使用 OpenAM token 来确定用户的 Java REST API？

Question

我无法使用 OpenAM 验证用户 token 。特别是我应该创建什么类型的代理。有没有人可以推荐一个解决方案？

本质上，REST API 将读取用户 OpenAM tokenid 并使用 OpenAM 验证 token ，然后 OpenAM 将返回包含用户名的数据。该用户名可以在 REST API 方法中使用来识别谁正在访问该方法。

更简单的是如何使用 OpenAM token 来获取 OpenAM 用户信息。

谢谢!

Answer 1

您可以使用以下端点:

1. 验证用户身份:

   curl --request POST --header "X-OpenAM-Username: demo" \
   --header "X-OpenAM-Password: changeit" \
   --header "Content-Type: application/json"      
   "http://openam.example.com:8080/sso/json/authenticate"
   
   {"tokenId":"AQIC5wM2LY4SfcyTReB5nbrLt3QaH-7GhPuU2-uK2k5tJsA.*AAJTSQACMDEAAlNLABMyOTUxODgxODAwOTE0MTA4NDE3*","successUrl":"/sso/console"}
   

2. 验证 token :

   curl --request POST \
   --header "Content-Type: application/json" \
   "http://openam.example.com:8080/sso/json/sessions/AQIC5wM2LY4SfczadxSebQWi9UEyd2ZDnz_io0Pe6NDgMhY.*AAJTSQACMDEAAlNLABM3MTMzMTYwMzM1NjE4NTE4NTMx*?_action=validate"
   
   {"valid":true,"uid":"demo","realm":"/"}
   

3. 获取个人资料属性:

   curl --request GET \
   --header "iPlanetDirectoryPro: AQIC5wM2LY4SfczadxSebQWi9UEyd2ZDnz_io0Pe6NDgMhY.*AAJTSQACMDEAAlNLABM3MTMzMTYwMzM1NjE4NTE4NTMx*" \
   "http://openam.example.com:8080/sso/json/users/demo"
   
   {"username":"demo","realm":"/","uid":["demo"],"userPassword":["{SSHA}cIgTNGHWd4t4Ff3SHa6a9pjMyn/Z3e3EOp5mrA=="],"sn":["demo"],"createTimestamp":["20160406210602Z"],"cn":["demo"],"givenName":["demo"],"inetUserStatus":["Active"],"dn":["uid=demo,ou=people,dc=example,dc=com"],"objectClass":["devicePrintProfilesContainer","person","sunIdentityServerLibertyPPService","inetorgperson","sunFederationManagerDataStore","iPlanetPreferences","iplanet-am-auth-configuration-service","organizationalperson","sunFMSAML2NameIdentifier","oathUser","inetuser","forgerock-am-dashboard-service","iplanet-am-managed-person","iplanet-am-user-service","sunAMAuthAccountLockout","top"],"universalid":["id=demo,ou=user,dc=openamcfg,dc=example,dc=com"]}