Jboss EAPのHTTPServerAuthModuleから認証を削除する方法

Question

認証用のユーザー名とパスワードの入力を求めないHTTPBasicServerAuthModuleに似たカスタム認証モジュールを作成する必要があります。なぜなら、私たちには認証を処理するjwtトークンがあり、別の認証層は必要ないからです。私のカスタム認証モジュールを以下に示します。

public class CustomJaspiAuthModule extends WebServerAuthModule 
{ 
    protected Context context; 
    protected boolean cache = false; 
    public static final byte[] AUTHENTICATE_BYTES = { 
     (byte) 'W', 
     (byte) 'W', 
     (byte) 'W', 
     (byte) '-', 
     (byte) 'A', 
     (byte) 'u', 
     (byte) 't', 
     (byte) 'h', 
     (byte) 'e', 
     (byte) 'n', 
     (byte) 't', 
     (byte) 'i', 
     (byte) 'c', 
     (byte) 'a', 
     (byte) 't', 
     (byte) 'e' 
    }; 
    protected String delegatingLoginContextName = null; 

    public CustomJaspiAuthModule() { } 

    public CustomJaspiAuthModule(String delegatingLoginContextName) { 
     super(); 
     this.delegatingLoginContextName = delegatingLoginContextName; 
    } 

    @Override 
    public AuthStatus secureResponse(MessageInfo messageInfo, Subject serviceSubject) throws AuthException { 
     // do nothing, just return SUCCESS. 
     return AuthStatus.SUCCESS; 
    } 

    @Override 
    public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException { 
     Request request = (Request) messageInfo.getRequestMessage(); 
     Response response = (Response) messageInfo.getResponseMessage(); 

     Principal principal; 
     context = request.getContext(); 
     LoginConfig config = context.getLoginConfig(); 

     // validate any credentials already included with this request. 
     String username = null; 
     String password = null; 

     MessageBytes authorization = request.getCoyoteRequest().getMimeHeaders().getValue("authorization"); 

     if (authorization != null) { 
      authorization.toBytes(); 
      ByteChunk authorizationBC = authorization.getByteChunk(); 

      if (authorizationBC.startsWithIgnoreCase("basic ", 0)) { 
       authorizationBC.setOffset(authorizationBC.getOffset() + 6); 
       CharChunk authorizationCC = authorization.getCharChunk(); 
       Base64.decode(authorizationBC, authorizationCC); 

       // get username and password from the authorization char chunk. 
       int colon = authorizationCC.indexOf(':'); 
       if (colon < 0) { 
        username = authorizationCC.toString(); 
       } else { 
        char[] buf = authorizationCC.getBuffer(); 
        username = new String(buf, 0, colon); 
        password = new String(buf, colon + 1, authorizationCC.getEnd() - colon - 1); 
       } 

       authorizationBC.setOffset(authorizationBC.getOffset() - 6); 
      } 

      principal = context.getRealm().authenticate(username, password); 
      if (principal != null) { 
       registerWithCallbackHandler(principal, username, password); 

       return AuthStatus.SUCCESS; 
      } 
     } 

     // send an "unauthorized" response and an appropriate challenge. 
     MessageBytes authenticate = response.getCoyoteResponse().getMimeHeaders(). 
       addValue(AUTHENTICATE_BYTES, 0, AUTHENTICATE_BYTES.length); 

     CharChunk authenticateCC = authenticate.getCharChunk(); 
     try { 
      authenticateCC.append("Basic realm=\""); 
      if (config.getRealmName() == null) { 
       authenticateCC.append(request.getServerName()); 
       authenticateCC.append(':'); 
       authenticateCC.append(Integer.toString(request.getServerPort())); 
      } else { 
       authenticateCC.append(config.getRealmName()); 
      } 
      authenticateCC.append('\"'); 
      authenticate.toChars(); 

      response.sendError(HttpServletResponse.SC_UNAUTHORIZED); 
     } catch (IOException e) { 
      // Ignore IOException here (client disconnect) 
     } 

     return AuthStatus.FAILURE; 
    } 

} 

私は、次のコードの一部は、我々は、プロンプトが認証のためのユーザ名とパスワードアラートを入力するようになっている理由であると信じています。

MessageBytes authenticate = response.getCoyoteResponse().getMimeHeaders(). 
       addValue(AUTHENTICATE_BYTES, 0, AUTHENTICATE_BYTES.length); 

     CharChunk authenticateCC = authenticate.getCharChunk(); 
     try { 
      authenticateCC.append("Basic realm=\""); 
      if (config.getRealmName() == null) { 
       authenticateCC.append(request.getServerName()); 
       authenticateCC.append(':'); 
       authenticateCC.append(Integer.toString(request.getServerPort())); 
      } else { 
       authenticateCC.append(config.getRealmName()); 
      } 
      authenticateCC.append('\"'); 
      authenticate.toChars(); 

      response.sendError(HttpServletResponse.SC_UNAUTHORIZED); 
     } catch (IOException e) { 
      // Ignore IOException here (client disconnect) 
     } 

しかし、私はこのブロックを削除した場合、私は（200応答）バック良い反応を得ていますが、私は戻って取得していますことを、要求と応答が空です。この認証アラートを削除する方法を提案してください。

Answer 1

私は次のようなカスタム認証モジュールを書いて、それが私の目的を果たし：

public class CustomJaspiAuthModule extends WebServerAuthModule 
{ 
    private static final String CLASSNAME = "CustomJaspiAuthModule"; 
    private static Logger  logger  = Logger.getLogger(CustomJaspiAuthModule.class.getName()); 

    protected Context context; 
    protected String delegatingLoginContextName = null; 

    public CustomJaspiAuthModule() { } 

    public CustomJaspiAuthModule(String delegatingLoginContextName) 
    { 
     super(); 
     this.delegatingLoginContextName = delegatingLoginContextName; 
    } 

    @Override 
    public AuthStatus secureResponse(MessageInfo messageInfo, Subject serviceSubject) throws AuthException 
    { 
     // do nothing, just return SUCCESS. 
     return AuthStatus.SUCCESS; 
    } 

    @Override 
    public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException 
    { 
     final String METHOD_NAME = "validateRequest"; 
     logger.logp(Level.INFO, CLASSNAME, METHOD_NAME, "**IN AUTHENTICATION MODULE**CustomJaspiAuthModule.validateRequest()"); 

     Request request = (Request) messageInfo.getRequestMessage(); 
     Response response = (Response) messageInfo.getResponseMessage(); 

     boolean authenticated = false; 
     context = request.getContext(); 
     Principal principal = context.getRealm().authenticate("*", "*"); 

     Callback[] callbacks = new Callback[] { 
       new CallerPrincipalCallback(clientSubject, (Principal) null) }; 

     if (principal != null) 
     { 
      callbacks = new Callback[] { 
        new CallerPrincipalCallback(clientSubject, principal) }; 
      authenticated = true; 
     } 

     if (authenticated) 
     { 
      try 
      { 
       callbackHandler.handle(callbacks); 
      } 
      catch (final Exception e) 
      { 
       throw (AuthException) new AuthException().initCause(e); 
      } 
      return AuthStatus.SUCCESS; 
     } 

     return AuthStatus.FAILURE; 
    } 
}