第 6 章 安​全​性​

过程 6.3. 启​用​基​于​角​色​的​授​权​

1. 分​配​管​理​员​权​限​给​用​户​

   在​启​用​基​于​角​色​的​授​权​之​前​，我​们​有​必​要​为​至​少​一​个​信​任​的​用​户​分​配​管​理​员​角​色​。​
   详​情​请​参​考​『​过程 6.5, “管​理​用​户​权​限​”』​。​

2. 关​闭​应​用​服​务​器​

   在​进​行​这​些​修​改​前​关​闭​应​用​服​务​器​。​

3. 打​开​ components.xml

   在​文​本​编​辑​器​里​打​开​ jboss-as-web/server/PROFILE/deploy/jboss-brms.war/WEB-INF/components.xml 文​件​。​

4. 找​到​ <property name="enableRoleBasedAuthorization"> 元​素​

   在​缺​省​的​ components.xml 文​件​里​，这​个​ XML 元​素​是​ <components> 的​子​元​素​。​

   <component name="org.jboss.seam.security.roleBasedPermissionResolver">
      <property name="enableRoleBasedAuthorization">false</property>
   </component>
   

   Copy to Clipboard Toggle word wrap

   注意

   在​ 5.1 和​更​早​的​版​本​里​，找​到​下​列​ XML

   <security:role-based-permission-resolver 
       enable-role-based-authorization="false"/>
   

   Copy to Clipboard Toggle word wrap

5. 更​新​属​性​值​为​ "True"

   更​新​ enable-role-based-authorization 属​性​为​ true 并​保​存​文​件​。​

   <component name="org.jboss.seam.security.roleBasedPermissionResolver">
      <property name="enableRoleBasedAuthorization">true</property>
   </component>
   

   Copy to Clipboard Toggle word wrap

   注意

   在​ 5.1 和​更​早​的​版​本​里​，找​到​下​列​ XML

   <security:role-based-permission-resolver 
       enable-role-based-authorization="true"/>
   

   Copy to Clipboard Toggle word wrap

6. 重​新​启​动​

   重​启​应​用​服​务​器​

过程 6.4. 添​加​新​用​户​到​ BRMS 里​

1. 选​择​权​限​细​节​

   从​ navigation pane 里​选​择​ Administration，然​后​选​择​ User Permissions。​

2. 添​加​用​户​映​射​

   点​击​ Create new user mapping 按​钮​。​在​对​话​框​里​输​入​用​户​名​，并​点​击​ OK。​

   注意

   为​该​角​色​指​定​的​用​户​名​必​须​匹​配​验​证​服​务​里​的​一​个​用​户​名​，否​则​它​无​法​使​用​。​

3. 添​加​权​限​

   详​情​请​参​考​『​过程 6.5, “管​理​用​户​权​限​”』​。​

过程 6.5. 管​理​用​户​权​限​

1. 选​择​用​户​权​限​

   从​ navigation pane 里​选​择​ Administration，然​后​选​择​ User Permissions。​

2. 选​择​用​户​

   点​击​用​户​名​旁​边​的​ Open
   

   View larger image

   

   图 6.2. 权​限​细​节​

3. 分​配​用​户​权​限​

   点​击​加​号​图​标​来​添​加​权​限​，然​后​从​ Permission type 下​列​菜​单​里​选​择​合​适​的​权​限​。​点​击​ OK 进​行​确​认​。​
   

   View larger image

   

   图 6.3. 编​辑​用​户​权​限​

4. 删​除​用​户​权​限​

   点​击​要​删​除​的​权​限​旁​边​的​减​号​图​标​，然​后​点​击​ OK 来​确​认​。​

过程 6.6. 配​置​规​则​软​件​包​签​名​

1. 创​建​私​有​密​钥​

   使​用​ keytool 创​建​私​有​密​钥​：

   keytool -genkey -alias ALIAS -keyalg RSA -keystore PRIVATE.keystore

   Copy to Clipboard Toggle word wrap
   -alias 参​数​指​定​了​用​来​链​接​密​钥​库​里​相​关​实​体​的​名​称​。​对​于​每​个​步​骤​都​使​用​相​同​的​别​名​。​别​名​是​不​区​分​大​小​写​的​。​-keystore 提​供​了​将​被​创​建​以​保​存​私​有​密​钥​的​文​件​的​名​称​。​
   keytool 将​提​示​你​确​定​一​些​信​息​以​及​两​个​密​码​。​第​一​个​密​码​是​密​钥​库​密​码​。​第​二​个​密​码​是​密​钥​密​码​，用​于​正​创​建​的​密​钥​。​

   [localhost ]$ keytool -genkey -alias BRMSKey -keyalg RSA -keystore PrivateBRMS.keystore
   Enter keystore password:  
   Re-enter new password: 
   What is your first and last name?
      [Unknown]:  John Smith
   What is the name of your organizational unit?
      [Unknown]:  Accounts
   What is the name of your organization?
      [Unknown]:  ACME INC
   What is the name of your City or Locality?
      [Unknown]:  Captital City
   What is the name of your State or Province?
      [Unknown]:  CC
   What is the two-letter country code for this unit?
      [Unknown]:  US
   Is CN=John Smith, OU=Accounts, O=ACME INC, L=Captial City, ST=CC, C=US correct?
      [no]:  yes
   Enter key password for <BRMSKey>
      (RETURN if same as keystore password):  
   Re-enter new password:
   

