高级 Java 安全框架
您在 Java 项目中使用什么安全框架？
我使用了 Spring Security 和 Apache Shiro，它们看起来都不成熟。
Spring Security缺陷：
- 没有对权限的原生支持；
- 无法在 Java 代码中显式使用（有时这是必要的）；
- 过于关注经典（非 AJAX）Web 应用程序。
Apache Shiro 缺陷：
- 最终版本中的错误（例如 Spring 集成的问题）；
- 不支持 OpenID 和其他一些广泛使用的技术；
- 报告了性能问题。
两者也都缺乏文档。
也许大多数真正的项目都开发自己的安全框架？
What security framework do you use in your Java projects?
I used Spring Security and Apache Shiro and they both look immature.
Spring Security flaws:
- no native support for permissions;
- no ability to use explicitly in Java code (sometimes it's necessary);
- too much focused on classic (non AJAX) web applications.
Apache Shiro flaws:
- bugs in final release (like the problem with Spring integration);
- no support for OpenID and some other widely used technologies;
- performance issues reported.
There is also lack of documentation for both of them.
Maybe most of the real projects develop their own security frameworks?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我当前的项目使用 SpringSecurity 并涉及执行您声称是 SpringSecurity 中的缺陷的所有三件事：
这些项目实现了超出简单角色的细粒度访问规则，并且以各种方式涉及域对象的状态、额外的请求参数等在。这些是使用在我的 MVC 控制器中调用的自定义“访问策略对象”来实现的。但是，访问检查失败会通过抛出相关异常而交回给 SpringSecurity。 （这些可以作为标准 SpringSecurity 方法级拦截器实现，但检查通常涉及检查域对象。）
这些项目支持 Web 和 AJAX 访问，并以不同的方式处理这两种情况的访问失败。这是通过为 SpringSecurity 编写一些自定义身份验证入口点组件来完成的，这些组件根据请求 URL 等在不同的身份验证行为之间进行选择。
换句话说，它可以完成......
话虽如此，我同意你的几点观点:
连接这种东西并不容易。在使用
文档非常稀疏，如果您尝试做一些不寻常的事情，则没有帮助。
My current projects use SpringSecurity and involve doing all three things you claim to be flaws in SpringSecurity:
The projects implement fine-grained access rules that go beyond simple ROLEs, and variously involve state of domain objects, extra request parameters, and so on. These are implemented using custom "access policy objects" that get called within my MVC controllers. However, access check failures are handed back to SpringSecurity by throwing the relevant exception. (These could have been implemented as standard SpringSecurity method-level interceptors, but the checks typically involve examining domain objects.)
The projects support both web and AJAX access, and deal with access failures differently for the two cases. This is done by writing some custom Authentication entrypoint components for SpringSecurity that choose between different authentication behaviors depending on the request URL, etc.
In other words, it can be done ...
Having said that, I agree with you on a couple of points:
It is not easy to wire this up kind of thing. I kept on running into roadblocks when using the
<http>element and its associated configurer. Like ... you want it to use a different version of component X. But to do that you have to replace Y, Z, P and Q as well.The documentation is really sparse, and not helpful if you are trying to do something out of the ordinary.
安德烈，我认为这个答案来得太晚了，对你没有帮助；它是为那些稍后登陆此线程的人准备的，我希望它有所帮助。
我的公司最近发布了开源的 OACC，这是一个高级 Java 应用程序安全框架。 OACC 专为需要高达对象级安全粒度的系统而设计。
OACC 提供高性能 API，提供基于权限的授权服务。简而言之，OACC 允许您的应用程序通过回答以下问题来增强安全性：实体“A”是否允许对实体“B”执行操作“p”？
OACC 中的关键抽象之一是资源。 资源充当OACC中需要保护的应用程序域中的对象的占位符。参与者（例如用户、进程）和受保护的对象（例如文档、服务器）在 OACC 中都表示为资源。作为参与者或受保护的应用程序域对象只是将资源 ID 存储到关联的资源。
与其他主要安全框架不同，资源抽象允许 OACC 提供丰富的 API 来管理资源之间的权限。 OACC 在 RDBMS 表中保留安全关系（当前支持 DB2、Oracle、MS-SQLServer 和 PostgreSQL）。
欲了解更多信息，请查看项目网站：http://oaccframework.org
Andrey, I think this answer comes too late to be helpful to you; it is intended for those who land on this thread later and I hope it helps.
My company recently released as open source, OACC, an advanced Java Application Security Framework. OACC is designed for systems that require up to object-level security granularity.
OACC provides a high performance API that provides permission based authorization services. In a nutshell, OACC allows your application to enforce security by answering the question: Is entity ‘A’ allowed to perform action ‘p’ on entity ‘B’?
One of the key abstractions in OACC is a resource. A resource serves as the placeholder in OACC for the object in the application domain that needs to be secured. Both the actors (e.g. users, processes) and the objects being secured (e.g. documents, servers) are represented as resources in OACC. The application domain objects that are actors, or are secured, simply store the resource id to the associated resource.
The resource abstraction allows OACC, unlike other major security frameworks, to provide a rich API that manages permissions between resources. OACC persists security relationships in RDBMS tables (DB2, Oracle, MS-SQLServer and PostgreSQL are currently supported).
For more information please check out the project website: http://oaccframework.org
我们在一个项目中使用了分层安全性。这些层如下：
从概念上讲，安全性由加密密钥、加密算法和应用该算法的数据组成。我们确保在通信过程中不会同时传递 3 个以上的 1 个。希望有帮助。问候， - MS
We use a layered security in one of our projects. The layers are the following:
Conceptually, the security consists of the encryption key, encryption algorithm and the data on which it is applied. We make sure that more than 1 of the 3 is never passed simultaneously during a communication. Hope that helps. Regards, - M.S.
至于 Apache Shiro：
我不确定你为什么列出你所做的事情：
我很乐意提供帮助，但您的担忧是概括性的，没有参考文献或具体示例的支持。也许您可以代表您的项目需要但迄今为止尚未完成的具体事情？
Apache Shiro 仍然是 Java 和 JVM 语言中最灵活、最容易理解的安全框架 - 我怀疑您会找到更好的。
但是，最重要的是，我是真心实意地表示，请不要编写自己的安全框架，除非您计划投入可笑的时间。我见过的几乎所有试图自己做到这一点的公司都惨遭失败。要“正确”（并且安全）确实非常困难。相信我 - 在写了 8 年之后，这是我绝对确定的一件事:)
不管怎样，请随意加入 Shiro 用户列表，你一定会发现社区很高兴并且愿意解决任何问题你可能有。您会发现我们会照顾提出问题的人，并尽力提供帮助。
哈！
As for Apache Shiro:
I'm not sure why you've listed the things you did:
I'd love to help, but your concerns are generalizations that aren't supported by references or concrete examples. Maybe you could represent specific things that your project needs that you've fail to accomplish thus far?
Apache Shiro continues to be the most flexible and easiest to understand security framework for Java and JVM languages there is - I doubt you'll find better.
But, above all, and I mean this with all sincerity, please don't write your own security framework unless you plan on putting a ridiculous amount of time into it. Nearly every company I've ever seen that tries to do this themselves fails miserably. It is really hard to get 'right' (and secure). Trust me - after writing one for 8 years, that's one thing I'm absolutely sure of :)
Anyway, feel free to join the Shiro user list and you're sure to find that the community is happy and willing to work through whatever issues you may have. You'll find that we take care of the people that ask questions and do our best to help out.
HTH!