david.turing 2007-09-04 15:20 发表评论
]]>Before you read this paper, please read another blog of mine( but not
necessary).
<
http://www.aygfsteel.com/security/archive/2007/01/07/WeblogicClusterWithApacheProxyUnderSSL.html 阅读全文
david.turing 2007-01-13 19:19 发表评论
]]>david.turing 2007-01-07 14:34 发表评论
]]>david.turing 2007-01-07 11:16 发表评论
]]>david.turing 2006-11-13 11:06 发表评论
]]>david.turing 2006-11-11 13:56 发表评论
]]>david.turing 2006-11-08 16:45 发表评论
]]>david.turing 2006-10-15 23:53 发表评论
]]>david.turing 2006-10-02 16:27 发表评论
]]>david.turing 2006-09-26 17:33 发表评论
]]>david.turing 2006-09-21 00:39 发表评论
]]>david.turing 2006-08-08 09:09 发表评论
]]>回到SpringSideQ我大概介绍一下如何配|一个真正实用的XFire验证服务?br />SpringSide中的XFire配置文g攑֜Q?br />SpringSide-bookstore\src\org\springside\bookstore\plugins\webservice\applicationContext-webservice-server.xml
我们在里面定义各个WebserviceQ该文g其实对应于XFire官方的XFire-Servlet.xml
看看下面的BookServiceQ这是一个典型的Webservice服务Q红色的inHandlers是我挂上ȝ。它的意思是所有访问BookService的请求都会被先送到authenticationHandlerd理，我们的验证逻辑可以在里面进行?br /> <!--Web Service 在SpringMVC中的URL 路径映射-->
<bean class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
<property name="mappings">
<value>/BookService=bookWebService</value>
</property>
<property name="inHandlers">
<ref bean="authenticationHandler"/>
</property>
</bean>
我们接着看看authenticationHandler的代码：
我们在SpringSide中通过header方式向服务器提供验证信息Q另外一U更单的方式是创Z个Login的webservice服务Q然后在XFire Session中徏立Token信息Q?br />
package org.springside.bookstore.plugins.webservice.authentication;
import org.apache.log4j.Logger;
import org.codehaus.xfire.MessageContext;
import org.codehaus.xfire.exchange.InMessage;
import org.codehaus.xfire.fault.XFireFault;
import org.codehaus.xfire.handler.AbstractHandler;
import org.jdom.Element;
import org.jdom.Namespace;
/**
* XFire的回调的HandlerQ在XFire配置文g中配|?br /> * Server端的认证模块Q回调处理模?br /> *
* ClientAuthHandler跟AuthenticationHandler要一LQ或者都不用
*
* @author david.turing
* @blog openssl.blogjava.net
*
*/
public class AuthenticationHandler extends AbstractHandler {
private static final Logger log = Logger.getLogger(AuthenticationHandler.class);
public void invoke(MessageContext context) throws Exception {
log.info("#AuthenticationHandler is invoked");
InMessage message=context.getInMessage();
final Namespace TOKEN_NS = Namespace.getNamespace("SpringSide","http://service.webservice.plugins.bookstore.springside.org");
if(message.getHeader()==null)
{
throw new XFireFault("GetRelation Service Should be Authenticated",
XFireFault.SENDER);
}
Element token = message.getHeader().getChild("AuthenticationToken", TOKEN_NS);
if (token == null)
{
throw new XFireFault("Request must include authentication token.",
XFireFault.SENDER);
}
String username = token.getChild("Username", TOKEN_NS).getValue();
String password = token.getChild("Password", TOKEN_NS).getValue();
System.out.println("username="+username);
System.out.println("password="+password);
if(username==null||password==null)
throw new XFireFault("Supplied Username and Password Please",
XFireFault.SENDER);
/**
* 查用户名密码是否正确
*/
PasswordAuthenticationManager pamanager=new PasswordAuthenticationManager();
if(!pamanager.authenticate(username,password))
throw new XFireFault("Authentication Fail! Check username/password",
XFireFault.SENDER);
}
}
注意QXFireFault异常是往客户端抛的，Webservice Client应该学会catch XFireFault.import org.apache.log4j.Logger;
import org.codehaus.xfire.MessageContext;
import org.codehaus.xfire.exchange.InMessage;
import org.codehaus.xfire.fault.XFireFault;
import org.codehaus.xfire.handler.AbstractHandler;
import org.jdom.Element;
import org.jdom.Namespace;
/**
* XFire的回调的HandlerQ在XFire配置文g中配|?br /> * Server端的认证模块Q回调处理模?br /> *
* ClientAuthHandler跟AuthenticationHandler要一LQ或者都不用
*
* @author david.turing
* @blog openssl.blogjava.net
*
*/
public class AuthenticationHandler extends AbstractHandler {
private static final Logger log = Logger.getLogger(AuthenticationHandler.class);
public void invoke(MessageContext context) throws Exception {
log.info("#AuthenticationHandler is invoked");
InMessage message=context.getInMessage();
final Namespace TOKEN_NS = Namespace.getNamespace("SpringSide","http://service.webservice.plugins.bookstore.springside.org");
