Jakarta EE安全性：使用身份存储

version: '3.6'
services:
  payara-micro:
    container_name: payara-micro
    image: payara/micro:latest
    ports:
      - 28080:8080
      - 26900:6900
    expose:
      - 8080
      - 6900
    volumes:
      - ../../../../servlet-with-ldap-identity-store/target/servlet-with-ldap-identity-store.war:/opt/payara/deployments/servlet-with-ldap-identity-store.war
      - ../../../../servlet-with-jdbc-identity-store/target/servlet-with-jdbc-identity-store.war:/opt/payara/deployments/servlet-with-jdbc-identity-store.war
  payara-full:
    container_name: payara-full
    image: payara/server-full:latest
    ports:
      - 18080:8080
      - 18081:8081
      - 14848:4848
      - 19009:9009
    expose:
      - 8080
      - 8081
      - 4848
      - 9009
    volumes:
      - ../../../../servlet-with-ldap-identity-store/target/servlet-with-ldap-identity-store.war:/opt/payara/deployments/servlet-with-ldap-identity-store.war
      - ../../../../servlet-with-jdbc-identity-store/target/servlet-with-jdbc-identity-store.war:/opt/payara/deployments/servlet-with-jdbc-identity-store.war
      - ./scripts/init.sql:/opt/payara/init.sql

...
      <plugin>
        <groupId>com.dkanejs.maven.plugins</groupId>
        <artifactId>docker-compose-maven-plugin</artifactId>
        <inherited>false</inherited>
        <executions>
          <execution>
            <id>up</id>
            <phase>install</phase>
            <goals>
              <goal>up</goal>
            </goals>
            <configuration>
              <composeFile>${project.basedir}/src/main/resources/docker-compose.yml</composeFile>
              <detachedMode>true</detachedMode>
              <removeOrphans>true</removeOrphans>
            </configuration>
          </execution>
          <execution>
            <id>down</id>
            <phase>clean</phase>
            <goals>
              <goal>down</goal>
            </goals>
            <configuration>
              <composeFile>${project.basedir}/src/main/resources/docker-compose.yml</composeFile>
              <removeVolumes>true</removeVolumes>
              <removeOrphans>true</removeOrphans>
            </configuration>
          </execution>
        </executions>
      </plugin>
...

@ApplicationScoped
@BasicAuthenticationMechanismDefinition(realmName="admin-realm")
@DatabaseIdentityStoreDefinition(
  dataSourceLookup = "${'java:global/H2'}",
  callerQuery = "select password from caller where name = ?",
  groupsQuery = "select group_name from caller_groups where caller_name = ?"
)
public class JdbcIdentityStoreConfig{}

curl http://localhost:18080/servlet-with-jdbc-identity-store/secured -u "admin:passadmin"

    <dependency>
      <groupId>com.unboundid</groupId>
      <artifactId>unboundid-ldapsdk</artifactId>
    </dependency>

...
dn: uid=admin,ou=caller,dc=payara,dc=fish
objectclass: top
objectclass: uidObject
objectclass: person
uid: admin
cn: Administrator
sn: Admin
userPassword: passadmin

dn: uid=user,ou=caller,dc=payara,dc=fish
objectclass: top
objectclass: uidObject
objectclass: person
uid: user
cn: User
sn: User
userPassword: passuser
...
dn: cn=admin-role,ou=group,dc=payara,dc=fish
objectclass: top
objectclass: groupOfNames
cn: admin-role
member: uid=admin,ou=caller,dc=payara,dc=fish

dn: cn=user-role,ou=group,dc=payara,dc=fish
objectclass: top
objectclass: groupOfNames
cn: user-role
member: uid=admin,ou=caller,dc=payara,dc=fish
member: uid=user,ou=caller,dc=payara,dc=fish
...

@ApplicationScoped
@BasicAuthenticationMechanismDefinition(realmName="admin-realm")
@LdapIdentityStoreDefinition(
  url = "ldap://localhost:33389",
  callerBaseDn = "ou=caller,dc=payara,dc=fish",
  groupSearchBase = "ou=group,dc=payara,dc=fish")
public class LdapIdentityStoreConfig{}

@WebServlet("/secured")
@DeclareRoles({ "admin-role", "user-role" })
@ServletSecurity(@HttpConstraint(rolesAllowed = "admin-role"))
public class LdapIdentityStoreServlet extends HttpServlet
{
  @Override
  protected void doGet(HttpServletRequest request, HttpServletResponse response)
    throws IOException
  {
    response.getWriter().write("This is a secured servlet \n");
    Principal principal = request.getUserPrincipal();
    String user = principal == null ? null : principal.getName();
    response.getWriter().write("User name: " + user + "\n");
    response.getWriter().write("\thas role \"admin-role\": " + request.isUserInRole("admin-role") + "\n");
    response.getWriter().write("\thas role \"user-role\": " + request.isUserInRole("user-role") + "\n");
  }
}

@Startup
@Singleton
public class LdapSetup
{
  private InMemoryDirectoryServer directoryServer;

  @PostConstruct
  public void init()
  {
    try
    {
      InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=fish");
      config.setListenerConfigs(
        new InMemoryListenerConfig("myListener", null, 33389, null, null, null));
      directoryServer = new InMemoryDirectoryServer(config);
      directoryServer.importFromLDIF(true,
        new LDIFReader(this.getClass().getResourceAsStream("/users.ldif")));
      directoryServer.startListening();
    } catch (LDAPException e)
    {
      throw new IllegalStateException(e);
    }
  }

  @PreDestroy
  public void destroy()
  {
    directoryServer.shutDown(true);
  }
}

  @Container
  private static GenericContainer payara =
    new GenericContainer("payara/micro:latest")
      .withExposedPorts(8080)
      .withCopyFileToContainer(MountableFile.forHostPath(
        Paths.get("target/servlet-with-ldap-identity-store.war")
          .toAbsolutePath(), 0777), "/opt/payara/deployments/test.war")
      .waitingFor(Wait.forLogMessage(".* Payara Micro .* ready in .*\\s", 1))
      .withCommand(
        "--noCluster --deploy /opt/payara/deployments/test.war --contextRoot /test");

@Test
public void testGetSecuredPageShouldSucceed() throws IOException
{
  given()
   .contentType(ContentType.TEXT)
   .auth().basic("admin", "passadmin")
   .when()
   .get(uri)
   .then()
   .assertThat().statusCode(200)
   .and()
   .body(containsString("admin-role"))
   .and()
   .body(containsString("admin-role"));
}

curl http://localhost:18080/servlet-with-ldap-identity-store/secured -u "admin:passadmin"

curl http://localhost:28080/servlet-with-ldap-identity-store/secured -u "admin:passadmin"