java - 在 Tomcat 中扩展 ValveBase 总是为 request.getRemoteUser() 返回 null

Question

我已经在 Tomcat 8.0.51 和 9.0.14 中测试过，结果相同。在 Ubuntu Linux 16.04 上运行。

此示例代码只是将所有请求记录到控制台(或 catalina.out)。主要问题是 request.getRemoteUser() 总是返回 null - 即使用户已通过身份验证。

我注意到当用户通过身份验证时，AccessLogValve 和 JDBCAccessLogValve 阀会正确返回登录名/用户名。我在下面通过显示与我的 Valve 记录到标准控制台日志的相同代码行的 access_log 行来展示这一点。

是否需要为我的 LoginValve 扩展或实现一个类，以便在用户通过身份验证时返回登录名/用户？我还尝试调用 request.getUserPrincipal()，它也总是返回 null。

非常感谢任何关于为什么这对 ValveBase 被阻止但对 AccessLogs 有效的帮助。

package org.apache.catalina.connector;

import java.io.IOException;
import java.time.LocalDateTime;
import javax.servlet.ServletException;
import javax.servlet.http.HttpSession;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.valves.ValveBase;

public class LoginValve extends ValveBase {
    public void invoke(Request request, Response response) throws IOException, ServletException {
        String reqlogin=request.getRemoteUser();
        String method=request.getMethod();
        String requestURI=request.getRequestURI();
        HttpSession session = request.getRequest().getSession();
        String sid=session.getId();
        String user_id = (String) session.getAttribute("UserID");
        String sesslogin=(String) session.getAttribute("login");  // put in session by app code
        LocalDateTime now=LocalDateTime.now();
        System.out.println("LoginValve: "+now+" sid: "+sid+" UserID: "+user_id+" method: "+method+" requestURI: "+requestURI+" reqlogin: "+reqlogin+" sesslogin: "+sesslogin);

        getNext().invoke(request, response);
    }
}

LoginValve 在下方时的输出。请注意，通过调用 request.getRemoteUser() 提供的字段是 reqlogin。 sesslogin 字段由应用填充到 session 中，与 getRemoteUser() 调用无关。

LoginValve: 2019-02-02T15:58:06.034 sid: 79D54B40DB8131E2A74375A67CE72ECD UserID: 3776559 method: GET requestURI: /app/auth/logoff.jsp reqlogin: null sesslogin: joe_user
LoginValve: 2019-02-02T15:58:06.050 sid: 41D1AD1DBBE5FA1D6EE4CB7A350D7DD6 UserID: null method: GET requestURI: /app/index.jsp reqlogin: null sesslogin: null
LoginValve: 2019-02-02T15:58:07.958 sid: 41D1AD1DBBE5FA1D6EE4CB7A350D7DD6 UserID: null method: GET requestURI: /app/user/index.jsp reqlogin: null sesslogin: null
LoginValve: 2019-02-02T15:58:10.006 sid: F75895CAE2521849902CF9894E39A039 UserID: null method: POST requestURI: /app/user/j_security_check reqlogin: null sesslogin: null
LoginValve: 2019-02-02T15:58:10.020 sid: F75895CAE2521849902CF9894E39A039 UserID: null method: GET requestURI: /app/user/index.jsp reqlogin: null sesslogin: null
LoginValve: 2019-02-02T15:58:13.743 sid: 0BBD2544A3C117E32FEE0A03840EAEAE UserID: 3776559 method: GET requestURI: /app/user/transactions.jsp reqlogin: null sesslogin: joe_user
LoginValve: 2019-02-02T15:58:18.127 sid: 0BBD2544A3C117E32FEE0A03840EAEAE UserID: 3776559 method: GET requestURI: /app/user/profile.jsp reqlogin: null sesslogin: joe_user
LoginValve: 2019-02-02T15:58:20.961 sid: 0BBD2544A3C117E32FEE0A03840EAEAE UserID: 3776559 method: GET requestURI: /app/user/feedback.jsp reqlogin: null sesslogin: joe_user
LoginValve: 2019-02-02T15:58:22.930 sid: 0BBD2544A3C117E32FEE0A03840EAEAE UserID: 3776559 method: GET requestURI: /app/user/ reqlogin: null sesslogin: joe_user
LoginValve: 2019-02-02T15:58:24.849 sid: 0BBD2544A3C117E32FEE0A03840EAEAE UserID: 3776559 method: GET requestURI: /app/auth/logoff.jsp reqlogin: null sesslogin: joe_user
LoginValve: 2019-02-02T15:58:24.872 sid: 879B16BB6831D4E07B486C7C0712AE5D UserID: null method: GET requestURI: /app/index.jsp reqlogin: null sesslogin: null