if(message.getHeader()==null)
{
throw new XFireFault("GetRelation Service Should be Authenticated",
XFireFault.SENDER);
}
Element token = message.getHeader().getChild("AuthenticationToken", TOKEN_NS);
if (token == null)
{
throw new XFireFault("Request must include authentication token.",
XFireFault.SENDER);
}
String username = token.getChild("Username", TOKEN_NS).getValue();
String password = token.getChild("Password", TOKEN_NS).getValue();
System.out.println("username="+username);
System.out.println("password="+password);
if(username==null||password==null)
throw new XFireFault("Supplied Username and Password Please",
XFireFault.SENDER);
/**
* 查用户名密码是否正确
*/
PasswordAuthenticationManager pamanager=new PasswordAuthenticationManager();
if(!pamanager.authenticate(username,password))
throw new XFireFault("Authentication Fail! Check username/password",
XFireFault.SENDER);
}
}
服务器端是q么单，看看客户端的TestCase
package org.springside.bookstore.plugins.webservice.service;
import java.lang.reflect.Proxy;
import java.net.MalformedURLException;
import java.util.List;
import org.codehaus.xfire.client.Client;
import org.codehaus.xfire.client.XFireProxy;
import org.codehaus.xfire.client.XFireProxyFactory;
import org.codehaus.xfire.service.Service;
import org.codehaus.xfire.service.binding.ObjectServiceFactory;
import org.springside.bookstore.commons.domain.Book;
import org.springside.bookstore.plugins.webservice.authentication.ClientAuthHandler;
import junit.framework.TestCase;
public class BookServiceWithAuthenticationTestCase extends TestCase {
protected void setUp() throws Exception {
super.setUp();
}
protected void tearDown() throws Exception {
super.tearDown();
}
public void getBookFromWebservice() throws Exception{
Service serviceModel = new ObjectServiceFactory()
.create(BookService.class);
BookService service = null;
try {
service=(BookService) new XFireProxyFactory().create(
serviceModel,
"http://localhost:8080/springside/service/BookService");
} catch (MalformedURLException e) {
e.printStackTrace();
}
Client client = ((XFireProxy) Proxy.getInvocationHandler(service)).getClient();
//挂上ClientAuthHandlerQ提供认?/span>
client.addOutHandler(new ClientAuthHandler());
List list = service.findBooksByCategory(null);
assertNotNull(list);
for(int i=0;i<list.size();i++)
System.out.println(((Book)list.get(i)).getName());
}
}
import java.lang.reflect.Proxy;
import java.net.MalformedURLException;
import java.util.List;
import org.codehaus.xfire.client.Client;
import org.codehaus.xfire.client.XFireProxy;
import org.codehaus.xfire.client.XFireProxyFactory;
import org.codehaus.xfire.service.Service;
import org.codehaus.xfire.service.binding.ObjectServiceFactory;
import org.springside.bookstore.commons.domain.Book;
import org.springside.bookstore.plugins.webservice.authentication.ClientAuthHandler;
import junit.framework.TestCase;
public class BookServiceWithAuthenticationTestCase extends TestCase {
protected void setUp() throws Exception {
super.setUp();
}
protected void tearDown() throws Exception {
super.tearDown();
}
public void getBookFromWebservice() throws Exception{
Service serviceModel = new ObjectServiceFactory()
.create(BookService.class);
BookService service = null;
try {
service=(BookService) new XFireProxyFactory().create(
serviceModel,
"http://localhost:8080/springside/service/BookService");
} catch (MalformedURLException e) {
e.printStackTrace();
}
Client client = ((XFireProxy) Proxy.getInvocationHandler(service)).getClient();
//挂上ClientAuthHandlerQ提供认?/span>
client.addOutHandler(new ClientAuthHandler());
List list = service.findBooksByCategory(null);
assertNotNull(list);
for(int i=0;i<list.size();i++)
System.out.println(((Book)list.get(i)).getName());
}
}
你应该看C面的client.addOutHandler(new ClientAuthHandler());
没错Q它跟服务器端的AuthenticationHandler是一对，一起用的Q?br />也就是，每个被送往WebService服务的请求都被ClientAuthHandler处理q了?br />看看ClientAuthHandler做了些什么：
package org.springside.bookstore.plugins.webservice.authentication;
import org.apache.log4j.Logger;
import org.codehaus.xfire.MessageContext;
import org.codehaus.xfire.handler.AbstractHandler;
import org.jdom.Element;
import org.jdom.Namespace;
