我有一台JBoss EAP6，想要使用我们的Active Directory基础架构设置Kerberos身份验证。 jboss-web.xml，standalone.xml和web.xml有哪些配置？
答案 0 :(得分：1)
在<security-constraint>
<web-resource-collection>
<web-resource-name>My Application</web-resource-name>
<url-pattern>/context-to-protect/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>AD_Group_Name</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>SPNEGO</auth-method>
<realm-name>SPNEGO</realm-name>
</login-config>
<security-role>
<description>Allowed Users</description>
<role-name>AD_Group_Name</role-name>
</security-role>
：
jboss-web.xml web.xml位于<jboss-web>
<security-domain>java:/jaas/SPNEGO</security-domain>
<valve>
<class-name>org.jboss.security.negotiation.NegotiationAuthenticator</class-name>
</valve>
<jacc-star-role-allow>true</jacc-star-role-allow>
</jboss-web>
旁边：
pom.xml在您的 <dependency>
<groupId>org.jboss.security</groupId>
<artifactId>jboss-negotiation-common</artifactId>
<version>2.3.8.Final-redhat-1</version>
</dependency>
<dependency>
<groupId>org.jboss.security</groupId>
<artifactId>jboss-security-spi</artifactId>
<version>2.0.4.SP2</version>
</dependency>
中，您可能需要一些依赖项：
standalone.xml在<extensions>
<extension module="org.jboss.as.security"/>
<!-- all your other extensions -->
</extensions>
<system-properties>
<property name="java.security.krb5.realm" value="mydomain.com"/>
<property name="java.security.krb5.kdc" value="kdcserver.mydomain.com"/>
<!-- all your other properties -->
</system-properties>
<subsystem xmlns="urn:jboss:domain:security:1.2">
<security-domains>
<security-domain name="other" cache-type="default">
<authentication>
<login-module code="Remoting" flag="optional">
<module-option name="password-stacking" value="useFirstPass"/>
</login-module>
<login-module code="RealmDirect" flag="required">
<module-option name="password-stacking" value="useFirstPass"/>
</login-module>
</authentication>
</security-domain>
<security-domain name="jboss-web-policy" cache-type="default">
<authorization>
<policy-module code="Delegating" flag="required"/>
</authorization>
</security-domain>
<security-domain name="jboss-ejb-policy" cache-type="default">
<authorization>
<policy-module code="Delegating" flag="required"/>
</authorization>
</security-domain>
<security-domain name="host">
<authentication>
<login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="required">
<module-option name="storeKey" value="true"/>
<module-option name="useKeyTab" value="true"/>
<module-option name="doNotPrompt" value="true"/>
<module-option name="debug" value="true"/>
<module-option name="keyTab" value="/path/to/your/server.keytab"/>
<module-option name="principal" value="HTTP/server.mydomain.com@MYDOMAIN.COM"/>
</login-module>
</authentication>
</security-domain>
<security-domain name="SPNEGO" cache-type="default">
<authentication>
<login-module code="SPNEGO" flag="requisite">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="serverSecurityDomain" value="host"/>
</login-module>
<login-module code="AdvancedAdLdap" flag="required">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="bindDN" value="CN=MyCN,OU=MyOU,DC=mydomain,DC=com"/>
<module-option name="bindCredential" value="thepassword"/>
<module-option name="java.naming.provider.url" value="ldap://ldap.mydomain.com:389"/>
<module-option name="baseCtxDN" value="OU=MyOU,DC=mydomain,DC=com"/>
<module-option name="baseFilter" value="(userPrincipalName={0})"/>
<module-option name="roleAttributeID" value="memberOf"/>
<module-option name="rolesCtxDN" value="OU=MyOU,DC=mydomain,DC=com"/>
<module-option name="roleAttributeIsDN" value="true"/>
<module-option name="roleNameAttributeID" value="cn"/>
<module-option name="searchScope" value="SUBTREE_SCOPE"/>
<module-option name="recurseRoles" value="true"/>
</login-module>
</authentication>
</security-domain>
<security-domain name="LdapDomain" cache-type="default">
<authentication>
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
<module-option name="java.naming.provider.url" value="ldap://ldap.mydomain.com:389"/>
<module-option name="bindDN" value="CN=MyCN,OU=MyOU,DC=mydomain,DC=com"/>
<module-option name="bindCredential" value="thepassword"/>
<module-option name="baseCtxDN" value="OU=MyOU,DC=mydomain,DC=com"/>
<module-option name="baseFilter" value="(sAMAccountName={0})"/>
<module-option name="rolesCtxDN" value="CN=MyCN,OU=MyOU,DC=mydomain,DC=com"/>
<module-option name="roleFilter" value="(sAMAccountName={0})"/>
<module-option name="roleAttributeID" value="memberOf"/>
<module-option name="roleNameAttributeID" value="cn"/>
<module-option name="searchScope" value="SUBTREE_SCOPE"/>
</login-module>
</authentication>
</security-domain>
</security-domains>
</subsystem>
：
["14: London", "15: Manchester", "16: Bristol"]