如何处理数据库中用户的身份验证/授权? [英] How to handle authentication/authorization with users in a database?
问题描述
目前，我正在使用 JSF 2.0、Tomcat 7 和 MongoDB 进行 Web 项目.我有一个关于如何处理数据库中用户的会话管理和身份验证/授权的大问题.
Currently, I am working on a web project using JSF 2.0, Tomcat 7 and MongoDB. I have a big question of how to handle the session management and authentication/authorization with users in a database.
我想要的结构是这样的:只有登录的用户才能创建事件，每个人都可以看到创建的事件.
The structure I want is as follows: only logged in users can create events and everyone can see the created events.
create.xhtml--> 仅适用于登录用户.events.xhtml--> 对所有人公开.
create.xhtml--> only for logged in users.events.xhtml--> public for everyone.
我计划的基本结构是:
- 检查页面是否需要登录用户(例如
create.xhtml) - 如果是，请检查用户是否已登录
- 如果用户未登录，请转到
login.xhtml - 如果登录成功，请返回请求页面
- 保留用户已登录"信息，除非用户点击退出按钮.(我猜
@SessionScoped开始起作用了)
- Check if the page requires logged in user (e.g.
create.xhtml) - If yes, check if user is logged in
- If user is not logged in, go to
login.xhtml - If successfully logged in, come back to requested page
- Keep the "User is logged in" information unless user clicks log out
button. (there I guess
@SessionScopedgets into play)
问题是:
- 什么是不太复杂的方法?
- 我应该在哪里使用
@SessionScoped注释?在Create.java或LoginManager.java? - 对于我的问题，Spring 安全性看起来有点复杂，是吗?需要它?如果是，您能否解释一下该实现如何与 JSF 2.0 和 Mongo DB 协同工作?
推荐答案
有几个选项.选择哪个完全取决于您.就根据自己的情况客观权衡具体的优缺点.
There are several options. Which to choose is fully up to you. Just objectively weigh the concrete advantages and disadvantages conform your own situation.
只需在 web.xml 中声明一个 /secured/*、/app/*、/private/* 等
Just declare a <security-constraint> in web.xml which refers a security realm which is configured in servletcontainer. You can for your webapp specify URL pattern(s) which should be checked for login and/or role(s), e.g. /secured/*, /app/*, /private/*, etc.
在 Java EE 8 之前，不幸的是，您仍然需要以特定于 servletcontainer 的方式配置安全领域.它通常在 servletconainer 特定文档中描述.如果是 Tomcat 8，那就是 Realm HOW-TO.例如，JDBCRealm"部分描述了基于用户/角色表的基于数据库的领域.
Before Java EE 8, you unfortunately still need to configure a security realm in a servletcontainer-specific way. It's usually described in servletconainer-specific documentation. In case of Tomcat 8, that's the Realm HOW-TO. For example, a database based realm based on users/roles tables is described in section "JDBCRealm".
从 Java EE 8 开始，最终会有一个基于 JSR-的标准 API-375.
Since Java EE 8, there will finally be a standard API based on JSR-375.
- 相对快速且易于设置和使用.
- 自 Java EE 8 以来，终于有了一个强大且灵活的标准 API.
- 在 Java EE 8 之前，领域配置是特定于容器的.在 Java EE 8 中，新的 JSR-375 安全规范 应该在 JASPIC.
- 在 Java EE 8 之前，没有细粒度控制.
- 在 Java EE 8 之前，它非常简陋；没有记住我"，错误处理很差，没有基于权限的限制.
- 执行使用 j_security_check 在 Java EE/JSF 中进行用户身份验证 - 包含完整的代码示例
- Java EE 启动应用程序 - 示例 Web 应用程序(由我开发)，它还演示了 Java EE 8 身份验证Soteria(JSR-375 RI).
- Performing user authentication in Java EE / JSF using j_security_check - contains complete code examples
- Java EE kickoff application - example web application (developed by me) which also demonstrates Java EE 8 authentication with Soteria (the JSR-375 RI).
这允许进行更细粒度的控制，但是您将需要自己编写所有代码，并且您应该真正知道/理解应该如何实现这样的过滤器以避免潜在的安全漏洞.例如，在 JSF 方面，您可以通过 sessionMap.put("user", user) 将登录用户作为会话属性，并在 session.getAttribute 时检查过滤器(user") 不是 null.
This allows for much more fine grained control, but you're going to need to write all the code yourself and you should really know/understand how you should implement such a filter to avoid potential security holes. In JSF side, you could for example just put the logged-in user as a session attribute by sessionMap.put("user", user) and check in the filter if session.getAttribute("user") is not null.
- 细粒度控制.
- 完全独立于容器.
- 重新发明轮子；新功能需要大量代码.
- 作为初学者，您永远无法确定您的代码是否 100% 稳健.
- 有什么简单的方法可以预处理和重定向 GET 请求? - 包含介绍性解释和身份验证启动示例
- 会话到期时的授权重定向不适用于提交 JSF 表单，页面保持不变 - 包含更多扩展启动示例身份验证也包括 ajax 请求
- 如何控制 JSF 中的访问和权限? - 包含授权启动示例
- Is there any easy way to preprocess and redirect GET requests? - contains introducory explanation and kickoff example for authentication
- Authorization redirect on session expiration does not work on submitting a JSF form, page stays the same - contains more extended kickoff example for authentication which also covers ajax requests
- How control access and rights in JSF? - contains kickoff example for authorization
例如，Apache Shiro、Spring Security 等.这通常提供比标准容器管理的身份验证更细粒度的配置选项，您不需要自己为此编写任何代码，当然，需要登录页面和一些 (XML) 配置.
For example, Apache Shiro, Spring Security, etc. This offers usually much more fine grained configuration options than standard container managed authentication and you don't need to write any code for this yourself, expect of the login page and some (XML) configuration of course.
- 细粒度控制.
- 完全独立于容器.
- 没有重新发明轮子；最少自己的代码.
- 经过大量用户的彻底开发和测试，因此很可能 100% 稳健.
- 一些学习曲线.
- JSF2 -Shiro 教程 - 关于在 JSF2 web 应用程序中集成 Shiro 的广泛教程
- JSF2 - Shiro tutorial - an extensive tutorial on integrating Shiro in JSF2 webapp
这篇关于如何处理数据库中用户的身份验证/授权?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
