📄 resin-security.xtp
字号:
<document><header> <product>resin</product> <title>Resin Security</title> <description> </description></header><body><localtoc/><s1 title="Quick Start"><p>The following sample shows how to protect a section of a web-sitewith a password, using a login form.</p><example title="WEB-INF/resin-web.xml - Simple Password Protection"><web-app xmlns="http://caucho.com/ns/resin"> <security-constraint url-pattern="/secure/*"> <auth-constraint role-name="*"/> <login uri="form:login-page=/login.jsp"/> </security-constraint> <authenticator uri="properties:password-digest=none"> <init> harry=quidditch,user </init> </authenticator></web-app></example><ul><li><security-constraint> protects a section of the web-app, i.e.providing an authorization context.</li><li><url-pattern> matches the URLs to be protected</li><li><auth-constraint> protects the web-app through login (as opposed toby IP address or by SSL)</li><li><login> specifies the login method</li><li><authenticator> defines the login users and passwords.The "properties:" authenticator specifies a simple .properties file user definition.</li><li>password-digest=none disables the default MD5-digest for thepasswords. Only recommended for examples.</li></ul></s1><s1 title="Management"><p>Since all Resin users will want to protectthe <code>/resin-admin</code> pages with an administration password,and protect any clustered management and deployment, Resin's top-level<management> tag includes a static, XML-based authentication context.The authenticator is automatically shared for all hosts and web-apps, sosimple sites can even use this authenticator configuration for theirsite-wide authentication.</p><example title="resin.xml"><resin xmlns="http://caucho.com/ns/resin"> <management"> <user name="admin" password="MD5HASH=="/> ... </management> ...</resin></example><p>The password is a hash of the user name, password, and the "resin"realm. The <code>/resin-admin</code> page includes a form to easily generatethe MD5 hash. You can also use the<a href="http://caucho.com/resin-javadoc/com/caucho/server/security/PasswordDigest.html">PasswordDigest</a> class to generate the digestprogrammatically.</p></s1><s1 title="Authentication"><p>Resin provides a basic set of authenticators covering the mostcommon cases. Applications which need custom authenticators can easilywrite their own extensions, described below.</p><s2 title="properties: - properties authentication"><example title="WEB-INF/resin-web.xml - inline properties"><web-app xmlns="http://caucho.com/ns/resin"> <authenticator uri="properties:password-digest=none"> <init> harry=quidditch,user,admin draco=mudblood,disabled,user </init> </authenticator></web-app></example><example title="WEB-INF/resin-web.xml - file property"><web-app xmlns="http://caucho.com/ns/resin"> <authenticator uri="properties:path=WEB-INF/users.properties"/></web-app></example><example title="WEB-INF/users.properties">harry=MD5HASH==,user,admin</example></s2><s2 title="xml: - xml authentication"><example title="WEB-INF/resin-web.xml - inline xml"><web-app xmlns="http://caucho.com/ns/resin"> <authenticator uri="properties:password-digest=none"> <init> <user name="harry" password="quidditch"/> </init> </authenticator></web-app></example><example title="WEB-INF/resin-web.xml - file xml"><web-app xmlns="http://caucho.com/ns/resin"> <authenticator uri="properties:path=WEB-INF/users.xml"/></web-app></example><example title="WEB-INF/users.xml"><users> <user name="harry password="MD5HASH==" roles="user,admin"/><users></example></s2><s2 title="custom authentication"><example title="WEB-INF/resin-web.xml - custom"><web-app xmlns="http://caucho.com/ns/resin"> <authenticator class="com.foo.MyAuthenticator"> <init> <foo>bar</foo> </init> </authenticator></web-app></example><example title="MyAuthenticator.java">package com.foo;import com.caucho.server.security;public class MyAuthenticator extends AbstractPasswordAuthenticator { private PasswordUser _user; public MyAuthenticator() { _user = new PasswordUser("harry", "quidditch", new String[] { "user" }); }192 public PasswordUser getUser(String userName) { if (userName.equals(_user.getName())) return _user; else return null; }}</example><p>It's also possible to register your custom authenticatr with Resin'suri-based configuration. You'll add a file in the <code>META-INF/services/com.caucho.config.uri</code> named<code>com.caucho.server.security.ServletAuthenticator</code> in the.jar file with the following contents:</p><example title="com.caucho.server.security.ServletAuthenticator">foo.my=com.foo.MyAuthenticator</example></s2><s2 title="Quick Start"><p>The easiest authenticator to understand is the <a href="#XmlAuthenticator">XmlAuthenticator</a>.It lets you put users and passwords directly in the configurationfile. The following example uses "Basic" authentication for login.Basic authentication asks the browser to pop open a window promptingfor a username and password. (Basic authentication is discouragedbecause it is not secure unless you use it with SSL, but it's theeasiest example.) The only user defined here is "Harry Potter" andhe has the password "quidditch". He also plays the"user" role.</p><example title="Using the XmlAuthenticator"><web-app xmlns="http://caucho.com/ns/resin"> ... <authenticator type="com.caucho.server.security.XmlAuthenticator"> <init> <user>Harry Potter:quidditch:user</user> <password-digest>none</password-digest> </init> </authenticator> <login-config auth-method="basic"/> <security-constraint url-pattern="/users-only/*" role-name="user"/> ...