使用 SCA RequestContext.getSecuritySubject () API

「服務元件架構 (SCA)」 RequestContext.getSecuritySubject () 應用程式設計介面會傳回 Java 鑑別和授權 (JAAS) 主題，代表存取受保護 SCA 服務的已鑑別使用者。

開始之前

SCA 服務開發人員可以使用 RequestContext.getSecuritySubject () API 來取得代表要求端的 JAAS Subject。

如果不符合下列一或多個前置條件，則不會鑑別 SCA 要求，且 RequestContext.getSecuritySubject API 會傳回空值 Subject:

必須啟用管理安全，才能起始設定安全基礎架構。
必須啟用應用程式安全，才能施行安全原則及鑑別。
SCA 服務必須需要已鑑別使用者。您可以在傳輸層使用 authentication.transport 目的 (適用於 OSOA 複合) 或 clientAuthentication.transport 目的 (適用於 OASIS 複合) 來進行鑑別。透過附加需要鑑別的 Web 服務原則集，可以在訊息層執行鑑別。

關於這項作業

使用 RequestContext.getSecuritySubject () 時 API ，請執行下列步驟:

程序

在您的檔案中使用 RequestContext.getSecuritySubject API。

下列範例利用 OSOA RequestContext.getSecuritySubject API:

import org.osoa.sca.annotations.Context;
import org.osoa.sca.annotations.Service;
import org.osoa.sca.RequestContext;
import javax.security.auth.Subject;
import java.security.Principal;
import java.util.Iterator;
import com.ibm.websphere.security.cred.WSCredential;

@Service(EchoService.class)
public class EchoServiceWithIdentityComponentImpl implements EchoService
{
    @Context
    protected RequestContext requestContext;

    public String echo_String(String input)
    {
        try {
	           Subject subject = null;
	           String securityName = null;

            if (requestContext != null) {
                subject = requestContext.getSecuritySubject();
   	         }

            if (subject != null) {
                 java.util.Set principalSet = subject.getPrincipals();
                 if (principalSet != null && principalSet.size() > 0) {
                     Iterator principalIterator = principalSet.iterator();
                     if (principalIterator.hasNext()) {
                         Principal principal = (java.security.Principal) principalIterator.next();
                         securityName = principal.getName();
                     }
                 }
            }
         } catch (Exception ex) {
               // Handle exception
         }
     }
}

相同的範例適用於使用 OASIS RequestContext.getSecuritySubject API ，但套件名稱變更除外:

import org.oasisopen.sca.annotation.Context;
import org.oasisopen.sca.annotation.Service;
import org.oasisopen.sca.RequestContext;

您可以從主體中的 WSCredential 物件取得要求的各種安全屬性，如下列範例所示:

if (subject != null) {
    java.util.Set credSet = subject.getPublicCredentials();
    if (credSet != null && credSet.size() > 0)
    {
        Iterator credIterator = credSet.iterator();
        while (credIterator.hasNext()) {
            Object o = credIterator.next();
            WSCredential cred = null;
            if (o instanceof WSCredential) {
                cred = (WSCredential) o;
            } else {
                if (securityName == null) {
                    securityName = new StringBuffer();
                }
                securityName.append("\n>> Found a public credential: " + o.getClass().getName());
            }
            if (cred != null) {
                if (securityName == null) {
                    securityName = new StringBuffer();
                }
                securityName.append("\n>> WSCredential security attributes . . .");
                securityName.append("\n>> getAccessId = \t\t" + cred.getAccessId());
                securityName.append("\n>> getGroupIds = \t\t" + cred.getGroupIds());
                securityName.append("\n>> getPrimaryGroupId = \t\t" + cred.getPrimaryGroupId());
                securityName.append("\n>> getRealmName = \t\t" + cred.getRealmName());
                securityName.append("\n>> getRealmSecurityName = \t\t" + cred.getRealmSecurityName());
                securityName.append("\n>> getRealmUniqueSecurityName = \t\t" + cred.getRealmUniqueSecurityName());
                securityName.append("\n>> getSecurityName = \t\t" + cred.getSecurityName());
                securityName.append("\n>> getUniqueSecurityName = \t\t" + cred.getUniqueSecurityName());
            } 
        }
    }
}

主體身分包含網域範圍名稱，後面接著要求者的身分。例如，假設 WebSphere® Application Server 配置為使用輕量型目錄存取通訊協定 (LDAP) 伺服器進行鑑別。網域範圍名稱是 LDAP 伺服器主機名稱和埠號:

security name = ldap1.austin.ibm.com:389/user2

這裡顯示範例輸出:

>> WSCredential security attributes . . . 
>> getAccessId = 			user:ldap1.austin.ibm.com:389/cn=user2,o=ibm,c=us 
>> getGroupIds = 			[group:ldap1.austin.ibm.com:389/CN=GROUP2,O=IBM,C=US] 
>> getPrimaryGroupId = 		group:ldap1.austin.ibm.com:389/CN=GROUP2,O=IBM,C=US 
>> getRealmName = 		ldap1.austin.ibm.com:389 
>> getRealmSecurityName = 	ldap1.austin.ibm.com:389/user2 
>> getRealmUniqueSecurityName = ldap1.austin.ibm.com:389/cn=user2,o=ibm,c=us 
>> getSecurityName = 		user2 
>> getUniqueSecurityName = 	cn=user2,o=ibm,c=us