java - 使用 JDBCRealm 时出现异常

Question

如何调试 request.login() 方法引起的 javax.servlet.ServletException？
登录.java

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    // TODO Auto-generated method stub
    PrintWriter out = response.getWriter();
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    try {       
        request.login(username, password); // Exceptions happen.
        out.println("logged in");
    } catch (Exception e) {
        e.printStackTrace();
    }
}

tomcat 服务器.xml

  <!-- Use the LockOutRealm to prevent attempts to guess user passwords
           via a brute-force attack -->
      <Realm className="org.apache.catalina.realm.LockOutRealm">
        <!-- This Realm uses the UserDatabase configured in the global JNDI
             resources under the key "UserDatabase".  Any edits
             that are performed against this UserDatabase are immediately
             available for use by the Realm.  -->
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
      </Realm>


<!-- added by myself>
    <Context>
      <Realm className="org.apache.catalina.realm.JDBCRealm" 
          connectionName="root" 
          connectionPassword="password" 
          connectionURL="jdbc:mysql://localhost/forum?autoReconnectForPools=true&amp;characterEncoding=UTF-8" 
          digest="MD5" 
          driverName="com.mysql.jdbc.Driver" 
          roleNameCol="role_name" 
          userCredCol="user_pass"
          userNameCol="user_name"
          userRoleTable="user_roles"
          userTable="users" />
     </Context>

异常(exception):

javax.servlet.ServletException: Login failed at org.apache.catalina.authenticator.AuthenticatorBase.doLogin(AuthenticatorBase.java:963) at org.apache.catalina.authenticator.AuthenticatorBase.login(AuthenticatorBase.java:943) at org.apache.catalina.connector.Request.login(Request.java:2768) at org.apache.catalina.connector.RequestFacade.login(RequestFacade.java:1064) at com.example.Login.doPost(Login.java:55) at javax.servlet.http.HttpServlet.service(HttpServlet.java:650) at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1115) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745)

Answer 1

你得到一个 Login fail因为您用于在数据库中创建散列密码的方法与 Tomcat 使用的方法不同 JDBCRealm .

而不是使用 MySql MD5功能，你应该使用digest Tomcat 提供的工具(在 Tomcat 安装的 bin 目录中)生成散列密码。

例如(密码为“1”):

[steve@Steves-MacBook-Pro apache-tomcat-8.0.18]$ bin/digest.sh -s 0 -a MD5 1
1:$1$c4ca4238a0b923820dcc509a6f75849b

我预计此结果 ( $1$c4ca4238a0...) 与您将在数据库表中观察到的不同。

此外，根据 Tomcat 8 Realm Configuration HOW-TO , 你应该消化值 {username}:{realm}:{cleartext-password}而不仅仅是 {cleartext-password}并将其存储在数据库中。 {realm}值来自 <realm-name>在您的 web.xml 文件中。