在 TAI 中以编程方式验证用户

Question

我正在开发 TAI，它必须在 WebSphere Portal 中授权用户。

我的 TAI 使用 OpenID Connect 获取有关用户的所有信息，我想构建一些上下文，将其提供给 WAS 并告诉 WAS 他必须信任此上下文而无需本地帐户。

如何在 TAI 中授权用户而无需本地存储库中的用户帐户？

更新：

代码：

String userid = "bob";
String uniqueid = "bob";

Hashtable hashtable = new Hashtable();
hashtable.put(AttributeNameConstants.WSCREDENTIAL_UNIQUEID, uniqueid);
hashtable.put(AttributeNameConstants.WSCREDENTIAL_SECURITYNAME, userid);
hashtable.put(AttributeNameConstants.WSCREDENTIAL_CACHE_KEY, uniqueid+"MyCustom");

Subject subject = new Subject();
subject.getPublicCredentials().add(hashtable);
return TAIResult.create(HttpServletResponse.SC_OK, "ignored", subject);

日志：

[25.03.15 20:16:33:521 AMT] 00000043 ServiceLogger I com.ibm.ws.ffdc.IncidentStreamImpl initialize FFDC0009I: FFDC opened incident stream file  WebSphere_Portal_00000043_15.03.25_20.16.33_0.txt
[25.03.15 20:16:33:537 AMT] 00000043 ServiceLogger I com.ibm.ws.ffdc.IncidentStreamImpl resetIncidentStream FFDC0010I: FFDC closed incident stream file WebSphere_Portal_00000043_15.03.25_20.16.33_0.txt
[25.03.15 20:16:33:677 AMT] 00000043 StorageApi    E com.ibm.wps.policy.commands.StorageApi StorageApi EJQAB0064E: A Null argument was passed to the StorageApi constructor.
[25.03.15 20:16:33:724 AMT] 00000043 PolicyService E com.ibm.wps.policy.services.PolicyService Error Occured while creating storageAPI EJQAB0064E: A Null argument was passed to the StorageApi constructor.

FFDC:

------Start of DE processing------ = [3/25/15 20:16:33:474 AMT] , key = com.ibm.websphere.wim.exception.PropertyNotDefinedException com.ibm.ws.security.auth.ContextManagerImpl.runAs 4153
Exception = com.ibm.websphere.wim.exception.PropertyNotDefinedException
Source = com.ibm.ws.security.auth.ContextManagerImpl.runAs
probeid = 4153
Stack Dump = com.ibm.websphere.wim.exception.PropertyNotDefinedException: CWWIM0514W The 'dn' property is not defined.

对于这个错误，我发现 this information。

但我不明白他们想让我做...

描述：

我有 FederatedRepositories，其中只有一个 LDAP 存储库。

更新#2：

我在WAS 8.5.5.2上做了这样的TAI，没有错误，只是白屏。我尝试使用组 "wpsadmins" 对用户 "bob" 进行身份验证。有 FederatedRepositories 和一个基于文件的内置存储库。

更新#3：

我为 WAS 编写了自定义应用程序，其中有一个按钮，可以向 Servlet 发出 POST 请求。

部分代码：

if (req.getRemoteUser() == null) {
    req
            .setAttribute("errorMessage",
                    "<b>Error: Please log in before accessing PrintUserInfo.<b>");
    RequestDispatcher disp = getServletContext().getRequestDispatcher(
            "/login.jsp");
    disp.forward(req, resp);
    return;
}
resp.setContentType("text/html");
PrintWriter out = new PrintWriter(resp.getOutputStream());

String id = WSSubject.getCallerPrincipal();
out.println("The WAS Subject layer thinks you are " + id);
    Context ic = new InitialContext();
    Object objRef = ic.lookup("UserRegistry");
    UserRegistry userReg = (UserRegistry) PortableRemoteObject.narrow(
            objRef, UserRegistry.class);
    out.println("<BR><BR>The user registry says your display name is: "
            + userReg.getUserDisplayName(req.getUserPrincipal()
                    .getName()));

