JAAS 程序化登录

在开始使用程序化登录 API 进行开发之前，请考虑以下要点：

• 对于纯 Java 客户端应用程序或客户端容器应用程序，在执行JAAS登录。 在进行 JAAS 登录之前通过执行以下代码来完成此操作：

  ...
  import java.util.Hashtable;
  import javax.naming.Context;
  import javax.naming.InitialContext;
  ...
  // Perform an InitialContext and default lookup prior to logging 
  // in to initialize ORB security and for the bootstrap host/port 
  // to be determined for SecurityServer lookup. If you do not want 
  // to validate the userid/password during the JAAS login, disable 
  // the com.ibm.CORBA.validateBasicAuth property in the 
  // sas.client.props file.
  
  Hashtable env = new Hashtable();
  env.put(Context.INITIAL_CONTEXT_FACTORY, 
      "com.ibm.websphere.naming.WsnInitialContextFactory");
  env.put(Context.PROVIDER_URL, 
       "corbaloc:iiop:myhost.mycompany.com:2809");
  Context initialContext = new InitialContext(env);
  Object obj = initialContext.lookup("");
  

• 对于纯 Java 客户端应用程序或客户端容器应用程序，请确保正确指定目标 Java 命名和目录接口 (JNDI) 引导属性的主机名和端口号。 查看开发使用CosNaming（CORBA 命名接口）部分了解详情。
• 如果应用程序使用自定义JAAS登录配置，确保风俗JAAS登录配置已正确定义。
• 一些JAASAPI 受 Java 2 安全权限保护。 如果这些 API 由应用程序代码使用，请确保这些许可权添加到应用程序 was.policy 文件。 看添加was.policy文件到应用程序以实现 Java 2 安全性，使用PolicyTool编辑 Java 2 安全性的策略文件和配置was.policyJava 2 安全性文件部分了解详情。 有关哪些 API 受 Java 2 安全权限保护的详细信息，请查看IBM®开发工具包，Java 技术版；JAAS和WebSphere Application Server公共 API 文档以了解更多详细信息。 以下列表包含在此文档中提供的样本代码中所使用的 API。
  • 受 javax.security.auth.AuthPermission "createLoginContext" 保护的 javax.security.auth.login.LoginContext 构造函数。
  • 受 javax.security.auth.AuthPermission "doAs" 保护的 javax.security.auth.Subject.doAs 和 com.ibm.websphere.security.auth.WSSubject.doAs。
  • 受 javax.security.auth.AuthPermission "doAsPrivileged" 保护的 javax.security.auth.Subject.doAsPrivileged 和 com.ibm.websphere.security.auth.WSSubject.doAsPrivileged。
• com.ibm.websphere.security.auth.WSSubject：由于 JAAS 1.0 中的设计疏忽，javax.security.auth.Subject.getSubject 不返回与 java.security.AccessController.doPrivileged 代码块中正在运行的线程相关联的主体集。 这会产生有问题的不一致行为，并且要花费额外的精力来解决问题。 com.ibm.websphere.security.auth.WSSubject API 提供了使主体集与正在运行的线程相关联的变通方法。 这com.ibm.websphere.security.auth.WSSubject API 扩展了JAAS模型Java EE进行授权检查的资源。 与正在运行的线程关联的主题com.ibm.websphere.security.auth.WSSubject.doAs或者com.ibm.websphere.security.auth.WSSubject.doAsPrivileged代码块用于Java EE资源授权检查。
• 管理控制台支持定义新的JAAS登录配置：您可以配置JAAS管理控制台中的登录配置并将其存储在WebSphere Application Server配置 API。 应用程序可以定义新的JAAS管理控制台中的登录配置，数据保存在与WebSphere Application Server配置 API。 然而， WebSphere Application Server仍然支持默认JAAS登录配置格式由JAAS默认实现。 如果在两个文件中都定义了重复登录配置WebSphere Application Server配置 API 和纯文本文件格式，登录配置在WebSphere Application Server配置 API 优先。 在中定义登录配置的优点WebSphere Application Server配置API包括：
  • 使用管理控制台定义 JAAS 登录配置。
  • 可以集中管理 JAAS 登录配置。
• JAAS登录配置WebSphere Application Server： WebSphere Application Server提供JAAS应用程序登录配置，用于执行编程身份验证WebSphere Application Server安全运行时。 这些JAAS登录配置WebSphere Application Server根据配置的身份验证机制执行身份验证，简单WebSphere身份验证机制 (SWAM) 或轻量级第三方身份验证 (LTPA)，以及基于所提供的身份验证数据的用户注册表（本地操作系统、LDAP 或自定义）。 来自这些经过身份验证的主题JAAS登录配置包含所需的主体和凭据，可供WebSphere Application Server安全运行时执行授权检查Java EE基于角色的受保护资源。
  笔记： SWAM 已弃用WebSphere Application Server版本8.5并将在未来版本中被删除。
  这里有JAAS提供的登录配置WebSphere Application Server：
  • 网页登录JAAS登录配置：通用JAASJava 客户端、客户端容器应用程序、servlet、JSP 文件、企业 Bean 等可以使用登录配置来执行基于用户 ID 和密码的身份验证，或基于令牌的身份验证WebSphere Application Server安全运行时。 但是，此配置不支持在客户机容器部署描述符中指定的 CallbackHandler 处理程序。
  • ClientContainer JAAS 登录配置：此 JAAS 登录配置识别在客户机容器部署描述符中指定的 CallbackHandler 处理程序。 此登录配置的登录模块将使用客户机容器部署描述符中的 CallbackHandler 处理程序（如果指定了一个的话），即使应用程序代码在登录上下文中指定了一个 CallbackHandler 处理程序。 这适用于客户机容器应用程序。
  • 使用先前提到的 JAAS 登录配置认证的主体集包含 com.ibm.websphere.security.auth.WSPrincipal 主体和 com.ibm.websphere.security.auth.WSCredential 凭证。 如果经过身份验证的主题被传递给com.ibm.websphere.security.auth.WSSubject.doAs方法或其他doAs方法， WebSphere Application Server安全运行时可以执行授权检查Java EE资源，基于主题com.ibm.websphere.security.auth.WSCredential凭据。
• 客户定义JAAS登录配置：您可以定义其他JAAS登录配置。 使用这些登录配置来对定制认证机制执行程序化认证。 然而，这些客户定义的主题JAAS登录配置可能未被使用WebSphere Application Server如果主题不包含所需的主体和凭证，则安全运行时执行授权检查。

