流程

1. 配置一个提供 URL 的目录上下文，以及用于连接到 LDAP 服务器的主体。

   /subsystem=elytron/dir-context=<dir_context_name>:add(url="<LDAP_URL>",principal="<principal_distinguished_name>",credential-reference=<credential_reference>)

   Example

   /subsystem=elytron/dir-context=exampleDirContext:add(url="ldap://10.88.0.2",principal="cn=admin,dc=wildfly,dc=org",credential-reference={clear-text="secret"})
   {"outcome" => "success"}

2. 创建一个引用目录上下文的 LDAP 域。指定搜索基础 DN 以及用户的映射方式。

   语法

   /subsystem=elytron/ldap-realm=<ldap_realm_name>add:(dir-context=<dir_context_name>,identity-mapping=search-base-dn="ou=<organization_unit>,dc=<domain_component>",rdn-identifier="<relative_distinguished_name_identifier>",user-password-mapper={from=<password_attribute_name>},attribute-mapping=[{filter-base-dn="ou=<organization_unit>,dc=<domain_component>",filter="<ldap_filter>",from="<ldap_attribute_name>",to="<identity_attribute_name>"}]})

   Example

   /subsystem=elytron/ldap-realm=exampleLDAPRealm:add(dir-context=exampleDirContext,identity-mapping={search-base-dn="ou=Users,dc=wildfly,dc=org",rdn-identifier="uid",user-password-mapper={from="userPassword"},attribute-mapping=[{filter-base-dn="ou=Roles,dc=wildfly,dc=org",filter="(&(objectClass=groupOfNames)(member={1}))",from="cn",to="Roles"},{from="mail",to="mail"},{from="telephoneNumber",to="telephoneNumber"}]})
   {"outcome" => "success"}

流程

1. 在 Elytron 中创建一个 filesystem-realm。

   语法

   /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add(path=<file_path>)

   Example

   /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir)
   {"outcome" => "success"}

2. 将用户添加到域，并配置用户的角色。

   1. 添加用户。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity(identity=<user_name>)

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity(identity=user1)
      {"outcome" => "success"}

   2. 为用户设置角色。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity-attribute(identity=<user_name>,name=<roles_attribute_name>, value=[<role_1>,<role_N>])

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity-attribute(identity=user1, name=Roles, value=["Admin","Guest"])
      {"outcome" => "success"}

   3. 设置用户的属性。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity-attribute(identity=<user_name>,name=<attribute_name>, value=[<attribute_value>])

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity-attribute(identity=user1, name=mail, value=["user@example.com"])
      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity-attribute(identity=user1, name=website, value=["http://www.example.com/"])

流程

1. 配置一个提供 URL 的目录上下文，以及用于连接到 LDAP 服务器的主体。

   /subsystem=elytron/dir-context=<dir_context_name>:add(url="<LDAP_URL>",principal="<principal_distinguished_name>",credential-reference=<credential_reference>)

   Example

   /subsystem=elytron/dir-context=exampleDirContext:add(url="ldap://10.88.0.2",principal="cn=admin,dc=wildfly,dc=org",credential-reference={clear-text="secret"})
   {"outcome" => "success"}

2. 创建一个引用目录上下文的 LDAP 域。指定搜索基础 DN 以及用户的映射方式。

   语法

   /subsystem=elytron/ldap-realm=<ldap_realm_name>add:(dir-context=<dir_context_name>,identity-mapping=search-base-dn="ou=<organization_unit>,dc=<domain_component>",rdn-identifier="<relative_distinguished_name_identifier>",user-password-mapper={from=<password_attribute_name>},attribute-mapping=[{filter-base-dn="ou=<organization_unit>,dc=<domain_component>",filter="<ldap_filter>",from="<ldap_attribute_name>",to="<identity_attribute_name>"}]})

   Example

   /subsystem=elytron/ldap-realm=exampleLDAPRealm:add(dir-context=exampleDirContext,identity-mapping={search-base-dn="ou=Users,dc=wildfly,dc=org",rdn-identifier="uid",user-password-mapper={from="userPassword"},attribute-mapping=[{filter-base-dn="ou=Roles,dc=wildfly,dc=org",filter="(&(objectClass=groupOfNames)(member={1}))",from="cn",to="Roles"}]})
   {"outcome" => "success"}

流程

1. 在 Elytron 中创建一个 filesystem-realm。

   语法

   /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add(path=<file_path>)

   Example

   /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir)
   {"outcome" => "success"}

2. 将用户添加到域，并配置用户的角色。

   1. 添加用户。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity(identity=<user_name>)

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity(identity=user2)
      {"outcome" => "success"}

   2. 设置用户的密码。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:set-password(identity=<user_name>, clear={password=<password>})

