代码之家 › 专栏 › 技术社区 › sixtyfootersdude

对jboss web.xml的更改无效

web.xml jboss tomcat web-services java

sixtyfootersdude · 技术社区 · 14 年前

我刚刚将它添加到我的jboss服务器上的web.xml中。但没有效果。我仍然可以连接到不使用双向证书交换的端口。有人有想法吗?

<!-- Force SSL for entire site as described here: http://wiki.metawerx.net/wiki/ForcingSSLForSectionsOfYourWebsite -->
<security-constraint>

        <!-- defines resources to be protected (in this case everything)-->
        <web-resource-collection>
                <!-- name for the resource, can be anything you like -->
                <!-- Question: is this referenced anywhere else? -->
                <web-resource-name>
                        Entire Application
                </web-resource-name>

                <!-- protect the entire application -->
                <url-pattern>
                        /*
                </url-pattern>
        </web-resource-collection>



        <!-- defines protection level for protected resource -->
        <user-data-constraint>
                <!-- data cannot be observed or changed                                 -->
                <!-- how it works in tomcat:                                            -->
                <!--    if (set to integral or confidential && not using ssl)           -->
                <!--            redirect sent to client, redirecting them to same url   -->
                <!--            but using the port defined in the redirect port         -->
                <!--            attribute in the <Connector> element of server.xml      -->
                <!--            default is 443, so in other words user is redirected    -->
                <!--            to same page using ssl.                                 -->
                <!-- BUT it is differnt for JBOSS!!  See this link: http://wiki.metawerx.net/wiki/ForcingSSLForSectionsOfYourWebsite -->
                <transport-guarantee>
                        CONFIDENTIAL
                </transport-guarantee>
        </user-data-constraint>

</security-constraint>

<login-config>

        <!-- Client-side SSL certificate based authentication.  The cert is passed to the server to authenticate -->
        <!-- I am pretty sure that CLIENT-CERT should have a dash NOT an underscore see: http://www.mail-archive.com/tomcat-user@jakarta.apache.org/msg139845.html -->
        <!-- CLIENT-CERT uses a client's AND server's certificates.  See: http://monduke.com/2006/01/19/the-mysterious-client-cert/ -->
        <auth-method>
                CLIENT-CERT
        </auth-method>     
</login-config>

更新

实际上,我在原来的帖子中似乎犯了一个错误。

web.xml确实会阻止用户使用http(下面的端口C)连接到web服务。但是,仍然允许用户连接到不强制用户进行身份验证的端口(端口B)。我认为用户应该能够连接到端口A(它有 clientAuth="true" )但我认为人们不应该连接到端口B(它有 clientAuth="false" )

摘录自server.xml

  <Connector port="<A>" ... SSLEnabled="true"
       ...
       scheme="https" secure="true" clientAuth="true"
       keystoreFile="... .keystore"
       keystorePass="pword"
       truststoreFile="... .keystore"
       truststorePass="pword"
       sslProtocol="TLS"/>

  <Connector port="<B>" ... SSLEnabled="true"
       ...
       scheme="https" secure="true" clientAuth="false"
       keystoreFile="... .keystore"
       keystorePass="pword" sslProtocol = "TLS" />


  <Connector port="<C>" ...
     />

2 回复 | 直到 11 年前

Arjan Tijms UML GURU 11 年前

我假设港口 <C> 是HTTP,因为您已经配置了 <transport-guarantee> CONFIDENTIAL </transport-guarantee> 因此港口 <C & GT; 被封锁了。

端口 <B> 是否使用满足 <运输保证>机密</运输保证> 因此不会阻塞。

web.xml配置中缺少一些元素。您的Web资源没有任何授权限制。因此,当您从端口访问时 <B & GT; 即使您没有授权,您仍然有权访问资源,因为您没有对资源设置任何授权限制。

你需要有 <security-role> 包含 <role-name> 可以访问此应用程序。

<security-constraint> 对于 <web-resource-collection> 应该有 <auth-constraint> 告诉哪个 <角色名称& GT; 将限制访问和其他人。

上面配置的角色是JavaEE角色。 容器(JBASS)需要被配置为将身份验证的角色映射到JavaEE角色。

参考文献:

http://java.sun.com/javaee/5/docs/tutorial/doc/bncbe.html

http://community.jboss.org/wiki/RoleMappingLoginModule

上述web.xml的更新副本

<!-- Force SSL for entire site as described here: http://wiki.metawerx.net/wiki/ForcingSSLForSectionsOfYourWebsite -->
<security-constraint>

        <!-- defines resources to be protected (in this case everything)-->
        <web-resource-collection>
                <!-- name for the resource, can be anything you like -->
                <!-- Question: is this referenced anywhere else? -->
                <web-resource-name>
                        Entire Application
                </web-resource-name>

                <!-- protect the entire application -->
                <url-pattern>
                        /*
                </url-pattern>
        </web-resource-collection>

        <auth-constraint>
            <description>Authorized Roles</description>
            <role-name>ALL_AUTHENTICATED</role-name>
        </auth-constraint>


        <!-- defines protection level for protected resource -->
        <user-data-constraint>
                <!-- data cannot be observed or changed                                 -->
                <!-- how it works in tomcat:                                            -->
                <!--    if (set to integral or confidential && not using ssl)           -->
                <!--            redirect sent to client, redirecting them to same url   -->
                <!--            but using the port defined in the redirect port         -->
                <!--            attribute in the <Connector> element of server.xml      -->
                <!--            default is 443, so in other words user is redirected    -->
                <!--            to same page using ssl.                                 -->
                <!-- BUT it is differnt for JBOSS!!  See this link: http://wiki.metawerx.net/wiki/ForcingSSLForSectionsOfYourWebsite -->
                <transport-guarantee>
                        CONFIDENTIAL
                </transport-guarantee>
        </user-data-constraint>

</security-constraint>

<login-config>

        <!-- Client-side SSL certificate based authentication.  The cert is passed to the server to authenticate -->
        <!-- I am pretty sure that CLIENT-CERT should have a dash NOT an underscore see: http://www.mail-archive.com/tomcat-user@jakarta.apache.org/msg139845.html -->
        <!-- CLIENT-CERT uses a client's AND server's certificates.  See: http://monduke.com/2006/01/19/the-mysterious-client-cert/ -->
        <auth-method>
                CLIENT-CERT
        </auth-method>     
</login-config>
<security-role>
    <description>All authenticated users</description>
    <role-name>ALL_AUTHENTICATED</role-name>
</security-role>

在安全性方面,有两件事:身份验证和授权。

认证: 验证用户是否是主题并授予用户某些主体;“您是谁”的行为。

授权: 验证是否允许用户访问某个资源的行为;“您可以做什么”。

<auth-method> 告诉你如何认证用户或者如何询问你是谁。如果用户没有客户端证书,则他是未经身份验证的用户。它不能告诉用户可以做什么。

然而 <授权限制 是你可以做的。如果你放 <授权限制 ,则只有其中提到的角色才能访问相应的Web资源。您仍然可以拥有未经身份验证但被授权访问某些资源(如果资源未被约束到证书角色)的用户。

brabster 14 年前

在您进行更改后,是否重新加载了Web应用程序?