从纯客户端调用远程 EJB(基于 IIOP 的 RMI)时如何传播 JAAS 主题 [英] How to propagate JAAS Subject when calling a remote EJB (RMI over IIOP) from a pure client

问题描述

我正在测试 JAAS 主题的传播 带有 自定义 Principal 来自在原始 Java 运行时上运行的独立 EJB 客户端到 JavaEE 服务器.我的目标是 JBoss 和 WebSphere 实现.

I am testing the propagation of JAAS Subject with a custom Principal from a standalone EJB client running on a raw Java runtime to a JavaEE server. I am targeting both JBoss and WebSphere implementations.

根据这个论坛帖子，我预计它可以轻松与 JBoss 配合使用.

According to this forum thread I have expected it would work with JBoss easily.

这是我的 EJB 客户端代码片段:

Here is my EJB client code code snippet:

Subject subject = new Subject();
Principal myPrincipal = new MyPrincipal("me I myself");
subject.getPrincipals().add(myPrincipal);

PrivilegedExceptionAction<String> action = new PrivilegedExceptionAction<String>() {
    public String run() throws Exception {
            String result;
            System.out.println("Current Subject: " + Subject.getSubject(AccessController.getContext()));
            InitialContext ic = new InitialContext();
            Business1 b = (Business1) ic.lookup("StatelessBusiness1");
            result = b.getNewMessage("Hello World");
            return result;
        }
    };

result = subject.doAs(subject, action);
System.out.println("result "+result);

服务端代码为:

public String getNewMessage(String msg) {
    System.out.println("getNewMessage principal: " + sessionContext.getCallerPrincipal());
    System.out.println("Current Subject: " + Subject.getSubject(AccessController.getContext()));
    return "getNewMessage: " + msg;
}

可以肯定的是，即使这是默认行为，我也已将此部分添加到我的 ejb-jar.xml 会话 bean:

To be sure, even if it is the default behaviour, I have added this section to my ejb-jar.xml session bean:

<security-identity>
   <use-caller-identity/>
</security-identity>

我的会话 bean 不受任何角色的保护.

My session bean is not protected by any role.

根据 这个 IBM WebSphere 信息中心部分，我还启用了系统属性 com.ibm.CSI.rmiOutboundPropagationEnabled=true.

According to this IBM WebSphere infocenter section, I have also enabled the system property com.ibm.CSI.rmiOutboundPropagationEnabled=true.

从技术上讲，服务调用在 JBoss 或 WebSphere 上都能正常工作.但是包含我在客户端上创建的自定义主体的 JAAS 主题不会传播到服务器.或者当然，在 JNDI 上下文创建和 EJB 调用之前转储 Subject 是可以的.

Technically speaking the service call works properly either on JBoss or WebSphere. But the JAAS Subject including my custom principal created on the client is not propagated to the server. Or course, the Subject dumped just before JNDI context creation and EJB call is OK.

我为服务器和客户端运行相同的 Java 运行时版本 (IBM Java6 SR9 FP2...)，MyPrincipal 可序列化类在服务器 ClassPath (AppServer/lib/extcode> 用于 WebSphere，server/default/lib 用于 JBoss)

I run the same Java runtime version for server and client (IBM Java6 SR9 FP2...), MyPrincipal serializable class is available in server ClassPath (AppServer/lib/ext for WebSphere, server/default/lib for JBoss)

WebSphere 转储:

WebSphere dumps:

[8/31/12 11:56:26:514 CEST] 00000024 SystemOut     O getNewMessage principal: UNAUTHENTICATED
[8/31/12 11:56:26:515 CEST] 00000024 SystemOut     O Current Subject: null

JBoss 转储:

 12:30:20,540 INFO  [STDOUT] getNewMessage principal: anonymous
 12:30:20,540 INFO  [STDOUT] Current Subject: null

当然，我错过了某种魔法咒语.你知道是哪一个吗?

For sure, I have missed some kind of magic spell. Do you know which one ?

推荐答案

我怀疑您没有在 WAS 服务器上启用安全性.由于未启用安全性且您未向 WAS 进行身份验证，因此没有凭据.因此，您对 getCallerPrincipal 的调用将返回 UNAUTHENTICATED.

I suspect you don't have security enabled on the WAS server. Because security is not enabled and you didn't authenticate to WAS, there is no credential. Thus your call to getCallerPrincipal is returning UNAUTHENTICATED.

如果您在 WAS 中打开应用程序安全性，则必须通过 CSIv2 协议.在独立客户端中创建您自己的 JAAS 主题不会这样做.如果可以，那么任何人都可以创建嘿，是我"凭证并登录到他们想要的任何远程 EJB.

If you turn on application security in WAS, you'll have to authenticate via the CSIv2 protocol. Creating your own JAAS subject in a standalone client will not do it. If it could, then anyone could create a "hey, it's me" credential and login to any remote EJB they wanted.

通过将您的主题附加到正在运行的执行线程，您的代码将在服务器上运行.跨线路流动主题/凭证需要一个协议来影响主题信息的序列化并确保在凭证中声明身份的一方的信任.从独立客户端，WAS 以基本授权、LTPA 和 kerberos 的形式接受用户信息.这可以在管理控制台内的入站 CSIv2 配置上进行配置.它记录在我之前引用的信息中心链接中.

Your code will work on the server by attaching your subject to the running thread of execution. Flowing subjects/credentials across the wire requires a protocol to effect the serialization of the subject info and ensure trust of the party asserting the identity in the credential. From a standalone client, WAS accepts user info in the form of basic authorization, LTPA, and kerberos. This can be configured on an inbound CSIv2 configuration within the admin console. It's documented in the Info Center link I referenced earlier.

这很有趣.祝你好运.

这篇关于从纯客户端调用远程 EJB(基于 IIOP 的 RMI)时如何传播 JAAS 主题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！