WebSphere Liberty配置文件-如何在部署Spring Boot uber JAR时添加安全约束

Question

我很高兴看到WebSphere Liberty Profile在18.0.0.2版本中支持直接部署Spring Boot support JAR。

<application id="x" name="x"
             type="spring"
             location="${server.config.dir}/apps/spring-boot-uber.jar">
        <application-bnd>
            <security-role name="Authenticated">
                <special-subject type="ALL_AUTHENTICATED_USERS"/>
            </security-role>
            <security-role name="SUPER_USERS">
                <group name="My_Admins"/>
            </security-role>
        </application-bnd>
    </application>

注意安全角色绑定。

在web.xml(WAR)或ibm-ws-bnd.xml(EAR)中，我认为需要执行以下操作：

<?xml version="1.0" encoding="UTF-8"?>
<webservices-bnd xmlns="http://websphere.ibm.com/xml/ns/javaee"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-ws-bnd_1_0.xsd"
                 version="1.0">
    <http-publishing>
        <webservice-security>

            <security-constraint>
                <web-resource-collection>
                    <web-resource-name>all</web-resource-name>
                    <url-pattern>/*</url-pattern>
                    <http-method>GET</http-method>
                    <http-method>PUT</http-method>
                    <http-method>HEAD</http-method>
                    <http-method>TRACE</http-method>
                    <http-method>POST</http-method>
                    <http-method>DELETE</http-method>
                    <http-method>OPTIONS</http-method>
                </web-resource-collection>
                <auth-constraint>
                    <role-name>Authenticated</role-name>
                </auth-constraint>
            </security-constraint>

            <security-role>
                <description>All authenticated users</description>
                <role-name>Authenticated</role-name>
            </security-role>
            <security-role>
                <description>Super users</description>
                <role-name>SUPER_USERS</role-name>
            </security-role>

        </webservice-security>
    </http-publishing>
</webservices-bnd>

以便在http请求（用户主体）中设置身份验证信息。

更新：

我甚至不确定WLP在部署Spring Boot uber JAR时是否支持application-bnd，但我根本不知道如何将角色绑定到它。

Answer 1

您可能需要考虑使用Spring Security https://Spring.io/guides/gs/securing-web/来提供Spring Boot应用程序中的用户详细信息和安全角色。到目前为止，liberty还不支持在application-bnd中定义授权角色的Spring Boot application JAR。

或者，您可以将JAR文件转换为WAR，并将web.xml文件放在src/main/webapp/WEB-INF文件夹中，并在server.xml中以“WAR”的形式提供应用程序类型