    Subject subject = WSSubject.getCallerSubject();
    Set credSet = subject.getPublicCredentials(WSCredential.class);
    //should be impossible.
    if (credSet.size() > 1) {
        System.out
                .println("Expected only one WSCredential in Subject set");
        throw new Exception("Expected one WSCredential, found "
                + credSet.size());
    }
if (credSet.isEmpty()) {
    System.out.println("Credential set is empty");
    throw new Exception("Found no credentials");
}
//get one and only one element of Set
Iterator iter = credSet.iterator();
WSCredential creds = (WSCredential) iter.next();
out.println("<BR><BR>Looking into your Subject your userid is "
        + creds.getSecurityName());
out.println("<BR><BR>Looking into your Subject your uniqueid is "
        + creds.getUniqueSecurityName());
out
        .println("<BR><BR>Looking into your Subject I see these groups: ");
//List groups = helper.getGroups();
List groups = creds.getGroupIds();
iter = groups.iterator();
while (iter.hasNext()) {
    String gid = (String) iter.next();
    out.println("<BR>Group ID: " + gid);
}

TAI 的新版本：

String userid = "alisa";
String uniqueid = "bob";

// add admin group 

// stash in hashtable
Hashtable hashtable = new Hashtable();


try {
    InitialContext ctx = new InitialContext();
    UserRegistry reg  =(UserRegistry)ctx.lookup("UserRegistry");
    String wpsadminsGroupUniqueId = reg.getUniqueGroupId("wpsadmins");
    List<String> groups = new ArrayList<String>();
    groups.add(wpsadminsGroupUniqueId);
    hashtable.put(AttributeNameConstants.WSCREDENTIAL_GROUPS, groups);
} catch (Exception  e) {
    System.out.println("EXCEPTION IN TAI");
    e.printStackTrace();
}

hashtable.put(AttributeNameConstants.WSCREDENTIAL_UNIQUEID,uniqueid);
hashtable.put(AttributeNameConstants.WSCREDENTIAL_SECURITYNAME,userid);
hashtable.put(AttributeNameConstants.WSCREDENTIAL_CACHE_KEY,uniqueid+"MyCustom");

Subject subject = new Subject();
subject.getPublicCredentials().add(hashtable);
return TAIResult.create(HttpServletResponse.SC_OK, "ignored", subject);

所以我从 Subject 获得了我的凭据，包括来自 LDAP 的 userId、uniqueId 和组。

结果：

The WAS Subject layer thinks you are alisa 

The user registry says your display name is: 

Looking into your Subject your userid is alisa 

Looking into your Subject your uniqueid is bob 

Looking into your Subject I see these groups: 
Group ID: group:domain:port/cn=wpsadmins,cn=CN,ou=OU,o=O,o=O,c=ru

更新#4

我在 TAI 中添加了几个组，而不是在 Portal 中授权（我认为），但我只看到白屏，什么也没有。怎么了？

更新 #5

WPS 给了我一个例外：

[26.03.15 18:47:41:006 AMT] 0000004e DefaultLoginF E com.ibm.wps.auth.impl.DefaultLoginFilter doLoginWithExceptions WpsException occured: com.ibm.wps.services.authentication.exceptions.UserRetrieveException: EJPSD0008E: Exception occurred while retrieving the user [null] from the user registry.

Answer 1

您需要创建完整主题，有关详细信息，请查看 Advanced authentication in WebSphere Application Server。

简而言之，您需要使用类似的代码：

String userid = "bob";//get from request
String uniqueid = "bob";

// stash in hashtable
Hashtable hashtable = new Hashtable();
hashtable.put(AttributeNameConstants.WSCREDENTIAL_UNIQUEID,uniqueid);
hashtable.put(AttributeNameConstants.WSCREDENTIAL_SECURITYNAME,userid);
// hashtable.put(AttributeNameConstants.WSCREDENTIAL_GROUPS,groups);
hashtable.put(AttributeNameConstants.WSCREDENTIAL_CACHE_KEY,uniqueid+"MyCustom");

Subject subject = new Subject();
subject.getPublicCredentials().add(hashtable);
return TAIResult.create(HttpServletResponse.SC_OK, "ignored", subject);

Answer 2

关于更新 #5 中添加的 WPS 异常 WebSphere Portal 要求 uniqueid 是完全限定的 DN。在您的情况下，您只有一个简称。门户确实使用 DN 在 VMM 中查找用户，并期望 WSCredential.getUniqueSecurityName() 到 return DN。

在 TAI 中以编程方式验证用户

Programmatically authenticate user in TAI

java

websphere

websphere-portal

websphere-6.1