下面的 determineCause 示例可用于处理 CustomUserRegistry 异常类型。

try 
    {
         lc.login(); 
    } 
    catch (LoginException le)
    {
	// drill down through the exceptions as they might cascade through the runtime
	Throwable root_exception = determineCause(le);
	
	// now you can use "root_exception" to compare to a particular exception type
	// for example, if you have implemented a CustomUserRegistry type, you would 
  //  know what to look for here.
    }


/* Method used to drill down into the WSLoginFailedException to find the 
"root cause" exception */

    public Throwable determineCause(Throwable e) 
      {
				Throwable root_exception = e, temp_exception = null;

				// keep looping until there are no more embedded WSLoginFailedException or 
				// WSSecurityException exceptions 
         while (true) 
				{
						if (e instanceof com.ibm.websphere.security.auth.WSLoginFailedException)
						{
							temp_exception = ((com.ibm.websphere.security.auth.WSLoginFailedException)
							e).getCause();
						}
						else if (e instanceof com.ibm.websphere.security.WSSecurityException)
						{
							temp_exception = ((com.ibm.websphere.security.WSSecurityException)
							e).getCause();
						}
						else if (e instanceof javax.naming.NamingException)
								// check for Ldap embedded exception
								{
										temp_exception = ((javax.naming.NamingException)e).getRootCause();
								}
						else if (e instanceof your_custom_exception_here)
						{
								// your custom processing here, if necessary
						}
						else
						{
								// this exception is not one of the types we are looking for,
								// lets return now, this is the root from the WebSphere 
								//  Application Server perspective
								return root_exception;
						}
						if (temp_exception != null)
						{
								// we have an exception; go back and see if this has another
								// one embedded within it.
								root_exception = temp_exception;
								e = temp_exception;
								continue;
						}
						else
						{
								// we finally have the root exception from this call path, this
								// has to occur at some point
								return root_exception;
						}
				}
		}

您还会在处理 post-form 登录处理时接收到来自 Servlet 过滤器的根本原因异常。 此异常很有用，这是因为它会告诉用户发生的情况。 可以发出以下 API 以获取根本原因异常：

Throwable t = com.ibm.websphere.security.auth.WSSubject.getRootLoginException();  
if (t != null)  	
         t = determineCause(t);

WebSphere Application Server提供了一个非提示的实现javax.security.auth.callback.CallbackHandler接口，称为com.ibm.websphere.security.auth.callback.WSCallbackHandlerImpl。 使用此接口，应用程序可将认证数据推入 WebSphere LoginModule 实例以执行认证。 此功能对于服务器端应用程序代码验证身份以及使用该身份调用下游Java EE资源。

javax.security.auth.login.LoginContext lc = null;

try {
lc = new javax.security.auth.login.LoginContext("WSLogin",
new com.ibm.websphere.security.auth.callback.WSCallbackHandlerImpl("user", 
      "securityrealm", "securedpassword"));

