.html