我正在将旧的旧服务迁移到 EAP 7.1 它目前通过 LDAP 对用户进行身份验证和授权，我想将其移动到它所属的位置 - AS 上的安全域。
我有一个由 LDAP 领域支持的工作安全域，如下所示：
/subsystem=elytron/ldap-realm=***censored***:query
{
"outcome" => "success",
"result" => {
"allow-blank-password" => false,
"dir-context" => "***censored***",
"direct-verification" => true,
"identity-mapping" => {
"rdn-identifier" => "sAMAccountName",
"use-recursive-search" => true,
"search-base-dn" => "***censored***",
"attribute-mapping" => [
{
"from" => "cn",
"to" => "roles",
"filter" => "(&(objectClass=group)(member={1}))",
"filter-base-dn" => "***censored***"
},
{"from" => "company", "to" => "company"},
{"from" => "givenName", "to" => "firstName"},
{"from" => "sn", "to" => "lastName"},
{"from" => "mail", "to" => "email"}
],
"user-password-mapper" => {"from" => "userPassword"}
}
}
}
针对从 LDAP 属性映射中提取的身份属性“角色”进行授权。
现在这可行，我想从 LDAP 中获取更多属性（公司、名字、姓氏、电子邮件，可能还有更多）。这些已经被上面的配置拾取，Elytron 以我认为我应该期望的方式处理它们：
<TS> DEBUG [org.wildfly.security] (default task-6) [javax.naming.ldap.InitialLdapContext@5c7e4fb4] successfully created. Connection established to LDAP server.
<TS> DEBUG [org.wildfly.security] (default task-6) Trying to create identity for principal [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Executing search [(sAMAccountName={0})] in context [*****] with arguments [*****]. Returning attributes are [MAIL, SN, GIVENNAME, COMPANY]. Binary attributes are [null].
<TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Identity for principal [*****] found at [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Executing search [(&(objectClass=group)(member={1}))] in context [*****] with arguments [*****, *****]. Returning attributes are [null, CN]. Binary attributes are [null].
<TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
.
. bunch of group memberships
.
<TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
<TS> TRACE [org.wildfly.security] (default task-6) Identity iterating - pagination not supported - end of list
<TS> DEBUG [org.wildfly.security] (default task-6) Obtaining authorization identity attributes for principal [*****]:
<TS> DEBUG [org.wildfly.security] (default task-6) Identity [*****] attributes are:
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [lastName] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [firstName] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [roles] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [company] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Attribute [email] value [*****].
<TS> DEBUG [org.wildfly.security] (default task-6) Context [javax.naming.ldap.InitialLdapContext@5c7e4fb4] was closed. Connection closed or just returned to the pool.
我想做的是从安全 EJB 中的代码中获取这些身份属性。当然可以注入 dir-context 并从代码本身查找属性，但这将是特定于部署的。我非常希望让 AS 通过SessionContext或等效项公开这些属性。
我不知道该怎么做。网上提供的大部分 Elytron 材料都是我的，只是复制了 cred 的官方示例，而只是一遍又一遍地重复使用相同的 Hello World 示例。
所以。总结一下。别介意这是一个 LDAP 领域。我需要的属性在 Identity 对象中可用。身份后来被转换为没有这些属性的主体，据我所知，主体是我可以通过 EJB 会话上下文访问的东西。
有什么方法可以让我从 EJB 中获取身份，或者至少是对其的看法？最好以与实现无关的方式？
此致！
/马格努斯·德鲁格