CustomAuthenticationMechanism在调用identityStoreHandler.validat

Question

我正在尝试创建一个自定义身份验证。当我我制作了一个简单的identityStore，用rols AF_ADMIN和AF_user将每个用户验证为访客。

登录时调用CustomAuthenticationMechanism，但idStoreHandler中的CredentialValidationResult没有callerGroups。所以Login-public.xhtml说我没有AF_ADMIN角色。

我遗漏了什么吗？

自定义身份验证机制

@AutoApplySession
@LoginToContinue
@ApplicationScoped
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {
@Inject
private IdentityStoreHandler idStoreHandler;
//@Override
public AuthenticationStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext) throws AuthenticationException {
final String ticket = request.getParameter("ticket");
if (ticket != null) {
CredentialValidationResult result = idStoreHandler.validate(new UsernamePasswordCredential(ticket, Arrays.toString("LOGIN_PASSWORD")));
if (result.getStatus() == VALID) {
return httpMessageContext.notifyContainerAboutLogin(result);
} else {
return httpMessageContext.responseUnauthorized();
}
}
return httpMessageContext.doNothing();
}
}

登录public.xhtml

...
<h1>Public</h1>
<div class="alert alert-danger" role="alert">
#{myBean.initBean()}
<h:outputText value="inRole(AF_ADMIN): #{request.isUserInRole('AF_ADMIN')}"/><br/>
<h:outputText value="requestURL: #{request.requestURL}"/><br/>
<h:outputText value="headerNames: #{request.headerNames}"/><br/>
#{requestScope['javax.servlet.error.status_code']}
#{requestScope['javax.servlet.error.message']}<br/>
#{messages['error.inesperat']}
</div>
...

登录private.xhtml

...
<h1>Public</h1>
<div class="alert alert-danger" role="alert">
#{myBean.initBean()}
<h:outputText value="inRole(AF_ADMIN): #{request.isUserInRole('AF_ADMIN')}"/><br/>
<h:outputText value="requestURL: #{request.requestURL}"/><br/>
<h:outputText value="headerNames: #{request.headerNames}"/><br/>
#{requestScope['javax.servlet.error.status_code']}
#{requestScope['javax.servlet.error.message']}<br/>
#{messages['error.inesperat']}
</div>
...

MyLoginIdentity存储

@ApplicationScoped
public class MyLoginIdentityStore implements IdentityStore {
private static final Logger log = LoggerFactory.getLogger(LoginIBIdentityStore.class);
public static final String USER = "user";
@Inject
HttpServletRequest request;
@Inject
UsuariServiceable userSvc;
@Override
public int priority() {
return 1;
}
@Override
public Set<ValidationType> validationTypes() {
return EnumSet.of(ValidationType.VALIDATE);
}
public CredentialValidationResult validate(UsernamePasswordCredential credential) {
return new CredentialValidationResult("guest", new HashSet<>(Arrays.asList("AF_ADMIN","AF_USER")));
}
@Override
public Set<String> getCallerGroups(CredentialValidationResult validationResult) {
return IdentityStore.super.getCallerGroups(validationResult);
}
}

web.xml

...
<security-constraint>
<display-name>app_public</display-name>
<web-resource-collection>
<web-resource-name>app_public</web-resource-name>
<url-pattern>/error.xhtml</url-pattern>
<url-pattern>/login</url-pattern>
<url-pattern>/login.xhtml</url-pattern>
<url-pattern>/login-public.xhtml</url-pattern>
<url-pattern>/resources/**</url-pattern>
<url-pattern>/javax.faces.resource/*</url-pattern>
</web-resource-collection>
</security-constraint>
<security-constraint>
<display-name>app</display-name>
<web-resource-collection>
<web-resource-name>accfor_auth</web-resource-name>
<description>paginas que requieren autentificacion</description>
<url-pattern>/*</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<description>Acceso a accfor</description>
<role-name>AF_ADMIN</role-name>
</auth-constraint>
</security-constraint>
...

Answer 1

默认validationTypes((方法返回VALIDATE和PROVIDE_GROUP。

问题是重写的验证类型方法只返回验证，而不返回提供组。

@Override
public Set<ValidationType> validationTypes() {
return EnumSet.of(ValidationType.VALIDATE, ValidationType.PROVIDE_GROUPS);
}