Wildfly安全约束被忽略

Question

我正在尝试在wildfly上保护一个演示Web应用程序.我在standalone.xml中定义了这个安全域

<security-domains>
                <security-domain name="projects" cache-type="default">
                    <authentication>
                        <login-module code="Database" flag="required">
                            <module-option name="dsJndiName" value="java:jboss/datasources/TestDS"/>
                            <module-option name="rolesQuery" value="SELECT role, 'Roles' FROM users WHERE username=?"/>
                            <module-option name="hashAlgorithm" value="MD5"/>
                            <module-option name="hashEncoding" value="hex"/>
                            <module-option name="principalsQuery" value="SELECT password from users WHERE username=?"/>
                        </login-module>
                    </authentication>
                    <authorization>
                        <policy-module code="Database" flag="required">
                            <module-option name="dsJndiName" value="java:jboss/datasources/school"/>
                            <module-option name="rolesQuery" value="SELECT role, 'Roles' FROM users WHERE username=?"/>
                            <module-option name="hashAlgorithm" value="MD5"/>
                            <module-option name="hashEncoding" value="hex"/>
                            <module-option name="principalsQuery" value="SELECT password from users WHERE username=?"/>
                        </policy-module>
                    </authorization>
                </security-domain>

然后在web-inf下我在web.xml中定义了这个安全成本

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>projects</web-resource-name>
      <url-pattern>/twp/projects/*</url-pattern>
      <http-method>POST</http-method>
      <http-method>GET</http-method>
      <http-method>PUT</http-method>
      <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>ADMINISTRATOR</role-name>
    </auth-constraint>
  </security-constraint>

  <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>projects</realm-name>
    <form-login-config>
      <form-login-page>/login.xhtml</form-login-page>
      <form-error-page>/error.xhtml</form-error-page>
    </form-login-config>
  </login-config>
  <security-role>
    <role-name>ADMINISTRATOR</role-name>
  </security-role>
  <security-role>
    <role-name>USER</role-name>
  </security-role>
</web-app>

这个内容在jboss-web.xml中

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
  <security-domain>java:/jaas/projects</security-domain>

</jboss-web>

问题是,如果我转到/ projects URL,我不会重定向到登录页面,就好像忽略了约束.

Answer 1

有了你的配置,它工作正常.在控制台你有这两行吗？:

WARN  [io.undertow.servlet] (ServerService Thread Pool -- 7) UT015020: Path /twp/projects/* is secured for some HTTP methods, however it is not secured for [TRACE, HEAD, CONNECT, OPTIONS]
INFO  [org.wildfly.extension.undertow] (ServerService Thread Pool -- 7) WFLYUT0021: Registered web context: '/test-1.0-SNAPSHOT' for server 'default-server'

如果不是,您应该将配置放在wildfly的standalone.xml中的corrent部分

第一个意味着路径是安全的,第二个意味着告诉你重新设置的Web上下文.

http:// localhost:8080/test-1.0-SNAPSHOT/twp/projects下的每个URL 都将受到保护并重定向到登录页面.

例如

HTTP://本地主机:8080 /测试-1.0-SNAPSHOT/TWP /项目/所有

但不是

HTTP://本地主机:8080 /测试-1.0-SNAPSHOT/TWP /所有

我使用带有urn的wildfly 11:jboss:domain:security:2.0而不是elytron.