// create a LoginContext and specify a CallbackHandler implementation
// CallbackHandler implementation determine how authentication data is collected
// in this case, the authentication data is "push" to the authentication mechanism
//   implemented by the LoginModule.
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: failed to instantiate a LoginContext and the exception: " 
+ e.getMessage());
e.printStackTrace();

// maybe javax.security.auth.AuthPermission "createLoginContext" is not granted
//   to the application, or the JAAS login configuration is not defined.
}

if (lc != null)
try {
lc.login();  // perform login
javax.security.auth.Subject s = lc.getSubject();
// get the authenticated subject

// Invoke a Java EE resource using the authenticated subject
com.ibm.websphere.security.auth.WSSubject.doAs(s,
new java.security.PrivilegedAction() {
public Object run() {
try {
bankAccount.deposit(100.00);  // where bankAccount is a protected EJB
} catch (Exception e) {
System.out.println("ERROR: error while accessing EJB resource, exception: " 
+ e.getMessage());
e.printStackTrace();
}
return null;
}
}
);
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: login failed with exception: " + e.getMessage());
e.printStackTrace();

// login failed, might want to provide relogin logic
}

WebSphere Application Server还提供了用户界面实现javax.security.auth.callback.CallbackHandler通过用户界面登录提示从用户收集身份验证数据的实现。 com.ibm.websphere.security.auth.callback.WSGUICallbackHandlerImpl 回调处理程序会提供一个用户界面登录面板，以提示用户输入认证数据。

javax.security.auth.login.LoginContext lc = null;

try {
lc = new javax.security.auth.login.LoginContext("WSLogin",
new com.ibm.websphere.security.auth.callback.WSGUICallbackHandlerImpl());

// create a LoginContext and specify a CallbackHandler implementation
// CallbackHandler implementation determine how authentication data is collected
// in this case, the authentication date is collected by GUI login prompt
//   and pass to the authentication mechanism implemented by the LoginModule.
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: failed to instantiate a LoginContext and the exception: " 
+ e.getMessage());
e.printStackTrace();

// maybe javax.security.auth.AuthPermission "createLoginContext" is not granted
//   to the application, or the JAAS login configuration is not defined.
}

if (lc != null)
try {
lc.login();  // perform login
javax.security.auth.Subject s = lc.getSubject();
// get the authenticated subject

// Invoke a Java EE resources using the authenticated subject
com.ibm.websphere.security.auth.WSSubject.doAs(s,
new java.security.PrivilegedAction() {
public Object run() {
try {
bankAccount.deposit(100.00);  // where bankAccount is a protected enterprise bean
} catch (Exception e) {
System.out.println("ERROR: error while accessing EJB resource, exception: " 
+ e.getMessage());
e.printStackTrace();
}
return null;
}
}
);
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: login failed with exception: " + e.getMessage());
e.printStackTrace();

// login failed, might want to provide relogin logic
}

如果 wsjaas_client.conf 文件中存在下列选项，请将它们设置为 false：

javax.security.auth.login.LoginContext lc = null;

String krb5Ccache = /etc/krb5/krb5cc_utle;

try {
lc = new javax.security.auth.login.LoginContext("WSKRB5Login",
new com.ibm.websphere.security.auth.callback.WSCcacheCallBackHandlerImpl(user, krb5Realm, krb5Ccache, false));
// create a LoginContext and specify a CallbackHandler implementation
// CallbackHandler implementation determines how authentication data is collected
// in this case, the authentication date is collected by stdin prompt
// and passed to the authentication mechanism implemented by the LoginModule.
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: failed to instantiate a LoginContext and the exception: 
          " + e.getMessage());
e.printStackTrace();

// maybe javax.security.auth.AuthPermission "createLoginContext" is not granted
//   to the application, or the JAAS login configuration is not defined.
}

if (lc != null)
try {
lc.login();  // perform login
javax.security.auth.Subject s = lc.getSubject();
// get the authenticated subject

// Invoke a Java EE resource using the authenticated subject
com.ibm.websphere.security.auth.WSSubject.doAs(s,
new java.security.PrivilegedAction() {
public Object run() {
try {
bankAccount.deposit(100.00);  
// where bankAccount is a protected enterprise bean
} catch (Exception e) {
System.out.println("ERROR: error while accessing EJB resource, exception: " 
       + e.getMessage());
e.printStackTrace();
}
return null;
}
}
);
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: login failed with exception: " + e.getMessage());
e.printStackTrace();

// login failed, might want to provide relogin logic
}

Application Server with the default Kerberos credential cache.

