Tomcat Realm的使用

 Realm  是什么，干嘛的。我这里就不说了

讲讲怎样配置Realm

<Realm className="org.apache.catalina.realm.JDBCRealm" debug="99"
			driverName="oracle.jdbc.driver.OracleDriver"
			connectionURL="jdbc:oracle:thin:@192.168.9.172:1521:yfzx"
			connectionName="bi"
			connectionPassword="bi"
			userTable="users" userNameCol="user_name" userCredCol="passwd"
			userRoleTable="user_roles" roleNameCol="role_name"/>

  

 

className 请求提交到这个class

driverName 驱动名

 connectionURL 数据库URL

connectionName 账户

connectionPassword 数据库密码

userTable 用户表名

userNameCol 用户名涉及表的列

userCredCol 用户密码涉及表列

userRoleTable 角色表，这个一般和用户表相关联

roleNameCol 这个就是角色名

 

 

 

Tomcat 最终通过查询出rolename来决定你的访问权限。

在/WEB-INF/web.xml里面配置

<security-constraint>
  <display-name>OpenI Security Constraint</display-name>
  <web-resource-collection>
   <web-resource-name>Protected Area</web-resource-name>
   <url-pattern>*.jsp</url-pattern>
   <url-pattern>*.html</url-pattern>
   <url-pattern>*.htm</url-pattern>
   <url-pattern>*.iface</url-pattern>
   <url-pattern>*.faces</url-pattern>
   <url-pattern>*.jspx</url-pattern>
   <url-pattern>*.xml</url-pattern>
   <url-pattern>/rss</url-pattern>
   <url-pattern>/StreamChart</url-pattern>
  </web-resource-collection>
  <auth-constraint>
     <role-name>openi</role-name>
  </auth-constraint>
 </security-constraint>

 

 以上是指定 role_name为openi的用户可以访问 web-resource-collection 标签里面的所有 url-pattern

 

然后配置登陆异常的页面了

 <login-config>
  <auth-method>FORM</auth-method>
  <realm-name>OpenI 2.0</realm-name>
  <form-login-config>
   <form-login-page>/login.jsp</form-login-page>
   <form-error-page>/login.jsp?login_failed</form-error-page>
  </form-login-config>
 </login-config>

 

差不多就这样，但是实际中远远不止这么些

 

如：我们一般再增加一个自己的Filter来获得认证后的用户具体信息

 

 

 <filter>
  <filter-name>AuthorizationFilter</filter-name>
  <filter-class>org.openi.security.AuthorizationFilter</filter-class>
  <init-param>
   <param-name>project_list_page</param-name>
   <param-value>projectlist.htm</param-value>
  </init-param>
 </filter>

 

上面是自定义的Filter

<filter>
  <filter-name>WcfJspFilter</filter-name>
  <filter-class>org.openi.web.RequestFilter</filter-class>
  </filter> 
 <filter-mapping>
  <filter-name>AuthorizationFilter</filter-name>
  <url-pattern>*.iface</url-pattern>
 </filter-mapping>
 <filter-mapping>
  <filter-name>AuthorizationFilter</filter-name>
  <url-pattern>*.faces</url-pattern>
 </filter-mapping>
 <filter-mapping>
  <filter-name>AuthorizationFilter</filter-name>
  <url-pattern>*.jsp</url-pattern>
 </filter-mapping>
 <filter-mapping>
  <filter-name>AuthorizationFilter</filter-name>
  <url-pattern>*.jspx</url-pattern>
 </filter-mapping>
 <filter-mapping>
  <filter-name>AuthorizationFilter</filter-name>
  <url-pattern>*.htm</url-pattern>
 </filter-mapping>
 <filter-mapping>
  <filter-name>LogoutFilter</filter-name>
  <url-pattern>/killsession</url-pattern>
 </filter-mapping>
 <filter-mapping>
  <filter-name>WcfJspFilter</filter-name>
  <url-pattern>*.jsp</url-pattern>
 </filter-mapping>

