java - 使用 tynamo-security 模块在 Tapestry Web 应用程序中实现身份验证功能的问题

Question

我对 Tapestry 和 tynamo-security 模块完全陌生，需要你的帮助。

我想使用 tynamo-security 和 hibernate 在我的 Web 应用程序上实现身份验证功能。我按照说明here进行操作但这还不足以让我让它发挥作用。

到目前为止，我已经实现了一个用户实体及其 dao:

package com.example.tynamo.entities;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;

import org.apache.tapestry5.beaneditor.NonVisual;
import org.apache.tapestry5.beaneditor.Validate;

@Entity
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    @NonVisual
    private Long id;

    @Validate("required")
    private String firstName;

    @Validate("required")
    private String lastName;

    @Validate("required")
    private String email;

    @Validate("required")
    private String loginName;

    @Validate("required")
    private String password;

    public User(){

    }

    public User(String firstName, String lastName, String email, String userName, String password){
        this.loginName = userName;
        this.firstName = firstName;
        this.lastName = lastName;
        this.email = email;
        this.password = password;
    }

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getFirstName() {
        return firstName;
    }

    public void setFirstName(String firstName) {
        this.firstName = firstName;
    }

    public String getLastName() {
        return lastName;
    }

    public void setLastName(String lastName) {
        this.lastName = lastName;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getLoginName() {
        return loginName;
    }

    public void setLoginName(String loginName) {
        this.loginName = loginName;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public String toString(){
        return loginName + " : " + firstName + " " + lastName + " - " + email + " : " + password;
    }
}


package com.example.tynamo.dao.impl;

import java.util.List;

import org.hibernate.Session;
import org.hibernate.SessionFactory;
import org.hibernate.Transaction;
import org.hibernate.cfg.Configuration;
import org.hibernate.criterion.Criterion;
import org.hibernate.criterion.Restrictions;
import org.hibernate.exception.ConstraintViolationException;

import com.example.tynamo.dao.UserDAO;
import com.example.tynamo.entities.User;

public class UserDAOImpl implements UserDAO {

    private SessionFactory factory = new Configuration().configure().buildSessionFactory();

    public void insertUser(User user) {
        Session session = factory.openSession();
        Transaction tx = session.beginTransaction();
        try {
            System.out.println(session.save(user));
            tx.commit();
            session.close();
        } catch (ConstraintViolationException e) {
            System.out.println(e.getErrorCode());
        }
    }

    public User loadUserById(int id) {
        Session session = factory.openSession();
        User u = (User) session.load(User.class, id);
        session.close();
        return u;
    }

    public User loadUserByLoginName(String loginName) {
        Session session = factory.openSession();
        User u = (User) session.createCriteria(User.class).add(Restrictions.eq("loginName", loginName)).uniqueResult();
        session.close();
        return u;
    }

    @SuppressWarnings("unchecked")
    public List<User> loadAllUser() {
        Session session = factory.openSession();
        List<User> list = session.createCriteria(User.class).list();
        session.close();
        return list;
    }

}

此外，我在 AppModule 中添加了一些行:

在 Binder 方法中:

binder.bind(UserDAO.class, UserDAOImpl.class);

...描述的方法 here

public static void contributeSecurityConfiguration(Configuration<SecurityFilterChain> configuration,
            SecurityFilterChainFactory factory)

...以及将我自己的 UserRalm 添加到配置中的 addRealms 方法。

@Contribute(WebSecurityManager.class)
    public static void addRealms(Configuration<Realm> configuration) {
        UserRealm realm = new UserRealm();
        configuration.add(realm);
    }

我从 here 获取了 UserRealm 的示例类并修改如下

package com.example.tynamo.security;


import java.util.HashSet;
import java.util.Set;

import org.apache.shiro.authc.AccountException;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.ExpiredCredentialsException;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.cache.MemoryConstrainedCacheManager;
import org.apache.shiro.crypto.hash.Sha1Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.SimpleByteSource;
import org.apache.tapestry5.ioc.annotations.Inject;
import org.hibernate.Session;
import org.hibernate.criterion.Restrictions;

import com.example.tynamo.dao.UserDAO;
import com.example.tynamo.entities.User;

public class UserRealm extends AuthorizingRealm {

    @Inject
    UserDAO userDAO;

    public UserRealm() {
        super(new MemoryConstrainedCacheManager());
        setName("localaccounts");
        setAuthenticationTokenClass(UsernamePasswordToken.class);
        setCredentialsMatcher(new HashedCredentialsMatcher(Sha1Hash.ALGORITHM_NAME));
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        if (principals == null) throw new AuthorizationException("PrincipalCollection was null, which should not happen");

        if (principals.isEmpty()) return null;

        if (principals.fromRealm(getName()).size() <= 0) return null;

        String username = (String) principals.fromRealm(getName()).iterator().next();
        if (username == null) return null;

        User user = findByUsername(username);
        // if (user == null) return null;
        // Set<String> roles = new HashSet<String>(user.getRoles().size());
        // for (Role role : user.getRoles())
            // roles.add(role.name());
        //return new SimpleAuthorizationInfo(roles);
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;

        String username = upToken.getUsername();

        // Null username is invalid
        if (username == null) { throw new AccountException("Null usernames are not allowed by this realm."); }

        User user = findByUsername(username);

        //if (user.isAccountLocked()) { throw new LockedAccountException("Account [" + username + "] is locked."); }
        //if (user.isCredentialsExpired()) {
        //  String msg = "The credentials for account [" + username + "] are expired";
        //  throw new ExpiredCredentialsException(msg);
        //}
        //return new SimpleAuthenticationInfo(username, user.getEncodedPassword(), new SimpleByteSource(user.getPasswordSalt()), getName());
        return null;
    }

    private User findByUsername(String username) {
        return userDAO.loadUserByLoginName(username);
    }
}

我注释掉了还不起作用的部分。我自己实现的用户实体没有此处要求的方法，并且我找不到任何可以帮助我实现这些方法的用户界面(只是联合的)。我究竟做错了什么？有人可以帮我吗？

tynamo-security 是否还提供注册页面(等等)？

Answer 1

你成功了吗？

我注意到的一件事是您自己实例化了 UserRealm ，因此 @Inject 在那里不起作用。您可以允许 Tapestry 使用 configuration.addInstance(UserRealm.class) 实例化它，也可以使用构造函数传递对 UserDAO 的引用。

由于您没有提到您面临的错误类型，因此很难回答。