这里是 localhost_access_log 文件的输出(它确实记录了用户 joe_user 调用 request.getRemoteUser() :

127.0.0.1 - joe_user [02/Feb/2019:15:58:06 -0600] "GET /app/auth/logoff.jsp HTTP/1.1" 302 -
127.0.0.1 - - [02/Feb/2019:15:58:06 -0600] "GET /app/index.jsp HTTP/1.1" 200 9303
127.0.0.1 - - [02/Feb/2019:15:58:07 -0600] "GET /app/user/index.jsp HTTP/1.1" 200 6297
127.0.0.1 - - [02/Feb/2019:15:58:10 -0600] "POST /app/user/j_security_check HTTP/1.1" 303 -
127.0.0.1 - joe_user [02/Feb/2019:15:58:10 -0600] "GET /app/user/index.jsp HTTP/1.1" 200 29637
127.0.0.1 - joe_user [02/Feb/2019:15:58:14 -0600] "GET /app/user/transactions.jsp HTTP/1.1" 200 1742146
127.0.0.1 - joe_user [02/Feb/2019:15:58:18 -0600] "GET /app/user/profile.jsp HTTP/1.1" 200 9793
127.0.0.1 - joe_user [02/Feb/2019:15:58:21 -0600] "GET /app/user/feedback.jsp HTTP/1.1" 200 5476
127.0.0.1 - joe_user [02/Feb/2019:15:58:23 -0600] "GET /app/user/ HTTP/1.1" 200 29637
127.0.0.1 - joe_user [02/Feb/2019:15:58:24 -0600] "GET /app/auth/logoff.jsp HTTP/1.1" 302 -
127.0.0.1 - - [02/Feb/2019:15:58:24 -0600] "GET /app/index.jsp HTTP/1.1" 200 9303

同样，问题是，如何调用 request.getRemoteUser() 以在用户通过身份验证时返回登录用户。

Answer 1

Is there a class I need to extend or implement for my LoginValve to return the login/user when the user is authenticated?

是的，您需要实现 Interface AccessLog它在其文档中声明“旨在供 Valve 使用以指示 Valve 提供访问日志记录。”

这就是 JDBCAccessLogValve 和 AccessLogValve 的作用。

这里是示例代码:

package org.stack;

import java.io.IOException;
import java.time.LocalDateTime;
import javax.servlet.ServletException;
import javax.servlet.http.HttpSession;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.valves.ValveBase;
import org.apache.catalina.AccessLog;

public class LoginValve extends ValveBase implements AccessLog {

    // Should this valve set request attributes for IP address, hostname, protocol and port used for the request?
    boolean requestAttributesEnabled = false;

    @Override
    public void invoke(Request request, Response response) throws IOException, ServletException {
        // null 
        System.out.println("LoginValve-invoke: " + request.getRemoteUser());
        getNext().invoke(request, response);
    }

    @Override
    public void log(Request request, Response response, long time) {
        // remote user
        System.out.println("LoginValve-log: " + request.getRemoteUser());
    }

    @Override
    public void setRequestAttributesEnabled(boolean requestAttributesEnabled) {
        this.requestAttributesEnabled = requestAttributesEnabled;
    }

    @Override
    public boolean getRequestAttributesEnabled() {
        return requestAttributesEnabled;
    }
}

当启用 tomcat-users.xml 文件以允许在管理器 webapp 上进行身份验证时，我得到了肯定的结果:

curl -u stack:stack 'http://localhost:8080/manager/html'
..
$ grep 'LoginValve' catalina.out
LoginValve-invoke: null
LoginValve-log: stack