将 Spring Security 与 EJB 或 Spring 结合使用？
我想构建一个基于 Java EE 6 的应用程序，但 Java EE 的安全机制不足以满足我的需求。 Spring Security 似乎是保护我的应用程序的最佳方法。现在我想知道 Spring Security + EJB 是否是一个很好的组合，或者我是否应该更好地只使用 Spring。
我需要方法拦截、ACL 以及可能的 URL 模式访问控制。我看到的主要问题是将 EJB 拦截与 Spring Security 结合使用。这是一个问题吗？还有哪些其他领域可能存在问题？
您更喜欢 Spring Security + EJB 还是 Spring Security + Spring（仅）？
正如 skaffman 所说，真正的问题是 Java EE 与 Spring。 JBoss 有一个很好的比较。
I wanted to build an application based on Java EE 6, but the security mechanisms of Java EE are not sufficient and a pain to with for my needs. Spring Security seems the best way to secure my application. Now I wonder if Spring Security + EJB is a good combination or if I should be better use Spring only.
I need method interception, ACLs and possibly URL pattern access control. The main problem I see is to use EJB interception with Spring Security. It is a problem? What other areas could be problematic?
Would you prefer Spring Security + EJB or Spring Security + Spring (only)?
As skaffman said the real question is Java EE vs. Spring. There is a nice comparison from JBoss.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Spring Security 与 Spring 框架不同。它们可以很好地协同工作，但 Spring Security 不要求您使用底层的 Spring 框架。
所以从非常现实的意义上来说，这并不重要，这变成了你更喜欢 EJB3 还是 Spring 的问题，而不考虑 Spring Security。
Spring Security is distinct from the Spring Framework. They work well together, but Spring Security does not require you to use the Spring Framework underneath.
So in a very real sense, it doesn't matter, it becomes a question of whether you prefer EJB3 or Spring, regardless of Spring Security.
我对 EJB 不是很熟悉，但我一直认为它本质上是一种数据访问技术，或者是一种分发服务的方式。
Spring 本身以及 Spring Security 模块被设计得非常轻量级且不引人注目。如果您正在构建 Web 应用程序并使用 Spring Security 进行登录/安全，那么它并不关心甚至不知道您是否使用 EJB、JDBC、远程处理技术等。
I am not very familiar with EJB but my understanding has always been that it is essentially a data-access technology, or a way to distribute services.
Spring itself, and the Spring Security module, is designed to be very lightweight and unobtrusive. If you are building a web application and using Spring Security for logins/security, then it doesn't care or even know if you are using EJB vs JDBC vs remoting technologies etc.
在花了很多天尝试找到一种仅使用 springsecurity 来保护 ejb 的方法之后，我采用了一种混合解决方案：JAAS + springsecurity。
客户端使用 JAAS 对服务器上的 ejb 进行身份验证，我创建了一个自定义 JAAS LoginModule，它将身份验证委托给 springsecurity 代码。
EJB 使用 jsr250 注释（RolesAllowed）注释的方法来执行其逻辑，这部分是完全由 Spring Security 处理。
通过这种方式，我实现了 ejb 和 spring security 之间的明确分离，因此由 springsecurity 保护的我的业务代码可以完全移植到任何其他类型的 ApplicationServer，甚至可以作为独立应用程序运行。
After having spent a lot of days trying to find a way to only uses springsecurity to secure the ejb, I've adopted kind of hybrid solution: JAAS + springsecurity.
The client uses JAAS to be authenticated to the ejb on the sever, I've created a custom JAAS LoginModule which delegates authentication to the springsecurity code.
EJBs to perform their logic use methods which are annotated with jsr250 annotations (RolesAllowed), and this part is fully handled by spring security.
In this way I've achieved a clear separation between ejb and spring security so my business code, secured by springsecurity, is fully portable to any other kind of ApplicationServer or it can even run as standalone application.