OAuth-JAX-RS-设置安全网页 [英] OAuth - JAX-RS - Setting up secure webpage
问题描述
我有一个JAX-RS项目，我需要使用OAuth保护1个特定的页面，如果可能的话，我希望所有内容都在1个类中.
I'm having a JAX-RS project, I need to secure 1 specific page with OAuth, if possible I would like to have everything in 1 class.
关于我搜索的内容似乎没有合适的指南或教程.
There seems to be no fitting guide or tutorial on what I searched.
这是我到目前为止尝试过的:
Here's what I've tried so far:
原始课程:
@Path("/topsecret")
@Produces(MediaType.TEXT_PLAIN)
public class TopSecretRestService extends AbstractRestService {
@GET
@Path("/")
public Response getSecret() {
String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
return Response.status(200).entity(output).build();
}
}
Steeplesoft的解决方案:(不断使所有内容出错)
Steeplesoft's solution: (keeps giving errors on everything)
@Path("/topsecret")
@Produces(MediaType.TEXT_PLAIN)
public class TopSecretRestService extends AbstractRestService {
@Path("/")
@GET
public Response authorize(@Context HttpServletRequest request)
throws URISyntaxException, OAuthSystemException {
try {
OAuthAuthzRequest oauthRequest =
new OAuthAuthzRequest(request);
OAuthIssuerImpl oauthIssuerImpl =
new OAuthIssuerImpl(new MD5Generator());
//build response according to response_type
String responseType =
oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE);
OAuthASResponse.OAuthAuthorizationResponseBuilder builder =
OAuthASResponse.authorizationResponse(request,
HttpServletResponse.SC_FOUND);
// 1
if (responseType.equals(ResponseType.CODE.toString())) {
final String authorizationCode =
oauthIssuerImpl.authorizationCode();
database.addAuthCode(authorizationCode);
builder.setCode(authorizationCode);
}
String redirectURI =
oauthRequest.getParam(OAuth.OAUTH_REDIRECT_URI);
final OAuthResponse response = builder
.location(redirectURI)
.buildQueryMessage();
URI url = new URI(response.getLocationUri());
return Response.status(response.getResponseStatus())
.location(url)
.build();
String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
return Response.status(200).entity(output).build();
} catch (OAuthProblemException e) {
// ...
}
}
}
Google的解决方案(似乎最简单，但找不到合适的罐子)
Google's solution (seems easiest but cannot find the fitting jar's)
@GET
@Path("/")
public Response getSecret() {
OAuthService oauth = OAuthServiceFactory.getOAuthService();
String scope = "https://www.googleapis.com/auth/userinfo.email";
Set<String> allowedClients = new HashSet<>();
allowedClients.add("407408718192.apps.googleusercontent.com"); // list your client ids here
try {
User user = oauth.getCurrentUser(scope);
String tokenAudience = oauth.getClientId(scope);
if (!allowedClients.contains(tokenAudience)) {
throw new OAuthRequestException("audience of token '" + tokenAudience
+ "' is not in allowed list " + allowedClients);
}
// proceed with authenticated user
String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
return Response.status(200).entity(output).build();
} catch (OAuthRequestException ex) {
// handle auth error
// ...
} catch (OAuthServiceFailureException ex) {
// optionally, handle an oauth service failure
// ...
}
}
网站和其他问题调查了:
Sites and other questions looked into:
使用OAuth保护jax-rs -答案由asker提供，非常简短没有详细信息
Securing jax-rs with OAuth -- answer provided by asker, very short and no details
Jax RS REST API- OAuth 2.0和Control Origin -由问问者提供的答案，不是同一个问题
Jax RS REST API - OAuth 2.0 and Control Origin -- answer provided by asker, not the same problem
http://cxf.apache.org/docs/jax-rs -oauth2.html 带有oauth2的jax-rs教程
http://cxf.apache.org/docs/jax-rs-oauth2.html tutorial on jax-rs with oauth2
注意:我对OAuth和jax-rs都很陌生
推荐答案
使用JAX-RS编写的最简单的工作示例是 java-oauth-server .它是一种授权服务器实施，不仅支持OAuth 2.0( RFC 6749 和其他)，而且a href ="http://openid.net/connect/" rel ="nofollow"> OpenID Connect .
The simplest working example written using JAX-RS is java-oauth-server. It is an authorization server implementation that supports not only OAuth 2.0 (RFC 6749 and others) but also OpenID Connect.
如果要查找的不是授权服务器实现而是资源服务器实现，请参见 java-resource -服务器.
If you are looking for not an authorization server implementation but a resource server implementation, see java-resource-server.
授权服务器是颁发访问令牌的服务器. 资源服务器是引用访问令牌并返回请求数据的服务器.这两台服务器在逻辑上是不同的，但是如果您愿意，也可以在一台服务器上实现它们.我不知道要实现哪个服务器.
An authorization server is a server that issues access tokens. A resource server is a server that refers to access tokens and returns requested data. These two servers are logically different things, but they can be implemented on one server if you wish. I could not figure out which server you want to implement.
答复者是java-oauth-server和java-resource-server的作者.
这篇关于OAuth-JAX-RS-设置安全网页的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
