8

I'm currently working on a web application based on Java EE 7, PostgreSQL and the application server GlassFish 4. I need to implement a form based authentication, and to secure some URL knowing that :

  • the users and the roles/groups (whatever they are called) are stored in the database.
  • I wanted my application to be as "standard" as possible (i.e I am currently using JSF and JPA, and no other framework like spring, struts ...)

After some research, I found that Java EE provided a standard authentication mechanism called JASPIC. So, I focused my research on JASPIC and I read multiple Stackoverflow Q/A and those articles written by Arjan Tijms (It's almost impossible to find a Stackoverflow Q/A related to Java EE without one of his answers or comments, thanks to him by the way) :

My question is : will JASPIC allow me to do what I need (form authentication + URL restriction with roles) and is it worth the effort to use it ? What I mean is : it's perhaps safer and easier to use another mechanism.

Arjan Tijms also says that whether or not using JASPIC is "a kind of chicken-and-egg problem" and if JASPIC is safe to use (It doesn't create more problems than it solves), no matter the amount of code I need to write, I really want to be "one of the first chickens".

4

3 回答 3

3

我正在使用 JASPIC 进行身份验证，但是 JASPIC 有一个您需要应对的限制（如果您想要标准的话）。您仅限于在 Java EE 7 API 之外没有依赖项。这意味着访问需要驱动程序的 JDBC 资源不是标准中明确规定的能力。

在我的OpenID Connect 实现中，我使用 Google 作为我的安全存储，它还为我提供了 Google 登录表单。这是使用 JASPIC 的一个更大的例子。

对于您自己，您可以将 EJB 暴露给全局名称空间并使用 InitialContext 来获取 EJB。会有一些代码重复，因为您必须在两个地方复制 EJB 远程接口代码并确保两个地方的 serialVersionID 相同。EJB 可用于连接到 JPA 资源以获取您的授权数据。

使用 EJB，因为您可能想到的另外两个选项是 REST 和 SOAP，它们会在您的 Web 端口上公开某些内容，并且需要一些额外的配置以防止未经授权的访问或要求将它们放置在不同的系统上。

如果您想学习，我创建的一个简单 JASPIC 实现是HTTP Header JASPIC 模块，该模块旨在与更复杂的系统（如 SiteMinder）集成。

于 2014-10-10T03:44:06.940 回答
-4

对于基于表单的身份验证和授权，您需要 JAAS。通过以下 url-link

于 2014-07-01T08:12:06.643 回答
-4

我不知道 JASPIC 但我建议你看看shiro 框架

它可以让您根据您的帖子以最少的配置完成几乎所有您需要的事情。

于 2014-04-24T12:28:27.457 回答