Question

我对tapestry和tynamo-security模块完全陌生，需要你的帮助。

我想使用tynamo-security和hibernate在我的网络应用上实现身份验证功能。我遵循了here的说明，但这对我来说还不够。

到目前为止，我已经实现了一个用户实体及其dao：

package com.example.tynamo.entities;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;

import org.apache.tapestry5.beaneditor.NonVisual;
import org.apache.tapestry5.beaneditor.Validate;

@Entity
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    @NonVisual
    private Long id;

    @Validate("required")
    private String firstName;

    @Validate("required")
    private String lastName;

    @Validate("required")
    private String email;

    @Validate("required")
    private String loginName;

    @Validate("required")
    private String password;

    public User(){

    }

    public User(String firstName, String lastName, String email, String userName, String password){
        this.loginName = userName;
        this.firstName = firstName;
        this.lastName = lastName;
        this.email = email;
        this.password = password;
    }

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getFirstName() {
        return firstName;
    }

    public void setFirstName(String firstName) {
        this.firstName = firstName;
    }

    public String getLastName() {
        return lastName;
    }

    public void setLastName(String lastName) {
        this.lastName = lastName;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getLoginName() {
        return loginName;
    }

    public void setLoginName(String loginName) {
        this.loginName = loginName;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public String toString(){
        return loginName + " : " + firstName + " " + lastName + " - " + email + " : " + password;
    }
}


package com.example.tynamo.dao.impl;

import java.util.List;

import org.hibernate.Session;
import org.hibernate.SessionFactory;
import org.hibernate.Transaction;
import org.hibernate.cfg.Configuration;
import org.hibernate.criterion.Criterion;
import org.hibernate.criterion.Restrictions;
import org.hibernate.exception.ConstraintViolationException;

import com.example.tynamo.dao.UserDAO;
import com.example.tynamo.entities.User;

public class UserDAOImpl implements UserDAO {

    private SessionFactory factory = new Configuration().configure().buildSessionFactory();

    public void insertUser(User user) {
        Session session = factory.openSession();
        Transaction tx = session.beginTransaction();
        try {
            System.out.println(session.save(user));
            tx.commit();
            session.close();
        } catch (ConstraintViolationException e) {
            System.out.println(e.getErrorCode());
        }
    }

    public User loadUserById(int id) {
        Session session = factory.openSession();
        User u = (User) session.load(User.class, id);
        session.close();
        return u;
    }

    public User loadUserByLoginName(String loginName) {
        Session session = factory.openSession();
        User u = (User) session.createCriteria(User.class).add(Restrictions.eq("loginName", loginName)).uniqueResult();
        session.close();
        return u;
    }

    @SuppressWarnings("unchecked")
    public List<User> loadAllUser() {
        Session session = factory.openSession();
        List<User> list = session.createCriteria(User.class).list();
        session.close();
        return list;
    }

}

此外我写了在AppModule中添加了一些行：

在binder方法中：

binder.bind(UserDAO.class, UserDAOImpl.class);

...描述here

的方法

public static void contributeSecurityConfiguration(Configuration<SecurityFilterChain> configuration,
            SecurityFilterChainFactory factory)

...以及一个addRealms方法，它将我自己的UserRalm添加到配置中。

@Contribute(WebSecurityManager.class)
    public static void addRealms(Configuration<Realm> configuration) {
        UserRealm realm = new UserRealm();
        configuration.add(realm);
    }

我从here获取了UserRealm的示例类，并将其修改如下

package com.example.tynamo.security;


import java.util.HashSet;
import java.util.Set;

import org.apache.shiro.authc.AccountException;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.ExpiredCredentialsException;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.cache.MemoryConstrainedCacheManager;
import org.apache.shiro.crypto.hash.Sha1Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.SimpleByteSource;
import org.apache.tapestry5.ioc.annotations.Inject;
import org.hibernate.Session;
import org.hibernate.criterion.Restrictions;

import com.example.tynamo.dao.UserDAO;
import com.example.tynamo.entities.User;

public class UserRealm extends AuthorizingRealm {

    @Inject
    UserDAO userDAO;

    public UserRealm() {
        super(new MemoryConstrainedCacheManager());
        setName("localaccounts");
        setAuthenticationTokenClass(UsernamePasswordToken.class);
        setCredentialsMatcher(new HashedCredentialsMatcher(Sha1Hash.ALGORITHM_NAME));
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        if (principals == null) throw new AuthorizationException("PrincipalCollection was null, which should not happen");

        if (principals.isEmpty()) return null;

        if (principals.fromRealm(getName()).size() <= 0) return null;

        String username = (String) principals.fromRealm(getName()).iterator().next();
        if (username == null) return null;

        User user = findByUsername(username);
        // if (user == null) return null;
        // Set<String> roles = new HashSet<String>(user.getRoles().size());
        // for (Role role : user.getRoles())
            // roles.add(role.name());
        //return new SimpleAuthorizationInfo(roles);
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;

        String username = upToken.getUsername();

        // Null username is invalid
        if (username == null) { throw new AccountException("Null usernames are not allowed by this realm."); }

        User user = findByUsername(username);

        //if (user.isAccountLocked()) { throw new LockedAccountException("Account [" + username + "] is locked."); }
        //if (user.isCredentialsExpired()) {
        //  String msg = "The credentials for account [" + username + "] are expired";
        //  throw new ExpiredCredentialsException(msg);
        //}
        //return new SimpleAuthenticationInfo(username, user.getEncodedPassword(), new SimpleByteSource(user.getPasswordSalt()), getName());
        return null;
    }

    private User findByUsername(String username) {
        return userDAO.loadUserByLoginName(username);
    }
}

我注释掉了那些不起作用的部分。我自己实现的用户实体没有这里要求的方法我找不到任何帮助我实现这些方法的用户界面（只是联邦）。我究竟做错了什么？有人可以帮我吗？

tynamo-security是否还提供注册页面（等等）？

Answer 1

你有没有这个工作？

我注意到的一件事是您已经自己实例化了UserRealm，因此@Inject将不起作用。您可以允许tapestry使用configuration.addInstance(UserRealm.class)实例化它，或者使用构造函数传递对UserDAO的引用。

由于您没有提到您所面临的错误，因此很难回答。

使用tynamo-security模块在tapestry Web应用程序中实现身份验证功能的问题

1 个答案: