Wildfly/Elytron-从ejb访问标识属性

Question

我有一个由LDAP领域支持的工作安全域，如下所示：

/subsystem=elytron/ldap-realm=***censored***:query
{
  "outcome" => "success",
  "result" => {
    "allow-blank-password" => false,
    "dir-context" => "***censored***",
    "direct-verification" => true,
    "identity-mapping" => {
      "rdn-identifier" => "sAMAccountName",
      "use-recursive-search" => true,
      "search-base-dn" => "***censored***",
      "attribute-mapping" => [
        {
          "from" => "cn",
          "to" => "roles",
          "filter" => "(&(objectClass=group)(member={1}))",
          "filter-base-dn" => "***censored***"
        },
        {"from" => "company", "to" => "company"},
        {"from" => "givenName", "to" => "firstName"},
        {"from" => "sn", "to" => "lastName"},
        {"from" => "mail", "to" => "email"}
      ],
      "user-password-mapper" => {"from" => "userPassword"}
    }
  }
}

授权是针对从LDAP属性映射中提取的标识属性“roles”进行的。

现在，这个方法已经成功了，我想从LDAP中获取更多的属性(company、firstName、lastName、email，可能还有更多）。上面的配置已经拾取了这些内容,而Elytron以我所期望的方式处理它们：

 <TS> DEBUG [org.wildfly.security] (default task-6) [javax.naming.ldap.InitialLdapContext@5c7e4fb4] successfully created. Connection established to LDAP server.
 <TS> DEBUG [org.wildfly.security] (default task-6) Trying to create identity for principal [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Executing search [(sAMAccountName={0})] in context [*****] with arguments [*****]. Returning attributes are [MAIL, SN, GIVENNAME, COMPANY]. Binary attributes are [null].
 <TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Identity for principal [*****] found at [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Executing search [(&(objectClass=group)(member={1}))] in context [*****] with arguments [*****, *****]. Returning attributes are [null, CN]. Binary attributes are [null].
 <TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
 .
 . bunch of group memberships
 .
 <TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
 <TS> TRACE [org.wildfly.security] (default task-6) Identity iterating - pagination not supported - end of list
 <TS> DEBUG [org.wildfly.security] (default task-6) Obtaining authorization identity attributes for principal [*****]:
 <TS> DEBUG [org.wildfly.security] (default task-6) Identity [*****] attributes are:
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [lastName] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [firstName] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [company] value [*****].
 <TS> DEBUG [org.wildfly.html" target="_blank">security] (default task-6)     Attribute [email] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Context [javax.naming.ldap.InitialLdapContext@5c7e4fb4] was closed. Connection closed or just returned to the pool.

所以.总结一下。不管这是一个LDAP领域。我需要的属性在Identity对象中可用。该标识随后被转换为没有这些属性的主体，据我所知，主体是我可以通过EJB会话上下文访问的东西。

有没有任何方法可以从EJB获取标识，或者至少获取标识的视图？最好是以实现不可知的方式？

最诚挚的问候！

/Magnus Drougge

Answer 1

要从EJB获取当前的安全标识，可以使用以下代码：

SecurityDomain.getCurrent().getCurrentSecurityIdentity()

有关SecurityDomain的更多详细信息可在此处找到：

http://wildfly-security.github.io/wildfly-elytron/master/org/wildfly/security/auth/server/securitydomain.html