w*r
发帖数: 2421 | |
g*****g
发帖数: 34805 | |
M***0
发帖数: 1180 | |
s******e
发帖数: 493 | |
w*r
发帖数: 2421 | 5 看来我的requirement 没有写清楚
这样说吧：
Webapp security: LDAP realm
Servlet To DB connection: standard JDBC, however, requires each user to
logon to database using his/her own credential. (username/password)
因为 DB 端接收的是LDAP also, 所以实际上user's username password to web app's
authentication are the same as username/pwd login to database.
所以我只需要在user login form submit authenticate成功之后（或者之前）把
password记下来，这样用户在执行DB操作的时候就不需要再输入用户名和密码了
有人提到了getPrincile()这样的调用，这只能返回username, 从login form里面post
的password是无法得到的。
keep
LDAP,
【在 g*****g 的大作中提到】
: Check spring security, it has an LDAP example. It's not a good idea to keep
: password in session. You should pull out all information you need from LDAP,
: and cache them.
:
: ).
: Database
: passwor
|
w*r
发帖数: 2421 | 6 BTW, I do not plan to use spring at all for such small implementation. and
to keep the app simple and portable, i am using the standard form based
authentication provided by all j2EE web containers.
's
post
【在 w*r 的大作中提到】
: 看来我的requirement 没有写清楚
: 这样说吧：
: Webapp security: LDAP realm
: Servlet To DB connection: standard JDBC, however, requires each user to
: logon to database using his/her own credential. (username/password)
: 因为 DB 端接收的是LDAP also, 所以实际上user's username password to web app's
: authentication are the same as username/pwd login to database.
: 所以我只需要在user login form submit authenticate成功之后（或者之前）把
: password记下来，这样用户在执行DB操作的时候就不需要再输入用户名和密码了
: 有人提到了getPrincile()这样的调用，这只能返回username, 从login form里面post
|
s******e
发帖数: 493 | 7 as said, even you can get user security info, I doubt that any app server
will expose you the password if you use built-in security. It would be a
security bleach. The application server should only pass your principal
around for you to enjoy the declarative security among the different parts
of server.
Even some app servers allow you to intercept the default authentication call
for example (basic, form, digest, etc), there is no way for you to achieve
your portable goal. |
t*******e
发帖数: 684 | 8 You need the right JDBC driver that is capable on windows authentication.
's
post
【在 w*r 的大作中提到】
: 看来我的requirement 没有写清楚
: 这样说吧：
: Webapp security: LDAP realm
: Servlet To DB connection: standard JDBC, however, requires each user to
: logon to database using his/her own credential. (username/password)
: 因为 DB 端接收的是LDAP also, 所以实际上user's username password to web app's
: authentication are the same as username/pwd login to database.
: 所以我只需要在user login form submit authenticate成功之后（或者之前）把
: password记下来，这样用户在执行DB操作的时候就不需要再输入用户名和密码了
: 有人提到了getPrincile()这样的调用，这只能返回username, 从login form里面post
|
g*****g
发帖数: 34805 | |
M***0
发帖数: 1180 | 10 JAAS implementation is vendor specific
我相信每个app server都提供可扩展的类让你提取plain password
glassfish里是abstract class AppservPasswordLoginModule
里面定义了protected String _username and protected String _password
spring的UsernamePasswordAuthenticationToken有getPrincipal()和getCredentials(
)分别提取username and password
你用的app server里应该也会有同样功能的class，但app server提供的东西互相不通
用，你还得add resource to app server。用Spring反而才是same code for all
servers.
correct me if I was wrong.
【在 w*r 的大作中提到】
: BTW, I do not plan to use spring at all for such small implementation. and
: to keep the app simple and portable, i am using the standard form based
: authentication provided by all j2EE web containers.
:
: 's
: post
|
|
|
w*r
发帖数: 2421 | 11 这个答复靠谱，看来简单的作法就是webapp里面自己extend
LDAPAuthenticationLogingModule,然后手动干，实际上这样的requirement比较常见，
除非所有的system都kerbros,大家share一个ldap,一次sign-on不需要重复password是
一个common feature.
用spring麻烦了，自己手干一个loginModule方便一些
getCredentials(
【在 M***0 的大作中提到】
: JAAS implementation is vendor specific
: 我相信每个app server都提供可扩展的类让你提取plain password
: glassfish里是abstract class AppservPasswordLoginModule
: 里面定义了protected String _username and protected String _password
: spring的UsernamePasswordAuthenticationToken有getPrincipal()和getCredentials(
: )分别提取username and password
: 你用的app server里应该也会有同样功能的class，但app server提供的东西互相不通
: 用，你还得add resource to app server。用Spring反而才是same code for all
: servers.
: correct me if I was wrong.
|
w*r
发帖数: 2421 | 12 app itself is not a high concurrency OLTP app. the scalability is not a
major concern. Security requires user identify himself/herself while perform
RDBMS operation.
Backend database is currently already configured using LDAP . therefore some
trick needs to be played to achieve higher user experience of not having to
input username./pwd multiple times.
ll
app
e,
【在 g*****g 的大作中提到】
: Not a scalable design. DB typically can only allocate a much smaller
: connection pool than your app server's thread pool. And in your case, you'll
: need to create a DB connection for your every user, which will have poor
: performance.
: You don't want to use fine-grain access control on DB itself. Do that on app
: server instead.
: You may be able to get away with it if your system has low concurrency (i.e,
: no more than 100 concurrent sessions). In that case, at least mask the
: password.
:
|
T****U
发帖数: 3344 | 13 不同系统之间共用username/pass? 这本身就是危险的
perform
some
to
【在 w*r 的大作中提到】
: app itself is not a high concurrency OLTP app. the scalability is not a
: major concern. Security requires user identify himself/herself while perform
: RDBMS operation.
: Backend database is currently already configured using LDAP . therefore some
: trick needs to be played to achieve higher user experience of not having to
: input username./pwd multiple times.
:
: ll
: app
: e,
|
T****U
发帖数: 3344 | |
g*****g
发帖数: 34805 | 15 As I said, if scalability is not a concern, you simply mask the password and
cache it in session, very simple.
Take spring security ldap example, I guess you only need to modify a few
lines of code.
perform
some
to
【在 w*r 的大作中提到】
: app itself is not a high concurrency OLTP app. the scalability is not a
: major concern. Security requires user identify himself/herself while perform
: RDBMS operation.
: Backend database is currently already configured using LDAP . therefore some
: trick needs to be played to achieve higher user experience of not having to
: input username./pwd multiple times.
:
: ll
: app
: e,
|
M***r
发帖数: 79 | 16 When authentication succeed (you shall be notified by register a listener),
you store the principal(or your customized security info object) in session.
After that, you use the security principal stored in session to determine
whether user has logged in. You never store password in session!!! |