</web-app></example><p>In the above example, the <security-constraint> checksfor authorization. Only users playing the "user" role can accessthe /users-only directory.</p><p>Another often used authenticator is the <a href="#JdbcAuthenticator">JdbcAuthenticator</a>, which uses usernames, passwords, and roles stored in a database.</p><example><web-app xmlns="http://caucho.com/ns/resin"> ... <!-- Resin-specific JdbcAuthenticator --> <authenticator type='com.caucho.server.security.JdbcAuthenticator'> <init> <data-source>test</data-source> <password-query> SELECT password FROM LOGIN WHERE username=? </password-query> <cookie-auth-query> SELECT username FROM LOGIN WHERE cookie=? </cookie-auth-query> <cookie-auth-update> UPDATE LOGIN SET cookie=? WHERE username=? </cookie-auth-update> <role-query> SELECT role FROM LOGIN WHERE username=? </role-query> </init> </authenticator> <login-config auth-method='basic'/> <security-constraint url-pattern='/users-only/*' role-name='user'/> ...</web-app></example></s2><s2 title="login-config" type="defun"><p>Configures the login class. The <a href="webapp-tags.xtp#login-config">web.xml configuration</a> describes theconfiguration in more detail.</p><p>The login can be customized by selecting the <code>com.caucho.server.security.AbstractLogin</code>. The <var>type</var> attribute will select thatclass. More sophisticated applications may want to add their own customAbstractLogin class to replace the predefined values.</p><p>Typically a custom login would only be necessary if the applicationneeded a custom way of extracting credentials from the request.</p></s2><s2 title="auth-method" type="defun"><p>Selects the authentication method.</p><deftable title="auth-method values"><tr><th>auth-method</th><th>Meaning</th></tr><tr><td>basic</td><td>HTTP Basic authentication</td></tr><tr><td>digest</td><td>HTTP Digest authentication</td></tr><tr><td>form</td><td>Form-based authentication</td></tr></deftable></s2><s2 title="form-login-config" type="defun"><p>Configures authentication for forms. The login form hasspecific parameters that the servlet engine's login form processingunderstands. If the login succeeds, the user will see the originalpage. If it fails, she will see the error page.</p><deftable><tr><td>form-login-page</td><td>The page to be used to prompt the user login</td><td>none</td></tr><tr><td>form-error-page</td><td>The error page for unsuccessful login</td><td>none</td></tr><tr><td>internal-forward</td><td>Use an internal redirect on success or a sendRedirect</td><td>false</td></tr><tr><td>form-uri-priority</td><td>If true, the form's j_uri will override a stored URI</td><td>false</td></tr></deftable><p>The form itself must have the action <var>j_security_check</var>. Itmust also have the parameters <var>j_username</var> and <var>j_password</var>.Optionally, it can also have <var>j_uri</var> and<var>j_use_cookie_auth</var>. <var>j_uri</var> gives the next page to displaywhen login succeeds. <var>j_use_cookie_auth</var> allows Resin to send apersistent cookie to the user to make following login easier.</p><p><var>j_use_cookie_auth</var> gives control to the user whether to generatea persistent cookie. It lets you implement the "remember me" button. Bydefault, the authentication only lasts for a single session.</p><deftable title="j_security_check Parameters"><tr><th>Parameter</th><th>Meaning)</th></tr><tr><td>j_username</td><td>The user name</td></tr><tr><td>j_password</td><td>The password</td></tr><tr><td>j_uri</td><td>Resin extension for the successful displaypage (Optional).</td></tr><tr><td>j_use_cookie_auth</td><td>Resin extension to allow cookielogin (Optional).</td></tr></deftable><p>The following is an example of a servlet-standard login page:</p><example><form action='j_security_check' method='POST'><table><tr><td>User:<td><input name='j_username'><tr><td>Password:<td><input name='j_password'><tr><td colspan=2>hint: the password is 'quidditch'<tr><td><input type=submit></table></form></example></s2><s2 title="authenticator" version="Resin 1.1" type="defun"><p>Specifies a class to authenticate users. This Resin-specificoption lets you control your authentication. You can either create your own custom authenticator, or use Resin's JdbcAuthenticator.</p><p>The authenticator is responsible for taking the username andpassword and returning a UserPrincipal if the username and password match.</p><p>Users wanting to implement an authenticator should look at the JavaDocfor <a href="javadoc|com.caucho.server.security.ServletAuthenticator|"/>and <a href="javadoc|com.caucho.server.security.AbstractAuthenticator|"/>.To protect your application from API changes, you should extendAbstractAuthenticator rather than implementing Authenticator directly.</p></s2><s2 title="XmlAuthenticator" version="Resin 2.0.4"><p>The XmlAuthenticator (com.caucho.serer.security.XmlAuthenticator),stores the authentication in either an xml file or in the configurationitself.</p><p>When configuring the XmlAuthenticator in the resin.xml(or web.xml), each <var>user</var> adds a new configureduser. The value contains the username, password, and theroles the user plays.</p><example title="XmlAuthenticator in resin.xml"><authenticator type="com.caucho.server.security.XmlAuthenticator"> <init> <user>Harry Potter:quidditch:user,gryffindor</user>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -