我正在尝试实现一个登录模块，以便我可以在我的网络应用程序上执行“记住我”功能，并使用 bcrypt 对我的密码进行哈希处理。为了构建我使用本教程的类。但是，在实施此操作后我没有设法连接。db 中的密码目前通过 SHA-256 进行哈希处理，我怀疑这就是原因。
public class TestAuthModule implements
javax.security.auth.message.module.ServerAuthModule {
@SuppressWarnings("rawtypes")
protected static final Class[] supportedMessageTypes = new Class[] {
HttpServletRequest.class, HttpServletResponse.class };
private CallbackHandler handler;
public void initialize(MessagePolicy requestPolicy,
MessagePolicy responsePolicy, CallbackHandler handler,
@SuppressWarnings("rawtypes") Map options) throws AuthException {
System.out.println("initialize called.");
this.handler = handler;
}
@SuppressWarnings("rawtypes")
public Class[] getSupportedMessageTypes() {
return supportedMessageTypes;
}
public AuthStatus validateRequest(MessageInfo messageInfo,
Subject clientSubject, Subject serverSubject) throws AuthException {
HttpServletRequest request = (HttpServletRequest) messageInfo
.getRequestMessage();
String user = request.getParameter("user");
String group = request.getParameter("group");
System.out.println("validateRequest called.");
System.out.println("User = " + user);
System.out.println("Group = " + group);
authenticateUser(user, group, clientSubject, serverSubject);
return AuthStatus.SUCCESS;
}
public AuthStatus secureResponse(MessageInfo msgInfo, Subject service)
throws AuthException {
System.out.println("secureResponse called.");
return AuthStatus.SEND_SUCCESS;
}
public void cleanSubject(MessageInfo msgInfo, Subject subject)
throws AuthException {
if (subject != null) {
subject.getPrincipals().clear();
}
}
private void authenticateUser(String user, String group,
Subject clientSubject, Subject serverSubject) {
System.out
.println("Authenticating user " + user + " in group " + group);
CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(
clientSubject, user);
GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(
clientSubject, new String[] { group });
try {
handler.handle(new Callback[] { callerPrincipalCallback,
groupPrincipalCallback });
} catch (Exception e) {
e.printStackTrace();
}
}
}
我像这样登录（在实现自定义登录模块之前确实有效）：
private String username;
private Password password;
//....
for (int i = 0; i < x -1 ; i++) {
this.password = PasswordEncoder
.toHex(PasswordEncoder
.hash512(this.password + salt));
}
// x is the number of time I hashed the password before storing it in db.
// x-1 because glassfish authentication does it once for me.
//...
try {
request.login(username, password + salt);
} catch (ServletException e)
同样在我的页面上，我曾经有一个注册和一个登录按钮，只有当用户为空时才会显示，否则我的用户名在顶部。现在我实现了这个，就像用户连接为“匿名”（所以在页面顶部有“你作为匿名连接”。为了防止这种情况，我做了一个临时修复：
if (username == null || username.equals("ANONYMOUS")) {
this.isUserConnected = false;
} else {
this.isUserConnected = true;
}
我试过了 ：
isUserInGroup("ANONYMOUS");
但是没有用户，所以我得到了一个 npe。我也不确定该怎么做。