GlassFish JDBC 领域 jdbcrealm.grouperror 疑难解答

Question

我想达到什么目标： 只有角色为“head”的用户才能访问与模式“mario/*”匹配的任何路径

我的方案是什么： 有两个角色：“头”和“默认”。角色“head”映射到组名“HEADS”。角色“default”映射到组名“USERS”。根据我的 jdbc 领域配置，每个登录的用户都被分配到最后一个组。

我通过电子邮件“robert@example.com”将组“USERS, HEADS”分配给用户，然后尝试登录。登录成功，但用户只分配了角色“USERS”。 问题是没有为用户分配“头”角色。，导致 403 HTTP 响应。怎么了？

尝试修复

我转到我的 jdbc 领域配置并更改了 标有“分配组：”的输入字段：“USERS，HEADS”。 这使得每个登录的用户都被分配到两个组。这不是我想要的。我再次更改了领域配置并将“分配组”值设置为“用户”。

服务器日志告诉我的信息： jdbcrealm.grouperror

我的 JDBC 领域配置是什么：

我的 glassfish 版本：5

角色映射：

 <security-role-mapping>
        <role-name>head</role-name>
        <group-name>HEADS</group-name>
    </security-role-mapping>

    <security-role-mapping>
        <role-name>default</role-name>
        <group-name>USERS</group-name>
    </security-role-mapping>

安全约束定义：

  <security-constraint>

        <web-resource-collection>
            <web-resource-name>Restricted</web-resource-name>
            <url-pattern>/mario/*</url-pattern>
        </web-resource-collection>

        <auth-constraint>
            <role-name>head</role-name>
        </auth-constraint>

    </security-constraint>

 <security-constraint>

        <web-resource-collection>
            <web-resource-name>Everyone user can access</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>

        <auth-constraint>
            <role-name>default</role-name>
        </auth-constraint>

    </security-constraint>

   <security-role>
        <role-name>admin</role-name>
    </security-role>

    <security-role>
        <role-name>default</role-name>
    </security-role>

我的数据库：修改自https://docs.oracle.com/javaee/6/tutorial/doc/glxgo.html

 CREATE TABLE "FOREST"."PERSON"
(
  ID int NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY 
      (START WITH 1, INCREMENT BY 1),
  FIRSTNAME varchar(50) NOT NULL,
  LASTNAME varchar(100) NOT NULL,
  EMAIL varchar(45) NOT NULL UNIQUE,
  ADDRESS varchar(45) NOT NULL,
  CITY varchar(45) NOT NULL,
  PASSWORD varchar(100),
  DTYPE varchar(31)
)
;
CREATE UNIQUE INDEX SQL_PERSON_EMAIL_INDEX ON "FOREST"."PERSON"(EMAIL)
;
CREATE UNIQUE INDEX SQL_PERSON_ID_INDEX ON "FOREST"."PERSON"(ID)
;
CREATE TABLE "FOREST"."GROUPS"
(
   ID int NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY 
       (START WITH 1, INCREMENT BY 1),
   NAME varchar(50) NOT NULL,
   DESCRIPTION varchar(300)
)
;
CREATE TABLE "FOREST"."PERSON_GROUPS"
(
  GROUPS_ID int NOT NULL,
  EMAIL varchar(45) NOT NULL
)
;
ALTER TABLE "FOREST"."PERSON_GROUPS"
ADD CONSTRAINT FK_PERSON_GROUPS_PERSON
FOREIGN KEY (EMAIL)
REFERENCES "FOREST"."PERSON"(EMAIL)
;
ALTER TABLE "FOREST"."PERSON_GROUPS"
ADD CONSTRAINT FK_PERSON_GROUPS_GROUPS
FOREIGN KEY (GROUPS_ID)
REFERENCES "FOREST"."GROUPS"(ID)
;
CREATE INDEX SQL_PERSONGROUPS_EMAIL_INDEX ON "FOREST"."PERSON_GROUPS"(EMAIL)
;
CREATE INDEX SQL_PERSONGROUPS_ID_INDEX ON "FOREST"."PERSON_GROUPS"(GROUPS_ID)

INSERT INTO "FOREST"."PERSON" (FIRSTNAME,LASTNAME,EMAIL,ADDRESS,CITY,
PASSWORD,DTYPE) VALUES ('Robert','Exampler','robert@example.com',
'Example street','San Francisco','81dc9bdb52d04dc20036dbd8313ed055',
'Customer');
INSERT INTO "FOREST"."PERSON" (FIRSTNAME,LASTNAME,EMAIL,ADDRESS,CITY,
PASSWORD,DTYPE) VALUES ('Admin','Admin','admin@example.com','Example street',
'Belmont','81dc9bdb52d04dc20036dbd8313ed055','Administrator');
INSERT INTO "FOREST"."PERSON" (FIRSTNAME,LASTNAME,EMAIL,ADDRESS,CITY,
PASSWORD,DTYPE) VALUES ('Jack','Frost','jack@example.com','Example Blvd',
'San Francisco','81dc9bdb52d04dc20036dbd8313ed055','Customer');
INSERT INTO "FOREST"."PERSON" (FIRSTNAME,LASTNAME,EMAIL,ADDRESS,CITY,
PASSWORD,DTYPE) VALUES ('Payment','User','paymentUser@dukesforest.com',
'-','-','58175e1df62779046a3a4e2483575937','Customer');

INSERT INTO "FOREST"."GROUPS" (NAME, DESCRIPTION) 
VALUES ('USERS', 'Users of the store');
INSERT INTO "FOREST"."GROUPS" (NAME, DESCRIPTION) 
VALUES ('ADMINS', 'Administrators of the store');
INSERT INTO "FOREST"."GROUPS" (NAME, DESCRIPTION) 
VALUES ('HEADS', 'The God Users');

INSERT INTO "FOREST"."PERSON_GROUPS" (GROUPS_ID,EMAIL) 
VALUES (1,'robert@example.com');
INSERT INTO "FOREST"."PERSON_GROUPS" (GROUPS_ID,EMAIL) 
VALUES (3,'robert@example.com');
INSERT INTO "FOREST"."PERSON_GROUPS" (GROUPS_ID,EMAIL) 
VALUES (2,'admin@example.com');
INSERT INTO "FOREST"."PERSON_GROUPS" (GROUPS_ID,EMAIL) 
VALUES (1,'jack@example.com');
INSERT INTO "FOREST"."PERSON_GROUPS" (GROUPS_ID,EMAIL) 
VALUES (1,'paymentUser@dukesforest.com');

Answer 1

问题与您在以下位置之一的组设置有关

1. Web.xml => 安全约束的授权设置
2. Glassfish-web.xml => 指定角色的组名
3. 数据库 => 在您的组表中指定的组名