Question

我正在将旧的旧版服务迁移到EAP 7.1，该服务目前通过LDAP进行身份验证和授权，我想将其移动到它所属的位置-AS上的安全域。

我有一个由LDAP领域支持的安全工作域，如下所示：

/subsystem=elytron/ldap-realm=***censored***:query
{
  "outcome" => "success",
  "result" => {
    "allow-blank-password" => false,
    "dir-context" => "***censored***",
    "direct-verification" => true,
    "identity-mapping" => {
      "rdn-identifier" => "sAMAccountName",
      "use-recursive-search" => true,
      "search-base-dn" => "***censored***",
      "attribute-mapping" => [
        {
          "from" => "cn",
          "to" => "roles",
          "filter" => "(&(objectClass=group)(member={1}))",
          "filter-base-dn" => "***censored***"
        },
        {"from" => "company", "to" => "company"},
        {"from" => "givenName", "to" => "firstName"},
        {"from" => "sn", "to" => "lastName"},
        {"from" => "mail", "to" => "email"}
      ],
      "user-password-mapper" => {"from" => "userPassword"}
    }
  }
}

针对从LDAP属性映射中选取的身份属性“角色”进行授权。

现在可以正常工作了，我想从LDAP中获取更多属性（公司，名字，姓氏，电子邮件，可能还有更多）。这些已经被上面的配置拾取，并且Elytron以我认为应该的方式处理它们：

 <TS> DEBUG [org.wildfly.security] (default task-6) [javax.naming.ldap.InitialLdapContext@5c7e4fb4] successfully created. Connection established to LDAP server.
 <TS> DEBUG [org.wildfly.security] (default task-6) Trying to create identity for principal [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Executing search [(sAMAccountName={0})] in context [*****] with arguments [*****]. Returning attributes are [MAIL, SN, GIVENNAME, COMPANY]. Binary attributes are [null].
 <TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Identity for principal [*****] found at [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Executing search [(&(objectClass=group)(member={1}))] in context [*****] with arguments [*****, *****]. Returning attributes are [null, CN]. Binary attributes are [null].
 <TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
 .
 . bunch of group memberships
 .
 <TS> DEBUG [org.wildfly.security] (default task-6) Found entry [*****].
 <TS> TRACE [org.wildfly.security] (default task-6) Identity iterating - pagination not supported - end of list
 <TS> DEBUG [org.wildfly.security] (default task-6) Obtaining authorization identity attributes for principal [*****]:
 <TS> DEBUG [org.wildfly.security] (default task-6) Identity [*****] attributes are:
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [lastName] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [firstName] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [roles] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [company] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6)     Attribute [email] value [*****].
 <TS> DEBUG [org.wildfly.security] (default task-6) Context [javax.naming.ldap.InitialLdapContext@5c7e4fb4] was closed. Connection closed or just returned to the pool.

我想做的是从受保护的EJB中的代码中获取那些身份属性。当然可以注入dir-context并从代码本身中查找属性，但这是特定于部署的。我非常希望让AS通过SessionContext或同等功能公开这些属性。

我不知道该怎么做。网络上可用的Elytron资料大部分都是同类文章，它只是复制了cred的官方示例，而又一次又一次地翻滚了相同的Hello World示例。

所以。总结一下。没关系，这是LDAP领域。我需要的属性在Identity对象中可用。身份后来被转换为没有那些属性的主体，据我所知，主体是我可以通过EJB会话上下文访问的东西。

我是否可以通过任何方式从EJB中获取身份或至少对其进行查看？最好以一种与实现方式无关的方式？

最诚挚的问候！

/ Magnus Drougge

Answer 1

要从EJB获取当前的安全身份，可以使用以下代码：

SecurityDomain.getCurrent().getCurrentSecurityIdentity()

有关SecurityDomain的更多详细信息，可以在这里找到：

http://wildfly-security.github.io/wildfly-elytron/master/org/wildfly/security/auth/server/SecurityDomain.html

Answer 2

寻找自定义角色解码器以获取 Wildfly 中的属性。然后将属性存储在某个地方，您可以在那里与您的委托人一起获取它们。

Wildfly / Elytron-从ejb

2 个答案: