1.5. 创建 JAAS 域

流程

1. 在 CLI 中使用 mvn 命令来建立一个 Maven 项目。此命令为项目创建目录结构，以及 pom.xml 配置文件。

   语法

   $ mvn archetype:generate \
   -DgroupId=<group-to-which-your-application-belongs> \
   -DartifactId=<name-of-your-application> \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-simple \
   -DinteractiveMode=false

   Copy to Clipboard Toggle word wrap

   Example

   $ mvn archetype:generate \
   -DgroupId=com.example.loginmodule \
   -DartifactId=example-custom-login-module \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-simple \
   -DinteractiveMode=false

   Copy to Clipboard Toggle word wrap

2. 导航到应用程序根目录。

   语法

   $ cd <name-of-your-application>

   Copy to Clipboard Toggle word wrap

   Example

   $ cd example-custom-login-module

   Copy to Clipboard Toggle word wrap

3. 将生成的 pom.xml 文件的内容替换为以下文本：

   <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
       <modelVersion>4.0.0</modelVersion>
   
       <groupId>custom.loginmodules</groupId>
       <artifactId>custom-login-modules</artifactId>
       <version>1.0</version>
       <dependencies>
           <dependency>
               <groupId>org.wildfly.security</groupId>
               <artifactId>wildfly-elytron</artifactId>
               <version>1.17.2.Final</version>
           </dependency>
           <dependency>
               <groupId>jakarta.security.enterprise</groupId>
               <artifactId>jakarta.security.enterprise-api</artifactId>
               <version>3.0.0</version>
           </dependency>
       </dependencies>
   
       <properties>
           <maven.compiler.source>11</maven.compiler.source>
           <maven.compiler.target>11</maven.compiler.target>
       </properties>
   
   </project>

   Copy to Clipboard Toggle word wrap

4. 删除目录 site 和 test，因为本例不需要它们。

   $ rm -rf src/site/
   $ rm -rf src/test/

   Copy to Clipboard Toggle word wrap

流程

1. 创建一个用于存储 Java 文件的目录。

   语法

   $ mkdir -p src/main/java/<path_based_on_artifactID>

   Copy to Clipboard Toggle word wrap

   Example

   $ mkdir -p src/main/java/com/example/loginmodule

   Copy to Clipboard Toggle word wrap

2. 导航到包含源文件的目录。

   语法

   $ cd src/main/java/<path_based_on_groupID>

   Copy to Clipboard Toggle word wrap

   Example

   $ cd src/main/java/com/example/loginmodule

   Copy to Clipboard Toggle word wrap

3. 删除生成的文件 App.java。

   $ rm App.java

   Copy to Clipboard Toggle word wrap

4. 为自定义登录模块源创建一个文件 ExampleCustomLoginModule.java。

   package com.example.loginmodule;
   
   import org.wildfly.security.auth.principal.NamePrincipal;
   
   import javax.security.auth.Subject;
   import javax.security.auth.callback.Callback;
   import javax.security.auth.callback.CallbackHandler;
   import javax.security.auth.callback.NameCallback;
   import javax.security.auth.callback.PasswordCallback;
   import javax.security.auth.callback.UnsupportedCallbackException;
   import javax.security.auth.login.LoginException;
   import javax.security.auth.spi.LoginModule;
   import java.io.IOException;
   import java.security.Principal;
   import java.util.Arrays;
   import java.util.HashMap;
   import java.util.Map;
   
   
   public class ExampleCustomLoginModule implements LoginModule {
   
       private final Map<String, char[]> usersMap = new HashMap<String, char[]>();
       private Principal principal;
       private Subject subject;
       private CallbackHandler handler;
   
       /**
        * In this example, identities are created as fixed Strings.
        *
        * The identities are:
        *    user1 has the password passwordUser1
        *    user2 has the password passwordUser2
        *
        * Use these credentials when you secure management interfaces
        * or applications with this login module.
        *
        * In a production login module, you would get the identities
        * from a data source.
        *
        */
   
       @Override
       public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
           this.subject = subject;
           this.handler = callbackHandler;
           this.usersMap.put("user1", "passwordUser1".toCharArray());
           this.usersMap.put("user2", "passwordUser2".toCharArray());
       }
   
       @Override
       public boolean login() throws LoginException {
           // obtain the incoming username and password from the callback handler
           NameCallback nameCallback = new NameCallback("Username");
           PasswordCallback passwordCallback = new PasswordCallback("Password", false);
           Callback[] callbacks = new Callback[]{nameCallback, passwordCallback};
           try {
               this.handler.handle(callbacks);
           } catch (UnsupportedCallbackException | IOException e) {
               throw new LoginException("Error handling callback: " + e.getMessage());
           }
   
           final String username = nameCallback.getName();
           this.principal = new NamePrincipal(username);
           final char[] password = passwordCallback.getPassword();
   
           char[] storedPassword = this.usersMap.get(username);
           if (!Arrays.equals(storedPassword, password)) {
               throw new LoginException("Invalid password");
           } else {
               return true;
           }
       }
   
       /**
        * user1 is assigned the roles Admin, User and Guest.
        * In a production login module, you would get the identities
        * from a data source.
        *
        */
   
       @Override
       public boolean commit() throws LoginException {
           if (this.principal.getName().equals("user1")) {
               this.subject.getPrincipals().add(new Roles("Admin"));
               this.subject.getPrincipals().add(new Roles("User"));
               this.subject.getPrincipals().add(new Roles("Guest"));
           }
           return true;
       }
   
       @Override
       public boolean abort() throws LoginException {
           return true;
       }
   
       @Override
       public boolean logout() throws LoginException {
           this.subject.getPrincipals().clear();
           return true;
       }
   
       /**
       * Principal with simple classname 'Roles' will be mapped to the identity's attribute with name 'Roles'.
       */
   
       private static class Roles implements Principal {
   
           private final String name;
   
           Roles(final String name) {
               this.name = name;
           }
   
           /**
            * @return name of the principal. This will be added as a value to the identity's attribute which has a name equal to the simple name of this class. In this example, this value will be added to the attribute with a name 'Roles'.
           */
   
           public String getName() {
               return this.name;
           }
       }
   }

   Copy to Clipboard Toggle word wrap

5. 在 <application_home> 目录中创建 JAAS 配置文件 JAAS-login-modules.conf。

   exampleConfiguration {
   	com.example.loginmodule.ExampleCustomLoginModule optional;
   };

   Copy to Clipboard Toggle word wrap
   • exampleConfiguration 是条目名称。
   • com.example.loginmodule.ExampleCustomLoginModule 是登录模块。
   • optional 是标志。

6. 编译登录模块。

   $ mvn package
   ...
   [INFO] ------------------------------------------------------------------------
   [INFO] BUILD SUCCESS
   [INFO] ------------------------------------------------------------------------
   [INFO] Total time: 1.321 s
   [INFO] Finished at: 2022-04-28T14:16:03+05:30
   [INFO] ------------------------------------------------------------------------

   Copy to Clipboard Toggle word wrap