CustomAuthenticationMechanism 在调用 identityStoreHandler.validate

问题描述

我正在尝试创建自定义身份验证。 当我 我制作了一个简单的 identityStore，使用角色 AF_ADMIN 和 AF_USER 将每个用户验证为访客。

CustomAuthenticationMechanism 在登录时被调用，但来自 idStoreHandler 的 CredentialValidationResult 没有调用者组。 所以 Login-public.xhtml 说我没有 AF_ADMIN 角色。

我错过了什么吗？

自定义身份验证机制

@AutoApplySession
@LoginToContinue
@ApplicationScoped
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {

    @Inject
    private IdentityStoreHandler idStoreHandler;

    //@Override
    public AuthenticationStatus validateRequest(HttpServletRequest request,HttpServletResponse response,HttpMessageContext httpMessageContext) throws AuthenticationException {
        final String ticket = request.getParameter("ticket");

        if (ticket != null) {

            CredentialValidationResult result = idStoreHandler.validate(new UsernamePasswordCredential(ticket,Arrays.toString("LOGIN_PASSWORD")));

            if (result.getStatus() == VALID) {
                return httpMessageContext.notifyContainerAboutLogin(result);
            } else {
                return httpMessageContext.responseUnauthorized();
            }
        }

        return httpMessageContext.doNothing();
    }

}

login-public.xhtml

...
<h1>Public</h1>
<div class="alert alert-danger" role="alert">
    #{myBean.initBean()}
    <h:outputText value="inRole(AF_ADMIN): #{request.isUserInRole('AF_ADMIN')}"/><br/>
    <h:outputText value="requestURL: #{request.requestURL}"/><br/>
    <h:outputText value="headerNames: #{request.headerNames}"/><br/>
    #{requestScope['javax.servlet.error.status_code']}
    #{requestScope['javax.servlet.error.message']}<br/>
    #{messages['error.inesperat']}
</div>
...
    

login-private.xhtml

...
<h1>Public</h1>
<div class="alert alert-danger" role="alert">
    #{myBean.initBean()}
    <h:outputText value="inRole(AF_ADMIN): #{request.isUserInRole('AF_ADMIN')}"/><br/>
    <h:outputText value="requestURL: #{request.requestURL}"/><br/>
    <h:outputText value="headerNames: #{request.headerNames}"/><br/>
    #{requestScope['javax.servlet.error.status_code']}
    #{requestScope['javax.servlet.error.message']}<br/>
    #{messages['error.inesperat']}
</div>
...

MyLoginIdentityStory

@ApplicationScoped
public class MyLoginIdentityStore implements IdentityStore {

    private static final Logger log = LoggerFactory.getLogger(LoginIBIdentityStore.class);
    public static final String USER = "user";

    @Inject
    HttpServletRequest request;

    @Inject
    UsuariServiceable userSvc;

    @Override
    public int priority() {
        return 1;
    }

    @Override
    public Set<ValidationType> validationTypes() {
        return EnumSet.of(ValidationType.VALIDATE);
    }

    public CredentialValidationResult validate(UsernamePasswordCredential credential) {
        return new CredentialValidationResult("guest",new HashSet<>(Arrays.asList("AF_ADMIN","AF_USER")));
    }

    @Override
    public Set<String> getCallerGroups(CredentialValidationResult validationResult) {
        return IdentityStore.super.getCallerGroups(validationResult);
    }
}

web.xml

...
<security-constraint>
    <display-name>app_public</display-name>
    <web-resource-collection>
        <web-resource-name>app_public</web-resource-name>
        <url-pattern>/error.xhtml</url-pattern>
        <url-pattern>/login</url-pattern>
        <url-pattern>/login.xhtml</url-pattern>
        <url-pattern>/login-public.xhtml</url-pattern>
        <url-pattern>/resources/**</url-pattern>
        <url-pattern>/javax.faces.resource/*</url-pattern>
    </web-resource-collection>
</security-constraint>

<security-constraint>
    <display-name>app</display-name>

    <web-resource-collection>
        <web-resource-name>accfor_auth</web-resource-name>
        <description>paginas que requieren autentificacion</description>
        <url-pattern>/*</url-pattern>
        <http-method>POST</http-method>
        <http-method>GET</http-method>
    </web-resource-collection>

    <auth-constraint>
        <description>Acceso a accfor</description>
        <role-name>AF_ADMIN</role-name>
    </auth-constraint>

</security-constraint>
...

解决方法

默认的validationTypes() 方法返回VALIDATE 和PROVIDE_GROUPS。

问题是覆盖的验证类型方法只返回验证而不返回提供组。

@Override
public Set<ValidationType> validationTypes() {
    return EnumSet.of(ValidationType.VALIDATE,ValidationType.PROVIDE_GROUPS);
}