java - 使用 LDAP 验证 Spring Web 服务

Question

我想公开一个使用 LDAP 进行身份验证的示例 Spring Web 服务。首先，我创建了 Web 服务:

import javax.jws.WebMethod;
import javax.jws.WebService;

import com.domain.SampleEntity;

/**
* Actual web service implementation.
* 
*/
@WebService
public class SampleEntityWebService {
    /**
    * Read and return SampleEntity by a supplied id.
    */
    @WebMethod
    public SampleEntityByIdResponse readSampleEntityById(Long id) {
        SampleEntity sampleEntity = new SampleEntity();
        sampleEntity.setId(id);
        SampleEntityByIdResponse sampleEntityByIdResponse = new SampleEntityByIdResponse();
        sampleEntityByIdResponse.setSampleEntity(sampleEntity);
        return sampleEntityByIdResponse;
    }
}

Web 服务提供者配置包含:

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:int="http://www.springframework.org/schema/integration"
    xmlns:context="http://www.springframework.org/schema/context" xmlns:ws="http://www.springframework.org/schema/integration/ws"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:sws="http://www.springframework.org/schema/web-services"
    xsi:schemaLocation="http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-2.1.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
        http://www.springframework.org/schema/integration/ws http://www.springframework.org/schema/integration/ws/spring-integration-ws-2.1.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
        http://www.springframework.org/schema/web-services http://www.springframework.org/schema/web-services/web-services-2.0.xsd
        ">

    <!-- TOOD: Check if required or not -->

    <!-- <bean id="simpleJaxWzServiceExporter"
        class="org.springframework.remoting.jaxws.SimpleJaxWsServiceExporter">
        <property name="baseAddress" value="${ws.base.url}" />
    </bean> -->

    <!-- <context:component-scan base-package="com.integration.ws.provider" /> -->

    <!-- <context:property-placeholder location="classpath:META-INF/spring/web-service.properties" /> -->

    <bean id="sampleEntityMarshaller" class="org.springframework.oxm.jaxb.Jaxb2Marshaller">
        <property name="classesToBeBound">
            <list>
                <value>com.integration.ws.provider.SampleEntityByIdRequest</value>
                <value>com.integration.ws.provider.SampleEntityByIdResponse</value>
                <value>com.domain.SampleEntity</value>
            </list>
        </property>
    </bean>

    <bean
        class="org.springframework.ws.server.endpoint.mapping.UriEndpointMapping">
        <property name="mappings">
            <props>
                <prop key="${ws.base.url}/sampleEntityById">sampleEntity-by-id-gateway</prop>
            </props>
        </property>
        <property name="interceptors">
            <list>
                <ref local="wsSecurityInterceptor" />
            </list>
        </property>
    </bean>  

    **<bean id="wsSecurityInterceptor"
        class="org.springframework.ws.soap.security.xwss.XwsSecurityInterceptor">
        <property name="policyConfiguration" value="classpath:META-INF/securityPolicy.xml" />
        <property name="callbackHandlers">
            <list>
                <ref bean="authenticationHandler"/>
            </list>
        </property>
    </bean>**

    <bean id="authenticationHandler"
        class="org.springframework.ws.soap.security.xwss.callback.SpringDigestPasswordValidationCallbackHandler">
          <property name="userDetailsService">
            <bean class="org.springframework.security.core.userdetails.memory.InMemoryDaoImpl">
                <property name="userMap">
                    <value>
                        ${wsUserName}=${wsUserPassword},ROLE_USER
                    </value>
                </property>
            </bean>
          </property> 
    </bean> 


    <ws:inbound-gateway id="sampleEntity-by-id-gateway"
        request-channel="sampleEntityRequestById" marshaller="sampleEntityMarshaller"
        unmarshaller="sampleEntityMarshaller" reply-channel="sampleEntityResponse" />

    <int:channel id="sampleEntityRequestById" />
    <int:channel id="sampleEntityResponse" />

    <int:service-activator
        expression="@sampleEntityWebService.readSampleEntityById(payload.id)"
        input-channel="sampleEntityRequestById" output-channel="sampleEntityResponse" requires-reply="true"/>

    <int:channel id="sampleEntitys" />

</beans>

引用的安全策略文件包含:

<xwss:SecurityConfiguration dumpMessages="true" xmlns:xwss="http://java.sun.com/xml/ns/xwss/config"> 
    <xwss:RequireUsernameToken passwordDigestRequired="true" nonceRequired="true"/> 
    </xwss:SecurityConfiguration>

该服务运行良好。现在我想使用 LDAP 对访问此服务的用户进行身份验证。我是 Spring Web 服务和安全的新手。任何人都可以建议将 Spring Web 服务与 LDAP 集成所需的配置更改吗？

Answer 1

您可以将用户详细信息服务从 InMemoryDaoImpl 更改为 LdapUserDetailsS​​ervice。

我可以获得的配置是:

<bean id="contextSource"
        class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
  <constructor-arg value="ldap://monkeymachine:389/dc=springframework,dc=org"/>
  <property name="userDn" value="cn=manager,dc=springframework,dc=org"/>
  <property name="password" value="password"/>
</bean>

<bean id="ldapPopulator" class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
   <constructor-arg ref="contextSource"/>
   <constructor-arg value="ou=groups"/>
   <property name="groupRoleAttribute" value="ou"/>
</bean>

<bean id="userSearch"
    class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
    <constructor-arg index="0"
        value="ou=People,o=MyCompany,o=Intranet" />
    <constructor-arg index="1" value="(uid={0})" />
    <constructor-arg index="2" ref="contextSource" />
</bean>

<bean id="authenticationHandler" class="org.springframework.ws.soap.security.xwss.callback.SpringDigestPasswordValidationCallbackHandler">
      <property name="userDetailsService">
        <bean class="org.springframework.security.ldap.userdetails.LdapUserDetailsService">
             <constructor-arg ref="userSearch">
             <constructor-arg ref="ldapPopulator">
        </bean>
      </property> 
</bean> 

请记住，我还没有尝试过，并且大部分部分是我从其他来源复制的。您需要的是 UserDetailsS​​ervice，只需将其设置为 authenticationHandler 即可。来自 LdapUserDetailsService源代码中，它需要两个构造函数，LdapUserSearch和LdapAuthoritiesPopulator。我在 google 上搜索了一个有关如何实例化 LdapUserSearch bean 的示例，并从 here 找到了示例。 。我从官方文档中找到了 LdapPopulator bean 示例。

有关 Spring Security 的 Ldap 身份验证的更多详细信息，请访问 official documentation .

我希望你了解LDAP，因为我对LDAP一无所知。祝你好运。