0
我需要創建一個類似於HTTPBasicServerAuthModule的自定義身份驗證模塊,它不應提示輸入用戶名和密碼進行身份驗證。因爲我們有一個jwt令牌可以爲我們提供身份驗證,並且我們不需要另一層身份驗證。以下是我的自定義驗證模塊:如何從Jboss中的HTTPServerAuthModule中刪除身份驗證EAP
public class CustomJaspiAuthModule extends WebServerAuthModule
{
protected Context context;
protected boolean cache = false;
public static final byte[] AUTHENTICATE_BYTES = {
(byte) 'W',
(byte) 'W',
(byte) 'W',
(byte) '-',
(byte) 'A',
(byte) 'u',
(byte) 't',
(byte) 'h',
(byte) 'e',
(byte) 'n',
(byte) 't',
(byte) 'i',
(byte) 'c',
(byte) 'a',
(byte) 't',
(byte) 'e'
};
protected String delegatingLoginContextName = null;
public CustomJaspiAuthModule() { }
public CustomJaspiAuthModule(String delegatingLoginContextName) {
super();
this.delegatingLoginContextName = delegatingLoginContextName;
}
@Override
public AuthStatus secureResponse(MessageInfo messageInfo, Subject serviceSubject) throws AuthException {
// do nothing, just return SUCCESS.
return AuthStatus.SUCCESS;
}
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {
Request request = (Request) messageInfo.getRequestMessage();
Response response = (Response) messageInfo.getResponseMessage();
Principal principal;
context = request.getContext();
LoginConfig config = context.getLoginConfig();
// validate any credentials already included with this request.
String username = null;
String password = null;
MessageBytes authorization = request.getCoyoteRequest().getMimeHeaders().getValue("authorization");
if (authorization != null) {
authorization.toBytes();
ByteChunk authorizationBC = authorization.getByteChunk();
if (authorizationBC.startsWithIgnoreCase("basic ", 0)) {
authorizationBC.setOffset(authorizationBC.getOffset() + 6);
CharChunk authorizationCC = authorization.getCharChunk();
Base64.decode(authorizationBC, authorizationCC);
// get username and password from the authorization char chunk.
int colon = authorizationCC.indexOf(':');
if (colon < 0) {
username = authorizationCC.toString();
} else {
char[] buf = authorizationCC.getBuffer();
username = new String(buf, 0, colon);
password = new String(buf, colon + 1, authorizationCC.getEnd() - colon - 1);
}
authorizationBC.setOffset(authorizationBC.getOffset() - 6);
}
principal = context.getRealm().authenticate(username, password);
if (principal != null) {
registerWithCallbackHandler(principal, username, password);
return AuthStatus.SUCCESS;
}
}
// send an "unauthorized" response and an appropriate challenge.
MessageBytes authenticate = response.getCoyoteResponse().getMimeHeaders().
addValue(AUTHENTICATE_BYTES, 0, AUTHENTICATE_BYTES.length);
CharChunk authenticateCC = authenticate.getCharChunk();
try {
authenticateCC.append("Basic realm=\"");
if (config.getRealmName() == null) {
authenticateCC.append(request.getServerName());
authenticateCC.append(':');
authenticateCC.append(Integer.toString(request.getServerPort()));
} else {
authenticateCC.append(config.getRealmName());
}
authenticateCC.append('\"');
authenticate.toChars();
response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
} catch (IOException e) {
// Ignore IOException here (client disconnect)
}
return AuthStatus.FAILURE;
}
}
我相信,代碼的下面的部分是,我們所得到的提示輸入用戶名和密碼警惕認證的原因。
MessageBytes authenticate = response.getCoyoteResponse().getMimeHeaders().
addValue(AUTHENTICATE_BYTES, 0, AUTHENTICATE_BYTES.length);
CharChunk authenticateCC = authenticate.getCharChunk();
try {
authenticateCC.append("Basic realm=\"");
if (config.getRealmName() == null) {
authenticateCC.append(request.getServerName());
authenticateCC.append(':');
authenticateCC.append(Integer.toString(request.getServerPort()));
} else {
authenticateCC.append(config.getRealmName());
}
authenticateCC.append('\"');
authenticate.toChars();
response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
} catch (IOException e) {
// Ignore IOException here (client disconnect)
}
但如果我刪除此塊中,我得到了良好的反響回(200響應),但該請求和響應,我找回都是空的。請建議我如何刪除此身份驗證警報。