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:set-password(identity=user2, clear={password="passwordUser2"})
      {"outcome" => "success"}

   3. 为用户设置角色。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity-attribute(identity=<user_name>, name=<roles_attribute_name>, value=[<role_1>,<role_N>])

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity-attribute(identity=user2, name=Roles, value=["Admin","Guest"])
      {"outcome" => "success"}

流程

1. 配置一个提供 URL 的目录上下文，以及用于连接到 LDAP 服务器的主体。

   /subsystem=elytron/dir-context=<dir_context_name>:add(url="<LDAP_URL>",principal="<principal_distinguished_name>",credential-reference=<credential_reference>)

   Example

   /subsystem=elytron/dir-context=exampleDirContext:add(url="ldap://10.88.0.2",principal="cn=admin,dc=wildfly,dc=org",credential-reference={clear-text="secret"})
   {"outcome" => "success"}

2. 创建一个引用目录上下文的 LDAP 域。指定搜索基础 DN 以及用户的映射方式。

   语法

   /subsystem=elytron/ldap-realm=<ldap_realm_name>add:(dir-context=<dir_context_name>,identity-mapping=search-base-dn="ou=<organization_unit>,dc=<domain_component>",rdn-identifier="<relative_distinguished_name_identifier>",user-password-mapper={from=<password_attribute_name>},attribute-mapping=[{filter-base-dn="ou=<organization_unit>,dc=<domain_component>",filter="<ldap_filter>",from="<ldap_attribute_name>",to="<identity_attribute_name>"}]})

   Example

   /subsystem=elytron/ldap-realm=exampleLDAPRealm:add(dir-context=exampleDirContext,identity-mapping={search-base-dn="ou=Users,dc=wildfly,dc=org",rdn-identifier="uid",user-password-mapper={from="userPassword"},attribute-mapping=[{filter-base-dn="ou=Roles,dc=wildfly,dc=org",filter="(&(objectClass=groupOfNames)(member={1}))",from="cn",to="Roles"}]})
   {"outcome" => "success"}

流程

1. 在 Elytron 中创建一个 filesystem-realm。

   语法

   /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add(path=<file_path>)

   Example

   /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir)
   {"outcome" => "success"}

2. 将用户添加到域，并配置用户的角色。

   1. 添加用户。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity(identity=<user_name>)

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity(identity=user1)
      {"outcome" => "success"}

   2. 设置用户的密码。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:set-password(identity=<user_name>, clear={password=<password>})

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:set-password(identity=user1, clear={password="passwordUser1"})
      {"outcome" => "success"}

   3. 为用户设置角色。

      语法

      /subsystem=elytron/filesystem-realm=<filesystem_realm_name>:add-identity-attribute(identity=<user_name>,name=<roles_attribute_name>, value=[<role_1>,<role_N>])

      Example

      /subsystem=elytron/filesystem-realm=exampleFileSystemRealm:add-identity-attribute(identity=user1, name=Roles, value=["Admin","Guest"])
      {"outcome" => "success"}

流程

1. 在 CLI 中使用 mvn 命令来建立一个 Maven 项目。此命令为项目创建目录结构，以及 pom.xml 配置文件。

   语法

   $ mvn archetype:generate \
   -DgroupId=<group-to-which-your-application-belongs> \
   -DartifactId=<name-of-your-application> \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-simple \
   -DinteractiveMode=false

   Example

   $ mvn archetype:generate \
   -DgroupId=com.example.loginmodule \
   -DartifactId=example-custom-login-module \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-simple \
   -DinteractiveMode=false

2. 导航到应用程序根目录。

   语法

   $ cd <name-of-your-application>

   Example

   $ cd example-custom-login-module

3. 将生成的 pom.xml 文件的内容替换为以下文本：

   <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
       <modelVersion>4.0.0</modelVersion>
   
       <groupId>custom.loginmodules</groupId>
       <artifactId>custom-login-modules</artifactId>
       <version>1.0</version>
       <dependencies>
           <dependency>
               <groupId>org.wildfly.security</groupId>
               <artifactId>wildfly-elytron</artifactId>
               <version>1.17.2.Final</version>
           </dependency>
           <dependency>
               <groupId>jakarta.security.enterprise</groupId>
               <artifactId>jakarta.security.enterprise-api</artifactId>
               <version>3.0.0</version>
           </dependency>
       </dependencies>
   
       <properties>
           <maven.compiler.source>11</maven.compiler.source>
           <maven.compiler.target>11</maven.compiler.target>
       </properties>
   
