Question

我想在运行基于Grizzly 2.3的JAX-RS Web服务的服务器上验证客户端x.509证书的CN字段。我找到了Grizzly 1的一些例子，但似乎代码发生了重大变化。这里是我的代码：

class Transport {
    public static void main(String[] args){
        ResourceConfig rc = new PackagesResourceConfig(Transport.class.getPackage().getName());     
        String url = "http://myhost:8080/myURL";        
        URI uri = UriBuilder.fromUri(url).build();
        HttpServer server = GrizzlyServerFactory.createHttpServer(uri, rc);
        SSLContextConfigurator sslContext = new SSLContextConfigurator();
        sslContext.setKeyStoreFile("path_to_my_keystore");
        sslContext.setKeyStorePass("password");
        sslContext.setTrustStoreFile("path_to_my_truststore");
        sslContext.setTrustStorePass("password");
        sslContext.setSecurityProtocol("TLSv1.2");
        SSLEngineConfigurator sslEngineConfigurator = new  SSLEngineConfigurator(sslContext);
        sslEngineConfigurator.setNeedClientAuth(true);
        sslEngineConfigurator.setWantClientAuth(true);
        sslEngineConfigurator.setEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"});
        sslEngineConfigurator.setClientMode(false);
        NetworkListener listener = new NetworkListener("grizzly_ssl", uri.getHost(), 8443);
        listener.setSecure(true);
        listener.setSSLEngineConfig(sslEngineConfigurator);
        server.addListener(listener);
    }

    @POST
    @Produces({ MediaType.APPLICATION_XML })
    @Consumes({ MediaType.APPLICATION_XML })
    @Path("foo")
    public Response receivePayload(MyPayload payload) {
        // How can I get the CN of the client x.509 certificate / or the fingerprint of the certificate?
    }
}

Answer 1

我在这里找到答案[1]和[2]。

[1] How to grab a pki certificate with Jersey / Spring? [2] Grizzly and ServletContainerContext

以下是适用的代码（仅适用于Jersey 1.1，不适用于Jersey 2）：

class Transport {
    public static void main(String[] args){
        ResourceConfig rc = new PackagesResourceConfig(Transport.class.getPackage().getName());     
        String url = "http://myhost:8080/myURL";        
        URI uri = UriBuilder.fromUri(url).build();
        HttpServer server = GrizzlyServerFactory.createHttpServer(uri, new HttpHandler() {
            @Override
            public void service(Request request, org.glassfish.grizzly.http.server.Response response) throws Exception {
                response.setStatus(404, "Not found");
                response.getWriter().write("404: not found");   
            }
        }); 

        // Initialize and register Jersey Servlet
        WebappContext context = new WebappContext("WebappContext", "");
        ServletRegistration registration = context.addServlet("ServletContainer", ServletContainer.class);
        registration.setInitParameter(ServletContainer.RESOURCE_CONFIG_CLASS, 
            ClassNamesResourceConfig.class.getName());
        registration.setInitParameter(ClassNamesResourceConfig.PROPERTY_CLASSNAMES, Transport.class.getName());
        registration.addMapping("/*");
        context.deploy(server);


        SSLContextConfigurator sslContext = new SSLContextConfigurator();
        sslContext.setKeyStoreFile("path_to_my_keystore");
        sslContext.setKeyStorePass("password");
        sslContext.setTrustStoreFile("path_to_my_truststore");
        sslContext.setTrustStorePass("password");
        sslContext.setSecurityProtocol("TLSv1.2");
        SSLEngineConfigurator sslEngineConfigurator = new  SSLEngineConfigurator(sslContext);
        sslEngineConfigurator.setNeedClientAuth(true);
        sslEngineConfigurator.setWantClientAuth(true);
        sslEngineConfigurator.setEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"});
        sslEngineConfigurator.setClientMode(false);
        NetworkListener listener = new NetworkListener("grizzly_ssl", uri.getHost(), 8443);
        listener.setSecure(true);
        listener.setSSLEngineConfig(sslEngineConfigurator);
        server.addListener(listener);
    }

    @POST
    @Produces({ MediaType.APPLICATION_XML })
    @Consumes({ MediaType.APPLICATION_XML })
    @Path("foo")
    public Response receivePayload(@Context HttpServletRequest request, MyPayload payload) {
        X509Certificate[] certChain = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
        if (certChain == null || certChain.length == 0){
        LOG.info("X509cert not found");
            return null;
        }
        X509Certificate certificate = certChain[0];
        // get information such as CN from certificate
    }
}

如何在Grizzly 2.3中获取X.509客户端证书（使用客户端身份验证时）

1 个答案: