Wildfly 9 http到https

Question

我想将请求从HTTP重定向到HTTPS。我用的是Wildfly9。在谷歌搜索后，我发现了以下内容，但它不起作用。我希望有人

<subsystem xmlns="urn:jboss:domain:undertow:2.0">
    <buffer-cache name="default"/>
    <server name="default-server">
        <http-listener name="default" socket-binding="http" redirect-socket="https"/>
        <https-listener name="https" socket-binding="https" security-realm="SSLRealm"/>
        <host name="default-host" alias="localhost">
            <location name="/" handler="welcome-content"/>
            <filter-ref name="server-header"/>
            <filter-ref name="x-powered-by-header"/>
        </host>
    </server>
    <servlet-container name="default">
        <jsp-config/>
        <websockets/>
    </servlet-container>
    <handlers>
        <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
    </handlers>
    <filters>
        <response-header name="server-header" header-name="Server" header-value="WildFly/9"/>
        <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
    </filters>
</subsystem>

Answer 1

首先，我以Wildfly9.0.1.final为基础，假设您只是试图通过HTTPS启用SSL，并不担心身份验证。我刚花了一天的时间想清楚这一切。完成以下文档：

https://docs.jboss.org/author/display/wfly9/admin+guide

您要做的第一件事是创建您的密钥存储库，如文档中所述。

keytool -genkey -alias MY_ALIAS -keyalg RSA -keystore MY_KEYSTORE_FILENAME -validity 365`

<security-realm name="ApplicationRealm">
    <server-identities>
        <ssl>
            <keystore path="MY_KEYSTORE_FILENAME" relative-to="jboss.server.config.dir" keystore-password="MY_PASSWORD" alias="MY_ALIAS" key-password="MY_PASSWORD"/>
        </ssl>
    </server-identities>
    <authentication>
        <local default-user="$local" allowed-users="*" skip-group-loading="true"/>
        <properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
    </authentication>
    <authorization>
        <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
    </authorization>
</security-realm>

注意:MY_KEYSTORE_FILENAME、MY_ALIAS和MY_PASSWORD必须与创建密钥时提供的值匹配。

现在，文档变得有点棘手。您现在需要向下滚动一点来执行下一步，但不幸的是，它没有告诉您这样做。现在您已经在Wildfly中安装了keystore，并在适当的安全领域中进行了配置，您需要安装HTTPS侦听器并将其链接到keystore。

https://docs.jboss.org/author/display/wfly9/admin+guide#adminguide-httpslistener

Https侦听器提供对服务器的安全访问。最重要的配置选项是security realm，它定义SSL安全上下文。

不幸的是，文档与security-realm属性并不一致（以前在ManagementRealm中安装keystore，这里在ssl-realm中引用它）。由于我将密钥存储放在ApplicationRealm中，所以我们需要这样引用它。

另外，为了澄清，您需要将其放在undertow子系统中。下面是我插入的内容，就在http-listener标记下面：

<https-listener name="httpsServer" socket-binding="https" security-realm="ApplicationRealm"/>

<subsystem xmlns="urn:jboss:domain:undertow:2.0">
    <buffer-cache name="default"/>
    <server name="default-server">
        <http-listener name="default" socket-binding="http" redirect-socket="https"/>
        <https-listener name="httpsServer" socket-binding="https" security-realm="ApplicationRealm"/>
        <host name="default-host" alias="localhost">
            <location name="/" handler="welcome-content"/>
            <filter-ref name="server-header"/>
            <filter-ref name="x-powered-by-header"/>
        </host>
    </server>
    <servlet-container name="default">
        <html" target="_blank">jsp-config/>
        <websockets/>
    </servlet-container>
    <handlers>
        <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
    </handlers>
    <filters>
        <response-header name="server-header" header-name="Server" header-value="WildFly/9"/>
        <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
    </filters>
</subsystem>

<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
    <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
    <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
    <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
    <socket-binding name="http" port="${jboss.http.port:8080}"/>
    <socket-binding name="https" port="${jboss.https.port:8443}"/>
    <socket-binding name="iiop" interface="unsecure" port="3528"/>
    <socket-binding name="iiop-ssl" interface="unsecure" port="3529"/>
    <socket-binding name="txn-recovery-environment" port="4712"/>
    <socket-binding name="txn-status-manager" port="4713"/>
    <outbound-socket-binding name="mail-smtp">
        <remote-destination host="localhost" port="25"/>
    </outbound-socket-binding>
</socket-binding-group>

第一步是创建SSL密钥：

keytool -genkeypair -alias serverkey -keyalg RSA -keysize 2048 -validity 7360 -keystore server.keystore -keypass mypassword -storepass mypassword

注意：记住，当它要求名字/姓氏时，应该使用您的服务器名称。

接下来，在standalone-xxx.xml中配置ManagementRealm，以包含密钥库。在下面添加server-identities标记：

<server-identities>
    <ssl>
        <keystore path="server.keystore" relative-to="jboss.server.config.dir" keystore-password="mypassword" alias="serverkey" key-password="mypassword"/>
    </ssl>
</server-identities>

<security-realm name="ManagementRealm">
    <server-identities>
        <ssl>
            <keystore path="server.keystore" relative-to="jboss.server.config.dir" keystore-password="mypassword" alias="serverkey" key-password="mypassword"/>
        </ssl>
    </server-identities>
    <authentication>
        <local default-user="$local" skip-group-loading="true"/>
        <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
    </authentication>
    <authorization map-groups-to-roles="false">
        <properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
    </authorization>
</security-realm>

<management-interfaces>
    <http-interface security-realm="ManagementRealm" http-upgrade-enabled="true">
              <socket-binding https="management-https"/>
    </http-interface>
</management-interfaces>

<socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>

将HTTP重定向到HTTPS

在web.xml文件中，在web-app标记中插入以下代码块。

<security-constraint>
    <web-resource-collection>
        <web-resource-name>WEB_APPLICATION_NAME</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

注意：您需要将应用程序的名称放在表示web_application_name的位置。我不能确定在所有情况下会是什么，但对我来说，如果正在部署的war文件是MyApp.war，那么我将MyApp放在那里。

curl -vv -k -L -X GET http://localhost:8080/MyApp/rest/endpoint

连接#1到主机localhost保持不变