 对相关的url访问过滤，在登陆成功之后 转向主页面时候会通过这个Filter

 

package org.openi.security;

import java.io.IOException;
import java.util.Enumeration;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.openi.application.Application;
import org.openi.project.ProjectContext;
import org.openi.users.User;
import org.openi.users.UserService;
import org.springframework.context.ApplicationContext;
import org.springframework.web.context.support.WebApplicationContextUtils;

public class AuthorizationFilter implements Filter {
	//private static final String APP_FILE_PATH = "/WEB-INF/application.xml";
	
	private static Logger logger = Logger.getLogger(AuthorizationFilter.class);
	
	private FilterConfig filterConfig;
	
	public void init(FilterConfig filterConfig) {
		this.filterConfig = filterConfig;
	}
	
	
	public static final String OPENI_ROLE_NAME = "openi";
	public static final String APP_ADMIN_ROLE_NAME = "app_admin";

	
	public void doFilter(ServletRequest request, ServletResponse response,
    		FilterChain chain) throws IOException, ServletException {
		ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(filterConfig.getServletContext());
		ProjectContext projectContext = (ProjectContext)appContext.getBean("projectContext");
		//request.setCharacterEncoding("UTF-8");
		/*
		Enumeration names = request.getParameterNames();
		while(names.hasMoreElements()) { 
			 String name = (String)names.nextElement();
			 String values[] = request.getParameterValues(name);
			 for(int i=0;i<values.length;i++) 
			 { 
				 values[i] = new String(values[i].getBytes("ISO-8859-1"),"utf-8");//(values[i]);
			 }
		}
	    */
		HttpServletRequest servletRequest = (HttpServletRequest) request;
		/*logger.info("---------------------servletRequest.getRequestURI() : " + servletRequest.getRequestURI());
		logger.info("---------------------servletRequest.getCharacterEncoding() : " + servletRequest.getCharacterEncoding());
		logger.info("---------------------servletRequest.getAttribute() : " + servletRequest.getAttribute("content"));
		logger.info("---------------------servletRequest.getParameter() : " + servletRequest.getParameter("content"));
		logger.info("---------------------servletRequest.getParameter(contentNow) : " + servletRequest.getParameter("contentNow"));
		logger.info("---------------------servletRequest.getQueryString() : " + servletRequest.getQueryString());
		logger.info("---------------------servletRequest.getRequestURI() : " + servletRequest.getRequestURL().toString());
		logger.info("---------------------servletRequest.getServletPath() : " + servletRequest.getServletPath());
		;
		*/
		// Glashfish invokes request filter before login, so check UserPrincipal for null
		
		if (projectContext.getUser() == null && servletRequest.getUserPrincipal() != null) {
			String userName = servletRequest.getUserPrincipal().getName();
			User user = null;
			try {
				UserService userService = (UserService)appContext.getBean("userService");
				if (userService != null) {
					user = userService.getUserById(userName);					
				}
			} catch (Throwable t) {}
			
			if (user == null) {
				user = new User();							
			} 
			
			if (user.getLanguage() == null ||  "".equals(user.getLanguage())) {
				user.setLanguage(servletRequest.getLocale().getLanguage());	
			} 
			
			user.setName(userName);	
			
			projectContext.setUser(user);
			if (servletRequest.isUserInRole(OPENI_ROLE_NAME)) {
				if (servletRequest.isUserInRole(APP_ADMIN_ROLE_NAME)) {
					projectContext.configureRoles(true, false, false);
				}/* else if (projectContext.getProject() != null 
						&& servletRequest.isUserInRole(projectContext.getProject().getProjectId() + " )) {
					if (servletRequest.isUserInRole(PRJ_ADMIN_ROLE_NAME)) {
						projectContext.configureRoles(false, true, false);
					} else if (servletRequest.isUserInRole(PRJ_USER_ROLE_NAME)) {
						projectContext.configureRoles(false, false, true);
					}
				}*/
			}
		}
		
		if (projectContext.getProject() == null && servletRequest.getUserPrincipal() != null) {
			try {
				if (!Application.isLoaded()) {
					((HttpServletRequest)request).getRequestDispatcher("/WEB-INF/pages/create_project.iface").forward(request, response);
					return;
				} else {
					logger.warn("project content directory is missing");
					
					if(!servletRequest.getRequestURI().endsWith("project_list.iface") 
							&& !servletRequest.getRequestURI().endsWith("blank.iface")){
						((HttpServletResponse)response).sendRedirect("project_list.iface");
						//((HttpServletRequest)request).getRequestDispatcher("project_list.iface").forward(request, response);
						return;
					}
				}				
			} catch (Exception e) {
				throw new ServletException("could forward request", e);
			}
		}
		/*
		Enumeration names1 = request.getParameterNames();
		while(names1.hasMoreElements()) { 
			 String name = (String)names1.nextElement();
			 String values[] = request.getParameterValues(name);
			 for(int i=0;i<values.length;i++) 
			 { 
				 values[i] = new String(values[i].getBytes("ISO-8859-1"),"utf-8");//(values[i]);
			 }
		}
		*/
		chain.doFilter(request, response);
	}
	
	public void destroy() {
				
	}
	
	
}

 通过上面这个类就可以获得用户的具体信息，从而得到细粒度的控制。

 

 

完毕。高手不吝赐教！