Glassfish 身份验证：领域可以是外部数据库吗
我对登录和身份验证概念完全陌生。我正在开发一个 Glassfish Web 应用程序，该应用程序应该向任何访问者呈现一般内容，并为使用用户名和密码登录的注册用户提供一些额外内容。
我一直在阅读有关安全性的 Java EE 教程，我认为基于表单或 HTTP 身份验证可以满足我的需求（在尝试浏览安全内容时，会要求访问者提供凭据）。
然而，我的第一个猜测是注册用户应该与他们的散列和加盐密码一起存储在外部数据库中。 Glassfish 中 Web 应用程序的安全性似乎依赖于直接在应用程序服务器上手动填充的领域（定义用户和组并将它们映射到应用程序中的角色）。
我是否误解了 Glassfish 的安全目的？或者领域可以是应用程序服务器之外的外部数据库吗？有关此主题的任何文档链接对我来说都是有用的。
提前谢谢你
蛋挞
I am completely new to login and authentication concepts. I am working on a Glassfish web application that should present general content to any visitor, and some extra content for registered users logged in with username and password.
I have been reading the Java EE tutorial about security, and I thought that the Form-based or HTTP authentication would fulfill my needs ( the visitor is asked for credentials when trying to browse a secured content ).
However, my first guess was that the registred users should be stored in an external database along with their hashed and salted password.
The security for web application in Glassfish seems to rely on the realm populated manually directly on the application server ( defining user and groups and mapping them to the Roles in the application ).
Did I misunderstood what security on Glassfish is intented to ? Or can a realm be a external database outside the application server ? Any link to documentation on this topic would be useful to me.
Thank you in advance
Tart
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这实际上是可能的。
在 Glassfish 中，转到 Configuration/Security/Realms，创建一个新领域并将类名设置为 com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm。
指明与数据库绑定的JDBC资源，并指明存储用户名/密码的表和列。数据库还应包含一个表，用于记录用户必须属于哪些组才能被授予访问权限。也指出那些。
在应用程序中，像往常一样使用领域名称设置 web.xml 和 sun-web.xml。
It is actually possible.
In Glassfish, go to Configuration/Security/Realms, create a new realm and set the classname to com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm.
Indicate the JDBC Resource bound to the database, and indicate the table and the columns where username/password are stored. The database shall also contains a table for the groups which the user must belong to be granted access. Indicate those also.
In the application, set up the web.xml and sun-web.xml with the realm name as usual.
这是一篇关于 glassfish 中的 jdbc 领域的文章，其中包含您所描述的场景： http://java-cookbook.blogspot.com/2011/02/jdbc-security-realm-with-glassfish-and.html
Here is an article about jdbc realm in glassfish with scenario you described: http://java-cookbook.blogspot.com/2011/02/jdbc-security-realm-with-glassfish-and.html