Java 我在camel下使用apacheshiro,无法将组映射到具有ldap/activedirectory的角色
我正在用西罗和骆驼。我可以使用activedirectory(ldap)对用户进行身份验证,但无法将角色中的用户组映射到用户权限。camel需要绝对的权限才能工作 这是我的config.ini:Java 我在camel下使用apacheshiro,无法将组映射到具有ldap/activedirectory的角色,java,authentication,active-directory,shiro,Java,Authentication,Active Directory,Shiro,我正在用西罗和骆驼。我可以使用activedirectory(ldap)对用户进行身份验证,但无法将角色中的用户组映射到用户权限。camel需要绝对的权限才能工作 这是我的config.ini: [main] authcStrategy = org.apache.shiro.authc.pam.FirstSuccessfulStrategy securityManager.authenticator.authenticationStrategy = $authcStrategy active
[main]
authcStrategy = org.apache.shiro.authc.pam.FirstSuccessfulStrategy
securityManager.authenticator.authenticationStrategy = $authcStrategy
activeDirectoryRealm = org.apache.shiro.realm.activedirectory.ActiveDirectoryRealm
activeDirectoryRealm.systemUsername=cn=padl,cn=Users,dc=comune,dc=prato,dc=local
activeDirectoryRealm.systemPassword=xxxxxxxxxxxxxxxxxxxxxxx
activeDirectoryRealm.url = ldap://172.16.1.98:389
activeDirectoryRealm.groupRolesMap = "CN=menu_ufficiomobile_ania,OU=Menu,OU=Gruppi,OU=ComuneDiPrato,DC=comune,DC=prato,DC=local":"menu_ufficiomobile_ania"
securityManager.realms = $activeDirectoryRealm
[users]
test = test,menu_ufficiomobile_passicarrabili, menu_ufficiomobile_rubati,menu_ufficiomobile_ordinanze, menu_ufficiomobile_ztl, menu_ufficiomobile_cciaa, menu_ufficiomobile_ania, menu_ufficiomobile_anagrafe, menu_ufficiomobile_mctc, menu_ufficiomobile_pra
[roles]
menu_ufficiomobile_anagrafe = prato:anagrafe
menu_ufficiomobile_mctc = prato:mctc
menu_ufficiomobile_pra = prato:pra
menu_ufficiomobile_ania = prato:ania
menu_ufficiomobile_cciaa = prato:cacomm
menu_ufficiomobile_ztl = prato:ztl
menu_ufficiomobile_ordinanze = prato:ordinanze
menu_ufficiomobile_rubati = prato:rubati
menu_ufficiomobile_passicarrabili = prato:permessi
我的安全注入代码:
ShiroSecurityToken shiroSecurityToken = new ShiroSecurityToken(qr.getUserName(),qr.getPassword());
ShiroSecurityTokenInjector shiroSecurityTokenInjector = new ShiroSecurityTokenInjector(shiroSecurityToken, passPhrase);
arg0.getIn().setHeader("SHIRO_SECURITY_TOKEN", shiroSecurityTokenInjector.encrypt());
以及使用权限的路由代码:
from("seda:interrogaANIA").threads(1)
.setHeader("db", constant(Database.ANIA)).policy(aniaS)
.to("bean:interrogaANIA?method=interrogaBancaDati")
.to("seda:prefilter");
谢谢,
Mario所以,shiro的一个领域提供了三件事:
package org.apache.shiro.samples.web;
import java.util.Collection;
import java.util.Collections;
import org.apache.shiro.authz.Permission;
import org.apache.shiro.authz.SimpleRole;
import org.apache.shiro.authz.permission.RolePermissionResolver;
import org.apache.shiro.config.Ini;
import org.apache.shiro.realm.text.IniRealm;
public class IniRealmRolePermissionResolver implements RolePermissionResolver {
private LocalIniRealm realm;
public Collection<Permission> resolvePermissionsInRole(final String roleString) {
final SimpleRole role = this.realm.getRole(roleString);
return role == null ? Collections.<Permission>emptySet() : role.getPermissions();
}
public void setIni(final IniRealm ini) {
this.realm = new LocalIniRealm();
this.realm.setIni(ini.getIni());
this.realm.init();
}
private static class LocalIniRealm extends IniRealm {
@Override
protected SimpleRole getRole(final String rolename) {
return super
.getRole(rolename);
}
}
}
如果您真的不需要ini映射,您可以使用相同的概念,但可以大大简化事情
package org.apache.shiro.samples.web;
import org.apache.shiro.authz.Permission;
import org.apache.shiro.authz.permission.*;
import java.util.Collection;
import java.util.Collections;
public class SimpleRolePermissionResolver implements RolePermissionResolver, PermissionResolverAware {
private PermissionResolver permissionResolver = new WildcardPermissionResolver();
public void setPermissionResolver(PermissionResolver permissionResolver) {
this.permissionResolver = permissionResolver;
}
public Collection<Permission> resolvePermissionsInRole(String roleString) {
return Collections.<Permission>singleton(permissionResolver.resolvePermission(roleString));
}
}
谢谢你的详细回复,我一定会用的。只是一个问题:事实上,如果我可以选择,我不需要任意的角色/权限映射。用户位于多个组中,组名就是我要使用的角色。但据我所知,在camel.policy()中,我只能指定权限列表,不能指定角色列表。我说的对吗?我对camel没有任何经验,但从ShiroSecurityPolicy来看,似乎是的,您只能指定权限。但是,我已经编辑了我的答案,以包含SimpleRolePermissionResolver的选项。这可能会更好地为您服务。再次感谢您。我只不明白一件事:使用上面的新代码,如果用户自动地在组X中(没有.ini),那么它也有角色X,并且它可以使用我在.ini中指定的角色X的权限?我相信你所问的问题是由activeDirectoryRealm.GroupRoleMap解决的。但我可能误解了你的问题。现在我完全理解了你的代码,它应该包含在官方的shiro示例或shiro源代码中。我缺少的一点是,显然,activedirectoryRealm没有权限的概念,只有可以(可选和非自动)映射到角色的组。
package org.apache.shiro.samples.web;
import org.apache.shiro.authz.Permission;
import org.apache.shiro.authz.permission.*;
import java.util.Collection;
import java.util.Collections;
public class SimpleRolePermissionResolver implements RolePermissionResolver, PermissionResolverAware {
private PermissionResolver permissionResolver = new WildcardPermissionResolver();
public void setPermissionResolver(PermissionResolver permissionResolver) {
this.permissionResolver = permissionResolver;
}
public Collection<Permission> resolvePermissionsInRole(String roleString) {
return Collections.<Permission>singleton(permissionResolver.resolvePermission(roleString));
}
}
rolePermissionResolver = org.apache.shiro.samples.web.SimpleRolePermissionResolver
activeDirectoryRealm.rolePermissionResolver = $rolePermissionResolver