配置安全性以通过WS-WFlyEJB0364连接访问EJB被拒绝

Question

[Standalone@localhost:9990/]/subsystem=elytron/filesystem-realm=proxyrealm:add(path=proxy-realm-users,relative-to=jboss.server.config.dir)
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=elytron/filesystem-realm=proxyrealm:add-identity(identity=ejbuser)
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=elytron/filesystem-realm=proxyrealm:set-password(identity=ejbuser,clear={password=12345678}）
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=elytron/filesystem-realm=proxyrealm:add-identity-attribute(identity=ejbuser,name=roles,value=[“guest”,“appcitas”])
{“output”=>“success”}

[standalone@localhost:9990/]/subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=roles)
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=elytron/security-domain=proxysd:add(default-realm=proxyrealm,permission-mapper=default-permission-mapper,realms=[{realm=proxyrealm,role-decoder=from-roles-attribute},{realm=local}])
{“结果”=>“成功”}

[独立@localhost:9990/]/subsystem=elytron/sasl-authentication-factory=proxy-application-sasl-authentication:add(mechanism-configurations=[{mechanism-name=jboss-local-user,realm-mapper=local},{mechanism-name=digest-md5,mechanism-realm-configurations=[{realm-name=proxyrealm}]},{mechanism-name=proxyrealm结果“=>”成功“}

[standalone@localhost:9990/]/subsystem=ejb3/application-security-domain=other:add(security-domain=proxysd)
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=remoting/http-connector=http-remoting-connector:write-attribute(name=sasl-authentication-Factory,value=proxy-application-sasl-autentication）
{“结果”=>“成功”,“响应-头”=>{“操作-要求-重新加载”=>true，“进程-状态”=>“重新加载-要求”}}

在mi EJB中，我有

@WebService(
  endpointInterface = "es.ssib.otic.test.prototipoEjbCitas.ApiCitasPublico",
  name = "ApiCitasEjb")
@RolesAllowed("apiCitas")
@Stateless
public class ApiCitasPublicoImpl
    implements ApiCitasPublico {

    @Override
    public @XmlElement(name = "pacienteCitaResponse", required = true) PacienteCitaResponse getPacienteCita(
        @WebParam(name = "datosSolicitante") @XmlElement(required = true) IdPeticion idPaciente) {
   ...
}

而我的jboss-app.xml是

<?xml version="1.0" encoding="UTF-8"?>
<jboss-app>
   <security-domain>other</security-domain>
</jboss-app>

• 用户名:ejbuser
• 密码:12345678
• 域：我已经尝试使用other、proxySD、proxyRealm并将其留空
• pre-emptive auth:我已经将“domain”的上述所有值与“use-global-preference”和“authenticate pre-emptionaly”组合在一起。

在所有情况下，我得到一个

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <soap:Fault>
       <faultcode>soap:Server</faultcode>
       <faultstring>WFLYEJB0364: Invocation on method: public es.ssib.otic.test.prototipoEjbCitas.beans.PacienteCitaResponse es.ssib.otic.test.prototipoEjbCitas.impl.ApiCitasPublicoImpl.getPacienteCita(es.ssib.otic.test.prototipoEjbCitas.beans.IdPeticion) of bean: ApiCitasPublicoImpl is not allowed</faultstring>
    </soap:Fault>
  </soap:Body>
</soap:Envelope>

如果删除安全配置，我就可以毫无问题地通过SoapUI访问。

[standalone@localhost:9990/]/subsystem=elytron/http-authentication-factory=proxy-application-http-authentication:add(http-server-mechanism-factory=global,security-domain=proxysd,mechanism-configurations=[{mechanism-name=basic,mechanism-realm-configuration=[{realm-name=proxyad}]}])
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=undertow/application-security-domain=proxyad:add(http-authentication-factory=proxy-application-http-authentication)
{“结果”=>“成功”}

并将jboss-app.xml中的security-domain的值更改为proxyad，部署EAR时出现错误：

{
“wflyctl0412:未安装的必需服务：”=>[“jboss.security.security-domain.proxyad”],
“wflyctl0180:缺少/不可用依赖项的服务”=>[
“jboss.deployment.subunit.\”prototipoearcitas-0.0.1-snapshot.ear\“.\”prototipoejbcitas-0.0.1-snapshot.jar\“.component.apicitaspublicoimpl.create缺少citas-0.0.1-snapshot.ear\”.\“prototipoejbcitas-0.0.1-snapshot.jar\”.apicitasPublicoImpl缺少[jboss.security.security-domain.proxyad]“
]
}

Answer 1

有几件事需要注意：

>

要使用HTTP基本身份验证，需要一个Elytronhttp-authentication-factory。关于如何配置此配置的文档可以在这里找到。

当使用HTTP基本身份验证时，还需要在Undertow子系统中添加application-security-domain映射。请参阅https://developer.jboss.org/thread/276445，了解使用WebServices时与此相关的更多详细信息。

[standalone@localhost:9990/]/subsystem=elytron/security-domain=proxysd:add(realms=[{realm=proxyrealm,role-decoder=groups-to-roles}],default-realm=proxyrealm,permission-mapper=default-permission-mapper)
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=elytron/http-authentication-factory=proxy-http-auth:add(http-server-mechanism-factory=global,security-domain=proxysd,mechanism-configurations=[{mechanism-name=basic,mechanism-realm-configurations=[{realm-name=proxyrealm}]}]
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=undertow/application-security-domain=proxysd:add(http-authentication-factory=proxy-http-auth)
{“结果”=>“成功”}

[standalone@localhost:9990/]/subsystem=elytron/sasl-authentication-factory=proxy-app-sasl-auth:add(mechanism-configurations=[{mechanism-name=jboss-local-user,realm-mapper=local},{mechanism-name=basic,mechanism-realm-configurations=[{realm-name=proxyrealm}]}],sasl-server-factory=configured,

[standalone@localhost:9990/]/subsystem=ejb3/application-security-domain=proxysd:add(security-domain=proxysd)
{“结果”=>“成功”}

备注：

>

您可能已经注意到，我从文件系统领域切换到了属性领域。这与问题无关，它只是使调试变得更容易。