标签：java authentication ssl jboss jaas
我们在配置JBoss时遇到问题.我们正在配置它以使其可以同时使用Mutual auth并且不使用它.
喜欢：
https://example.com/contextA/(需要SSL相互身份验证)
https://example.com/contextB/(只是SSL)
可能吗？
我能做的是让JBoss或所有JBoss使用SSL相互认证或不使用.如何将其配置为同时进行？
我的contextA web.xml：
<!DOCTYPE web-app PUBLIC
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd" >
<web-app>
<display-name>ContextA</display-name>
<security-constraint>
<web-resource-collection>
<web-resource-name>services</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>
<security-role>
<role-name />
</security-role>
</web-app>
我的contextA jboss-web.xml
<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
<security-domain>RequireCertificateDomain</security-domain>
</jboss-web>
ContextB web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<display-name>ContextB</display-name>
<jsp-config>
<jsp-property-group>
<url-pattern>*.jsp</url-pattern>
<trim-directive-whitespaces>true</trim-directive-whitespaces>
</jsp-property-group>
</jsp-config>
<session-config>
<session-timeout>10</session-timeout>
<cookie-config>
<http-only>true</http-only>
</cookie-config>
</session-config>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
<security-constraint>
<display-name>SecureApplicationConstraint</display-name>
<web-resource-collection>
<web-resource-name>ContextB</web-resource-name>
<description>Auth applications are secured</description>
<url-pattern>/login/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>Only Users with roles are allowed</description>
<role-name>USER</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint>
<display-name>SecureChannelConstraint</display-name>
<web-resource-collection>
<web-resource-name>Entire site is protected through SSL</web-resource-name>
<description />
<url-pattern>/contextB/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<description>Require encrypted channel</description>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>ContextBPolicy</realm-name>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/loginError.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description/>
<role-name>USER</role-name>
</security-role>
</web-app>
ContextB jboss-web.xml
<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
<security-domain>java:/jaas/ContextBPolicy</security-domain>
</jboss-web>
standalone.xml的内容
<security-domain name="ContextBPolicy">
<authentication>
<login-module code="org.ContextBLoginModule" flag="required"/>
</authentication>
</security-domain>
(...)
<security-domain name="RequireCertificateDomain">
<authentication>
<login-module code="CertificateRoles" flag="required">
<module-option name="securityDomain" value="RequireCertificateDomain"/>
<module-option name="verifier" value="org.jboss.security.auth.certs.AnyCertVerifier"/>
<module-option name="usersProperties" value="file:c:/tmp/my-users.properties"/>
<module-option name="rolesProperties" value="file:c:/tmp/my-roles.properties"/>
</login-module>
</authentication>
<jsse keystore-password="changethis" keystore-url="file:c:/tmp/localhost.jks" truststore-password="changethis" truststore-url="file:c:/tmp/cacerts.jks"/>
</security-domain>
(...)
<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
<configuration>
<jsp-configuration x-powered-by="false"/>
</configuration>
<connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
<ssl name="ssl" key-alias="localhost" password="changethis" certificate-key-file="../standalone/configuration/localhost.jks" verify-client="require" ca-certificate-file="../standalone/configuration/cacerts.jks" truststore-type="JKS"/>
</connector>
<virtual-server name="default-host" enable-welcome-root="true">
<alias name="localhost"/>
<alias name="example.com"/>
</virtual-server>
</subsystem>
解决方法:
在我看来,基于http端点不可能做到这一点.
原因是在客户端将http请求发送到服务器之前发生SSL / TLS握手.
端点(例如/ contextA)驻留在该http请求中！
在SSL / TLS握手开始时,只有主机名(例如example.com)可用(并且仅当客户端启用了SNI时).
所以你需要2个不同的主机名.例如contexta.example.com和contextb.example.com
标签：java,authentication,ssl,jboss,jaas 来源： https://codeday.me/bug/20190529/1178464.html
本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享； 2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关； 3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关； 4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除； 5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。