   Copy to Clipboard Toggle word wrap

2. 创​建​数​字​证​书​

   使​用​ keytool 创​建​数​字​证​书​：

   keytool -export -alias ALIAS -file CERTIFICATE.crt -keystore PRIVATE.keystore

   Copy to Clipboard Toggle word wrap
   使​用​和​前​一​步​骤​相​同​的​别​名​和​密​钥​库​。​-file 参​数​指​定​要​创​建​的​新​证​书​的​名​称​。​-keystore 参​数​指​定​私​有​密​钥​库​的​文​件​名​。​
   在​提​示​符​后​输​入​密​钥​库​的​密​码​。​

   [localhost ]$ keytool -export -alias BRMSKey -file BRMSKey.crt -keystore PrivateBRMS.keystore
   Enter keystore password:  
   Certificate stored in file <BRMSKey.crt>

   Copy to Clipboard Toggle word wrap

3. 将​数​字​证​书​导​入​到​信​任​库​

   使​用​ keytool 命​令​将​数​字​证​书​导​入​到​密​钥​库​里​：

   keytool -import -alias ALIAS -file CERTIFICATE.crt -keystore PUBLIC.keystore

   Copy to Clipboard Toggle word wrap
   这​会​创​建​一​个​新​的​密​钥​库​和​包​含​数​字​证​书​的​信​任​库​。​信​任​库​使​数​字​证​书​可​为​客​户​端​应​用​程​序​所​用​。​

   [localhost ]$ keytool -import -alias BRMSKey -file BRMSKey.crt -keystore PublicBRMS.keystore
   Enter keystore password:  
   Re-enter new password: 
   Owner: CN=John Smith, OU=Accounts, O=ACME INC, L=Captial City, ST=CC, C=US
   Issuer: CN=John Smith, OU=Accounts, O=ACME INC, L=Captial City, ST=CC, C=US
   Serial number: 4ca0021b
   Valid from: Sun Sep 26 22:31:55 EDT 2010 until: Sat Dec 25 21:31:55 EST 2010
   Certificate fingerprints:
      MD5:  31:1D:1B:98:59:CC:0E:3C:3F:57:01:C2:FE:F2:6D:C9
      SHA1: 4C:26:52:CA:0A:92:CC:7A:86:04:50:53:80:94:2A:4F:82:6F:53:AD
      Signature algorithm name: SHA1withRSA
      Version: 3
   Trust this certificate? [no]:  yes
   Certificate was added to keystore

   Copy to Clipboard Toggle word wrap

4. 将​私​有​密​钥​库​移​至​安​全​位​置​

   私​有​密​钥​库​需​要​保​存​在​只​有​ JBoss 企​业​级​ BRMS 平​台​服​务​器​能​够​访​问​的​安​全​位​置​。​它​可​以​在​相​同​的​机​器​或​是​安​全​的​网​络​位​置​上​。​

   重要

   JBoss 企​业​级​ BRMS 平​台​不​能​为​网​络​资​源​提​供​验​证​凭​证​。​如​果​私​有​密​钥​库​保​存​在​安​全​的​网​络​位​置​，那​么​任​何​验​证​过​程​都​必​须​代​替​ JBoss 企​业​级​ BRMS 平​台​服​务​器​来​执​行​，从​而​使​得​私​有​密​钥​库​为​之​所​用​。​例​如​，操​作​系​统​可​以​验​证​并​挂​载​一​个​保​存​私​有​密​钥​库​的​共​享​文​件​为​本​地​目​录​，以​供​ JBoss 企​业​级​ BRMS 平​台​服​务​器​进​行​访​问​。​

5. 将​信​任​库​移​至​公​共​位​置​

   信​任​库​需​要​可​被​客​户​端​应​用​程​序​访​问​。​这​可​以​通​过​把​信​任​库​放​在​网​络​共​享​或​ web 服​务​器​上​来​实​现​。​

6. 设​置​ Drools 序​列​化​属​性​

   你​需​要​在​服​务​器​上​设​置​ Drools 序​列​化​系​统​属​性​。​这​是​存​储​访​问​密​钥​库​所​需​信​息​的​属​性​。​因​为​ JBoss 企​业​级​ BRMS 平​台​也​包​含​客​户​组​件​，所​以​私​有​密​钥​库​和​信​任​库​属​性​都​需​要​进​行​设​置​。​
   关​于​在​哪​里​设​置​这​些​属​性​的​细​节​，请​参​考​『​第 6.3.1 节 “设​置​序​列​化​属​性​”』​。​
   需​要​设​置​的​属​性​是​：
   • drools.serialization.sign - 指​定​是​否​启​用​签​名​。​它​必​须​为​ true。​
   • drools.serialization.private.keyStoreURL - 私​有​密​钥​库​所​在​的​ URL
   • drools.serialization.private.keyStorePwd - 信​任​库​的​密​码​
   • drools.serialization.private.keyAlias - 创​建​密​钥​库​时​使​用​的​别​名​
   • drools.serialization.private.keyPwd - 密​钥​密​码​
   • drools.serialization.public.keyStoreURL - 信​任​库​所​在​的​ URL
   • drools.serialization.public.keyStorePwd - 信​任​库​的​密​码​

7. 加​密​密​钥​库​凭​证​

   密​钥​库​密​码​目​前​是​以​明​文​进​行​存​储​的​。​
   关​于​加​密​密​钥​库​凭​证​的​说​明​，请​参​考​『​https://access.redhat.com/kb/docs/DOC-47247』​。​