忽略Wildfly安全约束

Question

我试图在wildfly上保护一个演示web应用程序。我已经在单机版中定义了这个安全域。xml

<security-domains>
    <security-domain name="projects" cache-type="default">
        <authentication>
            <login-module code="Database" flag="required">
                <module-option name="dsJndiName" value="java:jboss/datasources/TestDS"/>
                <module-option name="rolesQuery" value="SELECT role, 'Roles' FROM users WHERE username=?"/>
                <module-option name="hashAlgorithm" value="MD5"/>
                <module-option name="hashEncoding" value="hex"/>
                <module-option name="principalsQuery" value="SELECT password from users WHERE username=?"/>
            </login-module>
        </authentication>
        <authorization>
            <policy-module code="Database" flag="required">
                <module-option name="dsJndiName" value="java:jboss/datasources/school"/>
                <module-option name="rolesQuery" value="SELECT role, 'Roles' FROM users WHERE username=?"/>
                <module-option name="hashAlgorithm" value="MD5"/>
                <module-option name="hashEncoding" value="hex"/>
                <module-option name="principalsQuery" value="SELECT password from users WHERE username=?"/>
            </policy-module>
        </authorization>
    </security-domain>
</security-domains>

然后在web-inf下，我在web.xml中定义了这个安全约束

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">
  
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>projects</web-resource-name>
      <url-pattern>/twp/projects/*</url-pattern>
      <http-method>POST</http-method>
      <http-method>GET</http-method>
      <http-method>PUT</http-method>
      <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>ADMINISTRATOR</role-name>
    </auth-constraint>
  </security-constraint>
  
  <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>projects</realm-name>
    <form-login-config>
      <form-login-page>/login.xhtml</form-login-page>
      <form-error-page>/error.xhtml</form-error-page>
    </form-login-config>
  </login-config>
  <security-role>
    <role-name>ADMINISTRATOR</role-name>
  </security-role>
  <security-role>
    <role-name>USER</role-name>
  </security-role>
</web-app>

以及jboss网站上的这些内容。xml

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
  <security-domain>java:/jaas/projects</security-domain>
</jboss-web>

问题是，如果我转到/projects URL，我不会重定向到登录页面，就好像忽略了约束一样。

Answer 1

以你的配置，它工作得很好。在控制台，你有这两行吗？：

WARN  [io.undertow.servlet] (ServerService Thread Pool -- 7) UT015020: Path /twp/projects/* is secured for some HTTP methods, however it is not secured for [TRACE, HEAD, CONNECT, OPTIONS]
INFO  [org.wildfly.extension.undertow] (ServerService Thread Pool -- 7) WFLYUT0021: Registered web context: '/test-1.0-SNAPSHOT' for server 'default-server'

如果没有，你应该把你的配置到野蝇standalone.xml的相关部分

第一个表示路径是安全的，第二个表示调整了大小的web上下文。

http://localhost:8080/test-1.0-SNAPSHOT/twp/projects下的每个网址都将被保护并重定向到登录页面。

例如

http://localhost:8080/test-1.0-SNAPSHOT/twp/projects/all

但不是

http://localhost:8080/test-1.0-SNAPSHOT/twp/all

我在urn:jboss:domain:security:2.0中使用wildfly 11，而不是elytron。