我创建了一个简单的 maven web 项目，并尝试使用 BASIC 身份验证和 jdbRealm 来保护它。
在我的 glassfish 4.0 服务器上，我创建了一个领域并启用了“默认主体到角色映射”。安全日志记录级别设置为最好。
我的 web.xml 看起来像这样：
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
<session-config>
<session-timeout>
30
</session-timeout>
</session-config>
<security-constraint>
<display-name>UserConstraint</display-name>
<web-resource-collection>
<web-resource-name>ApiResource</web-resource-name>
<description/>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>PUT</http-method>
<http-method>HEAD</http-method>
<http-method>POST</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<description/>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>jdbc-realm</realm-name>
</login-config>
<security-role>
<description/>
<role-name>user</role-name>
</security-role>
</web-app>
领域似乎工作。当我运行该项目时，会弹出一个身份验证屏幕并且登录成功：
玻璃鱼输出：
Fine: [Web-Security] Setting Policy Context ID: old = null ctxID = security/security
Fine: [Web-Security] hasUserDataPermission perm: ("javax.security.jacc.WebUserDataPermission" "" "GET")
Fine: [Web-Security] hasUserDataPermission isGranted: true
Fine: [Web-Security] Policy Context ID was: security/security
Fine: [Web-Security] Codesource with Web URL: file:/security/security
Fine: [Web-Security] Checking Web Permission with Principals : null
Fine: [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest: JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine: [Web-Security] hasResource isGranted: false
Fine: [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest: Processing login with credentials of type: class com.sun.enterprise.security.auth.login.common.PasswordCredential
Fine: Logging in user [joost] into realm: jdbc-realm using JAAS module: jdbcRealm
Fine: Login module initialized: class com.sun.enterprise.security.ee.auth.login.JDBCLoginModule
Finest: JDBC login succeeded for: joost groups:[users]
Fine: JAAS login complete.
Fine: JAAS authentication committed.
Fine: Password login succeeded for : joost
Fine: Set security context as user: joost
Fine: [Web-Security] Policy Context ID was: security/security
Fine: [Web-Security] Generating a protection domain for Permission check.
Fine: [Web-Security] Checking with Principal : joost
Fine: [Web-Security] Checking with Principal : users
Fine: [Web-Security] Codesource with Web URL: file:/security/security
Fine: [Web-Security] Checking Web Permission with Principals : joost, users
Fine: [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest: JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine: [Web-Security] hasResource isGranted: false
Fine: [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Fine: [Web-Security] Policy Context ID was: security/security
Fine: [Web-Security] hasUserDataPermission perm: ("javax.security.jacc.WebUserDataPermission" "" "GET")
Fine: [Web-Security] hasUserDataPermission isGranted: true
Fine: [Web-Security] Policy Context ID was: security/security
Fine: [Web-Security] Codesource with Web URL: file:/security/security
Fine: [Web-Security] Checking Web Permission with Principals : null
Fine: [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest: JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine: [Web-Security] hasResource isGranted: false
Fine: [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest: Processing login with credentials of type: class com.sun.enterprise.security.auth.login.common.PasswordCredential
Fine: Logging in user [joost] into realm: jdbc-realm using JAAS module: jdbcRealm
Fine: Login module initialized: class com.sun.enterprise.security.ee.auth.login.JDBCLoginModule
Finest: JDBC login succeeded for: joost groups:[users]
Fine: JAAS login complete.
Fine: JAAS authentication committed.
Fine: Password login succeeded for : joost
Fine: Set security context as user: joost
Fine: [Web-Security] Policy Context ID was: security/security
Fine: [Web-Security] Codesource with Web URL: file:/security/security
Fine: [Web-Security] Checking Web Permission with Principals : joost, users
Fine: [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest: JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine: [Web-Security] hasResource isGranted: false
Fine: [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Fine: FileRealm : file=C:\Users\Joost\School\S6\SOP\development_server\glassfish\domains\domain1\config\admin-keyfile
Fine: FileRealm : jaas-context=ignore
Fine: Login module initialized: class com.sun.enterprise.security.auth.login.FileLoginModule
Fine: File login succeeded for: admin
Fine: JAAS login complete.
Fine: JAAS authentication committed.
但是页面显示 HTTP 状态 403 - 禁止。我不知道。我也尝试过使用自定义主体角色映射，但它也不起作用。