   </project>

4. 删除目录 site 和 test，因为本例不需要它们。

   $ rm -rf src/site/
   $ rm -rf src/test/

流程

1. 创建一个用于存储 Java 文件的目录。

   语法

   $ mkdir -p src/main/java/<path_based_on_artifactID>

   Example

   $ mkdir -p src/main/java/com/example/loginmodule

2. 导航到包含源文件的目录。

   语法

   $ cd src/main/java/<path_based_on_groupID>

   Example

   $ cd src/main/java/com/example/loginmodule

3. 删除生成的文件 App.java。

   $ rm App.java

4. 为自定义登录模块源创建一个文件 ExampleCustomLoginModule.java。

   package com.example.loginmodule;
   
   import org.wildfly.security.auth.principal.NamePrincipal;
   
   import javax.security.auth.Subject;
   import javax.security.auth.callback.Callback;
   import javax.security.auth.callback.CallbackHandler;
   import javax.security.auth.callback.NameCallback;
   import javax.security.auth.callback.PasswordCallback;
   import javax.security.auth.callback.UnsupportedCallbackException;
   import javax.security.auth.login.LoginException;
   import javax.security.auth.spi.LoginModule;
   import java.io.IOException;
   import java.security.Principal;
   import java.util.Arrays;
   import java.util.HashMap;
   import java.util.Map;
   
   
   public class ExampleCustomLoginModule implements LoginModule {
   
       private final Map<String, char[]> usersMap = new HashMap<String, char[]>();
       private Principal principal;
       private Subject subject;
       private CallbackHandler handler;
   
       /**
        * In this example, identities are created as fixed Strings.
        *
        * The identities are:
        *    user1 has the password passwordUser1
        *    user2 has the password passwordUser2
        *
        * Use these credentials when you secure management interfaces
        * or applications with this login module.
        *
        * In a production login module, you would get the identities
        * from a data source.
        *
        */
   
       @Override
       public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
           this.subject = subject;
           this.handler = callbackHandler;
           this.usersMap.put("user1", "passwordUser1".toCharArray());
           this.usersMap.put("user2", "passwordUser2".toCharArray());
       }
   
       @Override
       public boolean login() throws LoginException {
           // obtain the incoming username and password from the callback handler
           NameCallback nameCallback = new NameCallback("Username");
           PasswordCallback passwordCallback = new PasswordCallback("Password", false);
           Callback[] callbacks = new Callback[]{nameCallback, passwordCallback};
           try {
               this.handler.handle(callbacks);
           } catch (UnsupportedCallbackException | IOException e) {
               throw new LoginException("Error handling callback: " + e.getMessage());
           }
   
           final String username = nameCallback.getName();
           this.principal = new NamePrincipal(username);
           final char[] password = passwordCallback.getPassword();
   
           char[] storedPassword = this.usersMap.get(username);
           if (!Arrays.equals(storedPassword, password)) {
               throw new LoginException("Invalid password");
           } else {
               return true;
           }
       }
   
       /**
        * user1 is assigned the roles Admin, User and Guest.
        * In a production login module, you would get the identities
        * from a data source.
        *
        */
   
       @Override
       public boolean commit() throws LoginException {
           if (this.principal.getName().equals("user1")) {
               this.subject.getPrincipals().add(new Roles("Admin"));
               this.subject.getPrincipals().add(new Roles("User"));
               this.subject.getPrincipals().add(new Roles("Guest"));
           }
           return true;
       }
   
       @Override
       public boolean abort() throws LoginException {
           return true;
       }
   
       @Override
       public boolean logout() throws LoginException {
           this.subject.getPrincipals().clear();
           return true;
       }
   
       /**
       * Principal with simple classname 'Roles' will be mapped to the identity's attribute with name 'Roles'.
       */
   
       private static class Roles implements Principal {
   
           private final String name;
   
           Roles(final String name) {
               this.name = name;
           }
   
           /**
            * @return name of the principal. This will be added as a value to the identity's attribute which has a name equal to the simple name of this class. In this example, this value will be added to the attribute with a name 'Roles'.
           */
   
           public String getName() {
               return this.name;
           }
       }
   }

5. 在 <application_home> 目录中创建 JAAS 配置文件 JAAS-login-modules.conf。

   exampleConfiguration {
   	com.example.loginmodule.ExampleCustomLoginModule optional;
   };

   • exampleConfiguration 是条目名称。
   • com.example.loginmodule.ExampleCustomLoginModule 是登录模块。
   • optional 是标志。

6. 编译登录模块。

   $ mvn package
   ...
   [INFO] ------------------------------------------------------------------------
   [INFO] BUILD SUCCESS
   [INFO] ------------------------------------------------------------------------
   [INFO] Total time: 1.321 s
   [INFO] Finished at: 2022-04-28T14:16:03+05:30
   [INFO] ------------------------------------------------------------------------

流程

1. 使用 mvn 命令建立一个 Maven 项目。该命令创建项目的目录结构以及 pom.xml 配置文件。

   语法

   $ mvn archetype:generate \
   -DgroupId=${group-to-which-your-application-belongs} \
   -DartifactId=${name-of-your-application} \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