javax.security.auth.login.LoginContext lc = null;

try {
lc = new javax.security.auth.login.LoginContext("WSKRB5Login",
new com.ibm.websphere.security.auth.callback.WSCcacheCallBackHandlerImpl(user, krb5Realm, null, true));
// create a LoginContext and specify a CallbackHandler implementation
// CallbackHandler implementation determines how authentication data is collected
// in this case, the authentication date is collected by stdin prompt
// and passed to the authentication mechanism implemented by the LoginModule.
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: failed to instantiate a LoginContext and the exception: 
          " + e.getMessage());
e.printStackTrace();

// maybe javax.security.auth.AuthPermission "createLoginContext" is not granted
//   to the application, or the JAAS login configuration is not defined.
}

if (lc != null)
try {
lc.login();  // perform login
javax.security.auth.Subject s = lc.getSubject();
// get the authenticated subject

// Invoke a Java EE resource using the authenticated subject
com.ibm.websphere.security.auth.WSSubject.doAs(s,
new java.security.PrivilegedAction() {
public Object run() {
try {
bankAccount.deposit(100.00);  
// where bankAccount is a protected enterprise bean
} catch (Exception e) {
System.out.println("ERROR: error while accessing EJB resource, exception: " 
       + e.getMessage());
e.printStackTrace();
}
return null;
}
}
);
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: login failed with exception: " + e.getMessage());
e.printStackTrace();

// login failed, might want to provide relogin logic
}

Application Server with the Microsoft native Kerberos credential cache. The client must
login to the Microsoft Domain Controller.

javax.security.auth.login.LoginContext lc = null;

try {
lc = new javax.security.auth.login.LoginContext("WSKRB5Login",
new com.ibm.websphere.security.auth.callback.WSCcacheCallBackHandlerImpl(null, null, null, true));
// create a LoginContext and specify a CallbackHandler implementation
// CallbackHandler implementation determines how authentication data is collected
// in this case, the authentication date is collected by stdin prompt
// and passed to the authentication mechanism implemented by the LoginModule.
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: failed to instantiate a LoginContext and the exception: 
          " + e.getMessage());
e.printStackTrace();

// maybe javax.security.auth.AuthPermission "createLoginContext" is not granted
//   to the application, or the JAAS login configuration is not defined.
}

if (lc != null)
try {
lc.login();  // perform login
javax.security.auth.Subject s = lc.getSubject();
// get the authenticated subject

// Invoke a Java EE resource using the authenticated subject
com.ibm.websphere.security.auth.WSSubject.doAs(s,
new java.security.PrivilegedAction() {
public Object run() {
try {
bankAccount.deposit(100.00);  
// where bankAccount is a protected enterprise bean
} catch (Exception e) {
System.out.println("ERROR: error while accessing EJB resource, exception: " 
       + e.getMessage());
e.printStackTrace();
}
return null;
}
}
);
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: login failed with exception: " + e.getMessage());
e.printStackTrace();

// login failed, might want to provide relogin logic
}

WebSphere Application Server还提供了javax.security.auth.callback.CallbackHandler界面。 回调处理程序 com.ibm.websphere.security.auth.callback.WSStdinCallbackHandlerImpl 通过 stdin 提示来提示用户输入认证数据和搜集认证数据。

javax.security.auth.login.LoginContext lc = null;

try {
lc = new javax.security.auth.login.LoginContext("WSLogin",
new com.ibm.websphere.security.auth.callback.WSStdinCallbackHandlerImpl());

// create a LoginContext and specify a CallbackHandler implementation
// CallbackHandler implementation determines how authentication data is collected
// in this case, the authentication date is collected by stdin prompt
// and passed to the authentication mechanism implemented by the LoginModule.
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: failed to instantiate a LoginContext and the exception: 
          " + e.getMessage());
e.printStackTrace();

// maybe javax.security.auth.AuthPermission "createLoginContext" is not granted
//   to the application, or the JAAS login configuration is not defined.
}

if (lc != null)
try {
lc.login();  // perform login
javax.security.auth.Subject s = lc.getSubject();
// get the authenticated subject

// Invoke a Java EE resource using the authenticated subject
com.ibm.websphere.security.auth.WSSubject.doAs(s,
new java.security.PrivilegedAction() {
public Object run() {
try {
bankAccount.deposit(100.00);  
// where bankAccount is a protected enterprise bean
} catch (Exception e) {
System.out.println("ERROR: error while accessing EJB resource, exception: " 
       + e.getMessage());
e.printStackTrace();
}
return null;
}
}
);
} catch (javax.security.auth.login.LoginException e) {
System.err.println("ERROR: login failed with exception: " + e.getMessage());
e.printStackTrace();

// login failed, might want to provide relogin logic
}