如何使用 j_security_check jsf

Question

我想使用 j_security_check 身份验证来验证用户凭据。

基本上我想要实现的是当用户按下提交时，如果他使用了错误的凭据，则会显示一条消息 (p:growl)，如果成功，则对话框将关闭。

网络上有很多例子，但不幸的是我仍然无法理解如何完成这个难题:(

在我的项目中，我使用的是 primefaces 4.0 和 weblogic 10.3.2.0 (JAVA EE 5)。

一些代码示例：

<p:dialog id="dialog" widgetVar="dlg" resizable="false"> 
    <h:form id="fLogin" prependId="false"
            onsubmit="document.getElementById('fLogin').action = 'j_security_check';">        
        <h:panelGrid columns="2" cellpadding="5">  
            <h:outputLabel for="j_username" value="Username:" />  
            <p:inputText value="#{expBean.username}"   
                         id="j_username" label="username"/>  
            <h:outputLabel for="j_password" value="Password:" />  
            <h:inputSecret value="#{expBean.password}"   
                           id="j_password" label="password"/>  
            <p:commandButton id="submitButton" 
                             value="Submit"
                             actionListener="#{expBean.run}" /> 
        </h:panelGrid> 
    </h:form>
</p:dialog>

web.xml

<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
    <url-pattern>*.jsf</url-pattern>
</servlet-mapping>
<security-constraint>
    <web-resource-collection>
        <web-resource-name>main</web-resource-name>
        <description/>
        <url-pattern>main.jsf</url-pattern>
        <http-method>POST</http-method>
    </web-resource-collection>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>my-realm</realm-name>
</login-config>
<security-role>
    <description/>
    <role-name>MyRole</role-name>
</security-role>

exeBean：

   public void run() {


      FacesContext facesContext = FacesContext.getCurrentInstance();

   }

任何指南和有用的例子将不胜感激

谢谢

Answer 1

您通过 PrimeFaces ajax 提交表单。这就是它失败的原因。 j_security_check 处理程序不理解传入的 JSF/PrimeFaces 风格的 ajax 请求，并且无法通过返回所需的 XML 响应来适当地处理它们。它必须是常规（同步）提交。

关掉ajax的东西：

<p:commandButton ... ajax="false" />

顺便说一句，您的表单声明很笨拙。只需使用<form> 而不是<h:form>。

<form id="fLogin" action="j_security_check">

Answer 2

在尝试了一些策略之后，我选择不使用 j_security_check 并以这种方式实现身份验证：

@ManagedBean
@ViewScoped
public class AuthBean implements Serializable
{
    private static final long serialVersionUID = 1L;
    private static final Logger logger = LoggerFactory.getLogger(AuthBean.class);

    @EJB
    private PersistenceService service;

    @ManagedProperty("#{user}")
    private UserBean userBean;

    private String email;
    private String password;
    private String originalURL;

    @PostConstruct
    public void init()
    {
        logger.debug("called");

        ExternalContext externalContext = FacesContext.getCurrentInstance().getExternalContext();
        originalURL = (String) externalContext.getRequestMap().get(RequestDispatcher.FORWARD_REQUEST_URI);

        if(originalURL == null)
        {
            originalURL = externalContext.getRequestContextPath();
        }
        else
        {
            String originalQuery = (String) externalContext.getRequestMap().get(RequestDispatcher.FORWARD_QUERY_STRING);

            if(originalQuery != null)
            {
                originalURL += "?" + originalQuery;
            }
        }

        logger.debug("originalURL: {}", originalURL);
    }

    public void login() throws IOException
    {
        logger.debug("called");
        logger.debug("originalURL: {}", originalURL);

        FacesContext context = FacesContext.getCurrentInstance();
        ExternalContext externalContext = context.getExternalContext();
        HttpServletRequest request = (HttpServletRequest) externalContext.getRequest();

        try
        {
            request.login(email, password);
        }
        catch(ServletException e)
        {
            JsfUtils.addErrorMessage(e, "authentication failed");
            return;
        }

        Person person = service.queryOne(Person.class, "SELECT x FROM Person x WHERE x.email = ?1", email);
        if(person == null)
        {
            JsfUtils.addErrorMessage("authorization failed");
            return;
        }

        userBean.setPerson(person);
        externalContext.redirect(originalURL);
    }

    public void logout() throws IOException
    {
        ExternalContext externalContext = FacesContext.getCurrentInstance().getExternalContext();
        externalContext.invalidateSession();
        externalContext.redirect(externalContext.getRequestContextPath());
    }

    // getters/setters
}

在 /login.xhtml 中使用此表单：

<h:form>
    <p:panel header="#{bundle.login}">
        <h:panelGrid columns="3">
            <h:outputLabel for="email" value="#{bundle.email}" />
            <h:outputLabel for="password" value="#{bundle.password}" />
            <h:panelGroup />

            <p:inputText id="email" value="#{authBean.email}" label="#{bundle.email}" size="32" />
            <p:password id="password" value="#{authBean.password}" label="#{bundle.password}" feedback="false" size="32" />
            <p:commandButton value="#{bundle.login}" action="#{authBean.login}" icon="ui-icon ui-icon-check" />
        </h:panelGrid>
    </p:panel>
</h:form>

还有这个登录配置：

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>some-realm-name</realm-name>
    <form-login-config>
        <form-login-page>/login.jsf</form-login-page>
        <form-error-page>/login.jsf</form-error-page>
    </form-login-config>
</login-config>