基于Spring的java应用程序身份验证和授权的最佳实践
在我们的组织中，我们正在开发基于 LDAP 的身份验证和授权 具有单点登录功能。开发这个通用模块后，将会有数十个其他模块依赖于它。工具集是 -
- Spring
- Hibernate
- Tomcat 7
- openAm/openSSO
- openldap
- postgresql
我们将拥有简单的身份验证机制，但非常复杂的授权方案。我们不确定授权的正确方法是什么。我们应该将身份验证和授权逻辑放在 LDAP 中还是应该仅将其用于身份验证？在这种情况下，我们将不得不使用 OpenAM/OpenSSO。还有其他方法吗？比如 Spring Security、CAS、JOSSO，..？无论采用哪种方法，它都必须具有很强的可扩展性和可维护性。任何建议或帮助将不胜感激。
谢谢， 纳兹鲁尔
In our organization we are developing an ldap based Authentication, and Authorization
with Single Sign On on feature. Upon developing this generic module, there will be tens of other modules which will be dependent on it. The tool sets are -
- Spring
- Hibernate
- Tomcat 7
- openAm/openSSO
- openldap
- postgresql
We will have simple authentication mechanism but very complex authorization scheme. We are not sure what will be the right approach for authorization. Should we put the authentication as well as authorization logic in LDAP or should we use it for authentication only? In that case we will have to mess around with the OpenAM/OpenSSO. Is there any other approach? like spring security, CAS, JOSSO, .. ? Whatever the approach, it has to be very scalable and maintainable. Any suggestion or help would be greatly appreciated.
Thanks,
Nazrul
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以查看 Apache Shiro：http://shiro.apache.org/。它是一个易于使用的安全框架，支持大多数现有的安全技术，包括 LDAP 和单点登录。
此外，通过子类型化 AuthenticatingRealm 和 AuthorizingRealm（来自 Shiro API），您可以实现您的身份验证和授权策略，无论它们有多复杂。
最常见的是，您将实现自己的：
AuthenticatingRealm
AuthorizingRealm
AuthenticationToken
AuthrozationToken
PremissionResolver
等等...
You may have a look at Apache Shiro: http://shiro.apache.org/. It is a easy-to-use security framework that supports most of the existing security technologies including LDAP and Single Sign On.
Also, through subtyping AuthenticatingRealm and AuthorizingRealm (from the Shiro API), you can implement your authenticating and authorizing strategies no matter how complex they are.
Most commonly, you will implement your own:
AuthenticatingRealm
AuthorizingRealm
AuthenticationToken
AuthrozationToken
PremissionResolver
and so on...
在做出任何决定之前，您可能会想看看这个。
http://grzegorzborkowski.blogspot.com/2008 /10/spring-security-acl-very-basic-tutorial.html
You probably would want to look at this before you move on in making any decision.
http://grzegorzborkowski.blogspot.com/2008/10/spring-security-acl-very-basic-tutorial.html
对于授权，您可以查看基于 XACML 的外部化授权框架，即 可扩展访问控制标记语言。
它是一个实现基于属性的访问控制的 OASIS 标准，为您设计授权的方式提供了很大的灵活性。
For the authorization, you can look at externalized authorization frameworks based on XACML, the eXtensible Access Control Markup Language.
It is an OASIS standard that implements attribute-based access control which gives you a lot of flexibility into how you design your authorization.