/**
* 客户端端的认证模块，回调处理模块
* 每个需要认证的WebServiceҎ都可以挂q个Handler
*
* 仅用于DemoQ从解耦和易用性出发，
* 没有跟Acegil合Q你可以L扩展
* 默认用户?密码是admin/admin
*
* ClientAuthHandler跟AuthenticationHandler要一LQ或者都不用
*
* @author david.turing
*
* @blog openssl.blogjava.net
*/
public class ClientAuthHandler extends AbstractHandler {
private static final Logger log = Logger.getLogger(ClientAuthHandler.class);
//客户端自己配|用户名密码或者更安全的KeyStore方式
private String username = "admin";
private String password = "admin";
public ClientAuthHandler() {
}
public ClientAuthHandler(String username,String password) {
this.username = username;
this.password = password;
}
public void setUsername(String username) {
this.username = username;
}
public void setPassword(String password) {
this.password = password;
}
public void invoke(MessageContext context) throws Exception {
/*******************************************
* Soap Header方式
* 从Soap Header中获取用户名密码
*******************************************/
final Namespace ns = Namespace.getNamespace("SpringSide","http://service.webservice.plugins.bookstore.springside.org");
Element el = new Element("header",ns);
Element auth = new Element("AuthenticationToken", ns);
Element username_el = new Element("Username",ns);
username_el.addContent(username);
Element password_el = new Element("Password",ns);
password_el.addContent(password);
auth.addContent(username_el);
auth.addContent(password_el);
el.addContent(auth);
context.getCurrentMessage().setHeader(el);
log.info("ClientAuthHandler done!");
}
}
import org.apache.log4j.Logger;
import org.codehaus.xfire.MessageContext;
import org.codehaus.xfire.handler.AbstractHandler;
import org.jdom.Element;
import org.jdom.Namespace;
/**
* 客户端端的认证模块，回调处理模块
* 每个需要认证的WebServiceҎ都可以挂q个Handler
*
* 仅用于DemoQ从解耦和易用性出发，
* 没有跟Acegil合Q你可以L扩展
* 默认用户?密码是admin/admin
*
* ClientAuthHandler跟AuthenticationHandler要一LQ或者都不用
*
* @author david.turing
*
* @blog openssl.blogjava.net
*/
public class ClientAuthHandler extends AbstractHandler {
private static final Logger log = Logger.getLogger(ClientAuthHandler.class);
//客户端自己配|用户名密码或者更安全的KeyStore方式
private String username = "admin";
private String password = "admin";
public ClientAuthHandler() {
}
public ClientAuthHandler(String username,String password) {
this.username = username;
this.password = password;
}
public void setUsername(String username) {
this.username = username;
}
public void setPassword(String password) {
this.password = password;
}
public void invoke(MessageContext context) throws Exception {
/*******************************************
* Soap Header方式
* 从Soap Header中获取用户名密码
*******************************************/
final Namespace ns = Namespace.getNamespace("SpringSide","http://service.webservice.plugins.bookstore.springside.org");
Element el = new Element("header",ns);
Element auth = new Element("AuthenticationToken", ns);
Element username_el = new Element("Username",ns);
username_el.addContent(username);
Element password_el = new Element("Password",ns);
password_el.addContent(password);
auth.addContent(username_el);
auth.addContent(password_el);
el.addContent(auth);
context.getCurrentMessage().setHeader(el);
log.info("ClientAuthHandler done!");
}
}
不就是往header里面注入username,passwordQ?br />
在SpringSide中，所有的Spring配置文g都被白分散到各个Module中去了，Wuyu原先是在Plugin中提供Webservice功能Q因此，我仍然在Plugin中创建XFire接口?br />SpringSide的Spring配置文g攑֜:
SpringSide-bookstore\webapp\WEB-INF\springmvc-servlet.xml
该文件定义了Plugin的xml:
AuthenticationHandlerq个Bean需要先定义在Plugins-servlet.xml中，其它很简单，大家去Try一下就知道了?img src ="http://www.aygfsteel.com/security/aggbug/60090.html" width = "1" height = "1" />
david.turing 2006-07-25 23:48 发表评论
]]>david.turing 2006-07-11 13:24 发表评论
]]>david.turing 2006-06-20 22:10 发表评论
]]>david.turing 2006-05-10 22:24 发表评论
]]>weblogic The default administration user DefaultAuthenticator
user0001 weblogic DefaultAuthenticator
user0002 user0002 DefaultAuthenticator
3Q徏立一个组QweblogicAdminQ同时在AD中也建立一个这Ll?br />注意Q在AD中的users而不是Builtin里面建组Q因Z者的DN是不一L?br />4Q将所有Weblogic中的user0001用户都加入到改组?br />5Q测试AD的可q接性，下蝲一个LDAP Browser?br />6Q在Weblogic Console中的Security->Realm的Authentication配置一个新的LDAP ProviderQ类型ؓQConfigure a new Active Directory Authenticator...
