默认“经过身份验证的角色”的角色名称是什么？在WebLogic中？如何在部署描述符中引用它？ [英] What is the role-name of the default "authenticated role" in WebLogic? How do I reference it in my deployment descriptor?

问题描述

我正在尝试在Web应用程序中实现身份验证机制，我正在WebLogic 12c实例上进行部署。我想限制只对经过身份验证的用户访问某些页面。

I'm attempting to implement an authentication mechanism in a web app, which I'm deploying on a WebLogic 12c instance. I want to restrict access to certain pages to only authenticated users.

我的问题在于如何定义我的安全部分的auth-constraint来执行此操作。这是我的web.xml的安全部分：

My problem is in figuring out how to define the auth-constraint of my security portion to do this. This is the security portion of my web.xml:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>secure</web-resource-name>
        <url-pattern>/secure/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>user</role-name>
    </auth-constraint>
</security-constraint>

<security-role>
    <description>Any User</description>
    <role-name>user</role-name>
</security-role>


<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>myrealm</realm-name>
    <form-login-config>
        <form-login-page>/login.html</form-login-page>
        <form-error-page>/auth_error.html</form-error-page>
    </form-login-config>
</login-config>

现在，身份验证工作正常，但是当我尝试访问任何安全页面，我很确定这是因为我没有任何用户映射到用户角色。我已经尝试为角色名称指定通配符（*），但这不起作用。

Right now, authentication works properly, but I get a 403 - Forbidden when I try to access any of the secure pages, and I'm fairly certain that this is because I don't have any users mapped to the "user" role. I've already tried specifying the wildcard (*) for role names, and that didn't work.

我宁愿不必配置任何映射。 WebLogic方面。 WebLogic文档指定有一个特殊的经过身份验证的角色会自动提供给任何进行身份验证的用户（请参阅 http://docs.oracle.com/cd/E14571_01/core.1111/e10043/introroles.htm#CJAGGDCA ）

I'd prefer to not have to configure any mappings on the WebLogic side. WebLogic documentation specifies that there is a special "Authenticated Role" that is automatically given to any user who authenticates (see http://docs.oracle.com/cd/E14571_01/core.1111/e10043/introroles.htm#CJAGGDCA)

该文档适用于11g - 与12c中的角色相同吗？如果是这样，我可以在我的web.xml中引用它来授予任何经过身份验证的用户的访问权限吗？它的角色名称是什么？

That documentation is for 11g - is the same role available in 12c? If so, can I reference it in my web.xml to grant access to any authenticated user? What would its role-name be?

推荐答案

我相信我找到了解决方案。

I believe I've found the solution.

我没有确定默认身份验证角色的名称，但WebLogic中似乎有一个名为users的隐式组，默认情况下所有用户都属于该组。该组似乎不会出现在管理控制台中的任何位置，但默认情况下所有用户似乎都属于它。

I didn't determine the name of a default authenticated role, but there seems to be an implicit group in WebLogic called "users", which all users belong to by default. It doesn't seem that this group shows up anywhere in the Admin Console, but all users seem to belong to it by default.

在我的web.xml中，我定义认证用户角色（名称并不重要）。然后，在weblogic.xml中，我将该角色映射到users组。这允许任何经过身份验证的用户访问受authenticated-users约束保护的页面。

In my web.xml, I define an "authenticated-users" role (the name isn't important). Then, in weblogic.xml, I map that role to the "users" group. This allows any page protected by the "authenticated-users" constraint to be accessed by any user who is authenticated.

我只使用FORM身份验证对此进行了测试，但是我看不出有什么理由不适用于其他方法。

I've only tested this using FORM authentication, but I don't see any reason why it wouldn't also work for other methods.

web.xml：

<security-constraint>
    <web-resource-collection>
        <web-resource-name>secure</web-resource-name>
        <url-pattern>/secure/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>authenticated-users</role-name>
    </auth-constraint>
</security-constraint>

<security-role>
    <description>Any User</description>
    <role-name>authenticated-users</role-name>
</security-role>


<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>myrealm</realm-name>
    <form-login-config>
        <form-login-page>/login_form.html</form-login-page>
        <form-error-page>/login_error.html</form-error-page>
    </form-login-config>
</login-config>

weblogic.xml

<?xml version="1.0" encoding="UTF-8"?>
<wls:weblogic-web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:wls="http://www.bea.com/ns/weblogic/90"
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/90/weblogic-web-app.xsd">

<wls:security-role-assignment>
    <wls:role-name>authenticated-users</wls:role-name>
    <wls:principal-name>users</wls:principal-name>
</wls:security-role-assignment>

这篇关于默认“经过身份验证的角色”的角色名称是什么？在WebLogic中？如何在部署描述符中引用它？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！