Jaas 需要一个 Java 策略，我不知道如何提供它

发布于 2024-10-23 16:45:42 字数 1608 浏览 1 评论 0原文

我正在尝试使用 Jaas、Java 身份验证和 Autorisation 服务。服务器是 App Engine，因此无法编辑web.xml。我使用的 servlet 过滤器如下：

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
    throws IOException, ServletException {
    try {
        LoginContext lc = new LoginContext("JaasSample", new AuthenticationCallbackHandler());
        lc.login();
        chain.doFilter(request, response);
        lc.logout();
    } catch (LoginException e) { /* lc.login() fails */}
}

对 LoginContext 的调用检查策略并抛出以下异常：

java.security.AccessControlException: 
access denied (javax.security.auth.AuthPermission createLoginContext.JaasSample)

我使用的代码来自 Oracle 参考。他们解释说，在存在安全管理器的情况下，有必要以这种方式授予一些权限：

grant {
    permission javax.security.auth.AuthPermission "createLoginContext.JaasSample";
}

我只是不明白为什么要在 JAR 中进行此操作。

我可以在运行配置中使用 -D--enable_all_permissions=true 绕过此检查。（但这需要在产品中解决）然后，在 System.getProperty("user.home")/.java.login.config 中搜索 Jaas 配置文件。难道它不是在项目资源中吗？这如何在本地/生产中发挥作用？

配置文件如下：

JaasSample {
    com.sun.security.auth.module.Krb5LoginModule required;
};

非常感谢。

附注Spring Security 可以与 Jaas 一起使用，并在 App Engine 上运行。 pps。无法使用 Spring Security，因为它启动 Spring 上下文，这会减慢 App Engine 的启动速度。并且这个环境下的启动是一直进行的。

原文

I'm trying to use Jaas, Java Authentication and Autorisation service.
The server is App Engine so, it is impossible to edit web.xml.
I'm using a servlet filter like:

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
    throws IOException, ServletException {
    try {
        LoginContext lc = new LoginContext("JaasSample", new AuthenticationCallbackHandler());
        lc.login();
        chain.doFilter(request, response);
        lc.logout();
    } catch (LoginException e) { /* lc.login() fails */}
}

The call to LoginContext checks a policy and throws the following exception:

java.security.AccessControlException: 
access denied (javax.security.auth.AuthPermission createLoginContext.JaasSample)

The code I'm using is from Oracle reference.
They explain that in presence of a Security Manager, it is necessary to grant some rights in this fashion:

grant {
    permission javax.security.auth.AuthPermission "createLoginContext.JaasSample";
}

I just don't understand why this as to be made in a JAR.

I can bypass this check with -D--enable_all_permissions=true in the Run Configuration. (But this as to be resolved to go in prod) and then, Jaas configuration file is searched at System.getProperty("user.home")/.java.login.config. Don't it rather be in the projects resources? How this can works in local / in production?

The configuration file is like:

JaasSample {
    com.sun.security.auth.module.Krb5LoginModule required;
};

Thanks so much.

ps. Spring Security can be use with Jaas and works on App Engine.
pps. Spring Security can not be used because it starts Spring context which slow down App Engine startup. And the startup in this environment is done all the time.

分享到QQ

分享到微博