   Example

   $ mvn archetype:generate \
   -DgroupId=com.example.app \
   -DartifactId=simple-webapp-example \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

2. 进入到应用程序根目录：

   语法

   $ cd <name-of-your-application>

   Example

   $ cd simple-webapp-example

3. 将生成的 pom.xml 文件的内容替换为以下文本：

   <?xml version="1.0" encoding="UTF-8"?>
   
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
   
     <groupId>com.example.app</groupId>
     <artifactId>simple-webapp-example</artifactId>
     <version>1.0-SNAPSHOT</version>
     <packaging>war</packaging>
   
     <name>simple-webapp-example Maven Webapp</name>
     <!-- FIXME change it to the project's website -->
     <url>http://www.example.com</url>
   
     <properties>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <maven.compiler.source>11</maven.compiler.source>
       <maven.compiler.target>11</maven.compiler.target>
     </properties>
   
     <dependencies>
       <dependency>
         <groupId>jakarta.servlet</groupId>
         <artifactId>jakarta.servlet-api</artifactId>
         <version>6.0.0</version>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.wildfly.security</groupId>
         <artifactId>wildfly-elytron-auth-server</artifactId>
         <version>1.19.0.Final</version>
       </dependency>
     </dependencies>
   
     <build>
       <finalName>${project.artifactId}</finalName>
       <plugins>
         <plugin>
           <groupId>org.wildfly.plugins</groupId>
           <artifactId>wildfly-maven-plugin</artifactId>
           <version>2.1.0.Final</version>
         </plugin>
       </plugins>
     </build>
   
   </project>

流程

1. 创建一个用于存储 Java 文件的目录。

   语法

   $ mkdir -p src/main/java/<path_based_on_artifactID>

   Example

   $ mkdir -p src/main/java/com/example/app

2. 前往新目录。

   语法

   $ cd src/main/java/<path_based_on_artifactID>

   Example

   $ cd src/main/java/com/example/app

3. 使用以下内容创建一个 securedServlet.java 文件：

   package com.example.app;
   
   import java.io.IOException;
   import java.io.PrintWriter;
   import java.security.Principal;
   import java.util.ArrayList;
   import java.util.Collection;
   import java.util.Iterator;
   import java.util.List;
   import java.util.Set;
   
   import jakarta.servlet.ServletException;
   import jakarta.servlet.annotation.WebServlet;
   import jakarta.servlet.http.HttpServlet;
   import jakarta.servlet.http.HttpServletRequest;
   import jakarta.servlet.http.HttpServletResponse;
   import org.wildfly.security.auth.server.SecurityDomain;
   import org.wildfly.security.auth.server.SecurityIdentity;
   import org.wildfly.security.authz.Attributes;
   import org.wildfly.security.authz.Attributes.Entry;
   /**
    * A simple secured HTTP servlet. It returns the user name and
    * attributes obtained from the logged-in user's Principal. If
    * there is no logged-in user, it returns the text
    * "NO AUTHENTICATED USER".
    */
   
   @WebServlet("/secured")
   public class SecuredServlet extends HttpServlet {
   
       @Override
       protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
           try (PrintWriter writer = resp.getWriter()) {
   
           	Principal user = req.getUserPrincipal();
           	SecurityIdentity identity = SecurityDomain.getCurrent().getCurrentSecurityIdentity();
           	Attributes identityAttributes = identity.getAttributes();
           	Set <String> keys = identityAttributes.keySet();
           	String attributes = "<ul>";
   
           	for (String attr : keys) {
           		attributes += "<li> " +  attr + " : " + identityAttributes.get(attr).toString() + "</li>";
           	}
   
           	attributes+="</ul>";
           	writer.println("<html>");
           	writer.println("  <head><title>Secured Servlet</title></head>");
           	writer.println("  <body>");
           	writer.println("    <h1>Secured Servlet</h1>");
           	writer.println("    <p>");
           	writer.print(" Current Principal '");
           	writer.print(user != null ? user.getName() : "NO AUTHENTICATED USER");
           	writer.print("'");
           	writer.print(user != null ? "\n" + attributes : "");
           	writer.println("    </p>");
           	writer.println("  </body>");
           	writer.println("</html>");
           }
       }
   
   }

4. 在应用程序根目录中，使用以下命令编译应用程序：

   $ mvn package
   ...
   [INFO] ------------------------------------------------------------------------
   [INFO] BUILD SUCCESS
   [INFO] ------------------------------------------------------------------------
   [INFO] Total time: 1.015 s
   [INFO] Finished at: 2022-04-28T17:48:53+05:30
   [INFO] ------------------------------------------------------------------------

5. 部署应用。

   $ mvn wildfly:deploy