检测 Tomcat 中领域身份验证失败的原因
我为 Tomcat 7 编写了一个自定义 Realm。我将其包装在 Tomcat 默认安装提供的锁定 Realm 中。锁定功能工作正常，但在我的 web.xml 中，我有
<error-page>
<error-code>403</error-code>
<location>/forbidden.html</location>
</error-page>
它将引导任何未验证页面的用户。但是，如果经过正确身份验证的用户被锁定，它也会将其重定向到该页面。当用户错误地进行身份验证并被锁定时，是否可以通过某种方式检测到差异？
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
看起来并不容易。我的第一个想法是子类化
LockOutRealm并在用户被锁定时向请求上下文添加一些内容，稍后您可以将其打印到用户界面。不幸的是，它不起作用，因为LockOutRealm的 >authenticate 方法刚刚获取了登录名和密码，并且那里没有请求或上下文对象。另一个问题是，当身份验证失败时，
authenticate方法会返回null，而LockOutRealm也会这样做。身份验证失败时，
LockOutRealm的行为与任何其他领域的行为没有区别。解决方法：如果您使用的是 Servlet 3.0，请使用
HttpServletRequest接口的login方法，自己实现锁定逻辑并检查在 servlet 调用 HttpServletRequest.login() 之前失败的登录尝试计数。如果高于限制，请勿调用
login()并打印自定义错误消息。It does not look easy. My first idea was subclassing the
LockOutRealmand adding something to the request context if the user is locked out which you can print to the user interface later. Unfortunately it will not work because theauthenticatemethods of theLockOutRealmjust got the login and password and there is no request or context objects there.Another problem is that the
authenticatemethods returnsnullwhen the authentication failed andLockOutRealmalso does that.There is no difference between the behavior of the
LockOutRealmand the behavior of any other realm when the authentication failed.A workaround: If you are using Servlet 3.0 use the
loginmethod of theHttpServletRequestinterface, implement the lockout logic yourself and check the count of failed login attempts before your servlets call theHttpServletRequest.login(). If it's higher than the limit don't call the
login()and print a custom error message.有同样的问题。请求范围内可能存在某些内容。有我在 Tomcat 5.5 中使用的另一个锁定领域的经验，它将放入请求范围“com.ofc.tomcat.LOGIN_FAILURE_MESSAGE”，如果该范围不存在，则用户一定已被锁定。
Have same question. There might be something in the request scope. Have experience with another lockout realm that I used with Tomcat 5.5 and it would put into the request scope "com.ofc.tomcat.LOGIN_FAILURE_MESSAGE" and if that was not present then the user must have been locked out.
这个帖子很老了，我的回答肯定很延迟。然而，我将列举一种执行上述操作的方法。身份验证后提供失败原因的自定义消息在 Tomcat 中稍微复杂，但是可以实现。为了实现这一点，方法之一是构造一个自定义 Tomcat Valve 并将其添加到适当的级别（主机、引擎或上下文）。如果任何 Web 应用程序使用 FORM 身份验证，Tomcat 会自动将 FormAuthentication Valve 插入处理管道。这个想法是拦截来自浏览器的“j_security_check”操作，并在它到达 FormAuthentication Valve 之前进行一些预验证。在“invoke”方法中，用户名（“j_username”）和密码（“j_password”）都可以从请求对象中以明文形式获取。通过这些，可以通过直接进入领域（数据库或 LDAP 等）来检查帐户是否被锁定或用户是否需要更改密码等。从这个阀门，可以将response.redirect()发送到适当的错误页面。
This thread is very old and my answer most certainly is very delayed. However, I shall enumerate one way of doing the above. Custom messages after authentication providing the reason for failure is slightly complicated in Tomcat, however, it can be achieved. To achieve this, one of the methods is to construct a custom Tomcat Valve and add it at an appropriate level (Host, Engine or Context). Tomcat automatically inserts the FormAuthentication Valve to the processing pipeline, if any web application uses FORM authentication. The idea is to intercept the 'j_security_check' action from the browser and do some pre-validations before it lands with the FormAuthentication Valve. In the 'invoke' method, both the user name ('j_username') and password ('j_password') are available as clear text from the request object. With these it can be checked whether an account is locked out or user needs to change password etc. by directly going into the realm (Database or LDAP etc.). From this valve, a response.redirect() can be sent to appropriate error pages.