7Q配|参敎ͼ
i) 转到Active Directory那一Tab,看到HOST了吧Q?br />HOSTZ的AD的IP或者主机名QAD默认端口?89
ii) Principal为CN=user0001,CN=Users,DC=dlsvr,DC=com
其中QDC=dlsvr,DC=com为我的服务器的RootDNQ例如DC=ibmQDC=comQ?br />很讨厌AD的一个地Ҏ它采用与其他LDAP不一L命名ҎQ他用CN=User而不是OU=....Q所以我前面的步骤才需要徏立一个welogicAdmin的组?br />iii)Credential为AD中user0001的密码?br />注意Qii)和iii)是用于连接AD用的Q构造一个LDAPConnection需要用户名密码的，懂不懂：Q?br />转到user tab
iv) User Name AttributeQuser0001
v) User Base DNQCN=Users,DC=dlsvr,DC=com
转到group tab
vi) Group Base DN:CN=weblogicAdmin,CN=Users,DC=dlsvr,DC=com
vii) weblogicAdmin
保存
关键的步骤到了：
Security->Realms->myrealm->Providers->Authentication
有没有看到Re-order the Configured Authentication Providers
对，是q里需要调整一下顺序?br />把ActiveDirectoryAuthenticator调整到最上面Q优先最高）
然后讄ActiveDirectoryAuthenticator的General里面的Control Flag为Required?br />接着DefaultAuthenticator里面的设成是OPTIONAL?br />于是QAD取代了以前的DefaultAuthenticator了，如果两个都RequriedQ那么也你要接受双重认证Q汗......一般不需要这栗?br />注意:boot.properties里面的默认的Weblogic启动账号同样受AD影响Q你如果在AD里面止了Weblogicq个账号Q我保证你WLS启动不了
david.turing 2006-04-02 12:05 发表评论
]]>edu.yale.its.tp.cas.authHandler
edu.yale.its.tp.cas.auth.provider.WeblogicHandler
我自己写了一个WeblogicHandler(edu.yale.its.tp.cas.auth.provider包中)Q专门让CASd到Weblogic ServerQ事实上Q将来如果不用WLSQ还可能使用WebsphereQJbossQAD之类?/p>
后来发现Q虽然能loginContext拿到SubjectQ但该Subject的Principal不能被页面的request.getPrincipal()所取得Q醒悟自己在做JAAS LoginQ查看weblogic文档Q原来Weblogic提供?br />weblogic.servlet.security.ServletAuthentication
用于在Servlet端调用JAAS接口q行dQ通过该接口登录后Q就如同User使用了标准的d机制d了Weblogic?br />于是Q立即修改了login servlet试一下，加入
try {
CallbackHandler handler = new SimpleCallbackHandler(
request.getParameter("username"),
request.getParameter("password"));
Subject mySubject = weblogic.security.services.Authentication
.login(handler);
weblogic.servlet.security.ServletAuthentication.runAs(
mySubject, request);
System.out.println("mySubject[" +mySubject.toString()+"]"+
"写入Session");
} catch (LoginException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
然后Q页面果然就能拿到Pincipal了?/p>
david.turing 2006-04-02 12:02 发表评论
]]>java.security.UnrecoverableKeyException: Cannot recover key
而且他已l正配|了keystoreFile和keystorePass?br />后来我发玎ͼ他对Keystore中的Key使用了Password保护Q而且
保护q个KeyEntry的KeyPass!=KeyStore的KeypassQ导致出错，
Tomcat SSL要求q两个密码必ȝ{?br />解决办法Q?br />keytool -keypasswd -v -alias mykeyalias -keypass noequalpass -new equalpass -keystore mykeystore.jks -storepass equalpass
其中Q?mykeyalias是key在keystore中的别名Q?keypass后面跟key的旧密码"noequalpass", -new 是新密码"equalpass",注意新密码跟storepass一致?/p>
附：Weblogic是支持不一致的KeystorePass和KeyPass的?/p>
david.turing 2006-04-02 12:00 发表评论
]]>david.turing 2006-03-17 10:38 发表评论
]]>david.turing 2006-03-09 17:24 发表评论
]]>