RESTEasy支持JAX-RS @RolesAllowed

Question

我花了几个小时在嵌入式Jetty 9.1.0.v20131115和RESTEasy 3.0.5.Final中安装自定义登录服务.我的登录服务将在数据库中查找用户并为其分配角色.它看起来像这样:

final Constraint restConstraint = new Constraint();
restConstraint.setName(Constraint.__BASIC_AUTH);
restConstraint.setRoles(new String[]{"user", "admin");
restConstraint.setAuthenticate(true);
final ConstraintMapping restConstraintMapping = new ConstraintMapping();
restConstraintMapping.setConstraint(restConstraint);
restConstraintMapping.setPathSpec("/api/*");
final ConstraintSecurityHandler restSecurityHandler = new ConstraintSecurityHandler();
final LoginService myLoginService = new MyLoginService();
restSecurityHandler.setAuthenticator(new BasicAuthenticator());
restSecurityHandler.setRealmName(myLoginService.getName());
restSecurityHandler.addConstraintMapping(restConstraintMapping);
restSecurityHandler.setLoginService(myLoginService);

我有用户joe-user谁拥有的角色user,和jane-admin谁既有user和admin角色.我有一个GET名为的REST 资源my-resource:

@RolesAllowed("admin")

当我做一个HTTP GET上my-resource的浏览器中正确请求凭据,我可以登录,无论是joe-user或jane-admin.问题是任何一个用户都被允许GET my-resource!!

我已经跟踪了一些Jetty代码,事实上,由于我的登录服务,Jetty要求登录用户支持哪些角色.不幸的是,无论用户如何,Jetty都会接受我指定的任何角色restConstraint.setRoles(new String[]{"user", "admin").

显然,RESTEasy层应该识别@RolesAllowed("admin")注释并验证用户.但是我如何让RESTEasy做到这一点？

Answer 1

在RESTEasy文档的帮助下,我发现为了使RESTEasy能够遵循@RolesAllowed注释,必须打开文件中的resteasy.role.based.security上下文参数开关web.xml; 或者以编程方式,正如我所做的那样:

final ServletHolder servletHolder = new ServletHolder(new HttpServlet30Dispatcher());
servletHolder.setInitParameter("javax.ws.rs.Application", MyApplication.class.getName());
servletHolder.setInitParameter("resteasy.role.based.security", String.valueOf(true));
contextHandler.addServlet(servletHolder, "/api/*");