JAAS：Java Authentication and Authorization Service，提供了認(rèn)證和授權(quán)框架。
本例是認(rèn)證的實(shí)現(xiàn)，JAAS定義了可插拔的認(rèn)證機(jī)制，使認(rèn)證邏輯獨(dú)立開來(lái)，可通過(guò)修改配置文件切換認(rèn)證模塊。
官方參考：
http://java.sun.com/products/archive/jaas/
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/JAASRefGuide.html
security.pdf
一、配置文件及設(shè)置
1. 配置文件（假設(shè)為D:/jaas.conf）：
Sample{
com.fastunit.samples.jaas.SampleLoginModule required debug=false;
};此文件定義了一個(gè)“Sample”驗(yàn)證模塊，使用SampleLoginModule來(lái)進(jìn)行驗(yàn)證。
2. 啟用配置文件：
-Djava.security.auth.login.config=D:/jaas.conf
二、客戶端調(diào)用
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import javax.servlet.http.HttpServletRequest;
public class LoginManager {
public static boolean login(HttpServletRequest request) {
try {
String username = request.getParameter("username");
String password = request.getParameter("password");
//此處指定了使用配置文件的“Sample”驗(yàn)證模塊，對(duì)應(yīng)的實(shí)現(xiàn)類為SampleLoginModule
LoginContext lc = new LoginContext("Sample", new SampleCallbackHandler(
username, password));
lc.login();// 如果驗(yàn)證失敗會(huì)拋出異常
return true;
} catch (LoginException e) {
e.printStackTrace();
return false;
} catch (SecurityException e) {
e.printStackTrace();
return false;
}
}
}
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
public class SampleCallbackHandler implements CallbackHandler {
private String username;
private String password;
public SampleCallbackHandler(final String username, final String password) {
this.username = username;
this.password = password;
}
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
for (int index = 0; index < callbacks.length; index++) {
if (callbacks[index] instanceof NameCallback) {
NameCallback ncb = (NameCallback) callbacks[index];
ncb.setName(username);
}
if (callbacks[index] instanceof PasswordCallback) {
PasswordCallback pcb = (PasswordCallback) callbacks[index];
pcb.setPassword(password.toCharArray());
}
}
}
}
三、驗(yàn)證實(shí)現(xiàn)
import java.io.IOException;
import java.util.Map;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
public class SampleLoginModule implements LoginModule {
private boolean isAuthenticated = false;
private CallbackHandler callbackHandler;
private Subject subject;
private SamplePrincipal principal;
public void initialize(Subject subject, CallbackHandler callbackHandler,
Map sharedState, Map options) {
this.subject = subject;
this.callbackHandler = callbackHandler;
}
public boolean login() throws LoginException {
try {
NameCallback nameCallback = new NameCallback("username");
PasswordCallback passwordCallback = new PasswordCallback("password",
false);
final Callback[] calls = new Callback[] { nameCallback, passwordCallback };
// 獲取用戶數(shù)據(jù)
callbackHandler.handle(calls);
String username = nameCallback.getName();
String password = String.valueOf(passwordCallback.getPassword());
// TODO 驗(yàn)證，如：查詢數(shù)據(jù)庫(kù)、LDAP。。。
if (true) {// 驗(yàn)證通過(guò)
principal = new SamplePrincipal(username);
isAuthenticated = true;
} else {
throw new LoginException("user or password is wrong");
}
} catch (IOException e) {
throw new LoginException("no such user");
} catch (UnsupportedCallbackException e) {
throw new LoginException("login failure");
}
return isAuthenticated;
}
/**
* 驗(yàn)證后的處理,在Subject中加入用戶對(duì)象
*/
public boolean commit() throws LoginException {
if (isAuthenticated) {
subject.getPrincipals().add(principal);
} else {
throw new LoginException("Authentication failure");
}
return isAuthenticated;
}
public boolean abort() throws LoginException {
return false;
}
public boolean logout() throws LoginException {
subject.getPrincipals().remove(principal);
principal = null;
return true;
}
}
import java.security.Principal;
public final class SamplePrincipal implements Principal {
private String name;
public SamplePrincipal(String name) {
this.name = name;
}
public String getName() {
return name;
}
public boolean equals(Object o) {
return (o instanceof SamplePrincipal)
&& this.name.equalsIgnoreCase(((SamplePrincipal) o).name);
}
public int hashCode() {
return name.toUpperCase().hashCode();
}
}