JBoss EAP6にKerberos認証を設定するにはどうすればよいですか？

Question

私はJBoss EAP6を持っており、Active DirectoryインフラストラクチャでKerberos認証を設定したいと考えています。どの設定がweb.xml,jboss-web.xml、standalone.xmlになるのですか？ web.xmlで

Answer 1

：次の常駐jboss-web.xmlで

<security-constraint> 
    <web-resource-collection> 
     <web-resource-name>My Application</web-resource-name> 
     <url-pattern>/context-to-protect/*</url-pattern> 
    </web-resource-collection> 
    <auth-constraint> 
     <role-name>AD_Group_Name</role-name> 
    </auth-constraint> 
</security-constraint> 

<login-config> 
    <auth-method>SPNEGO</auth-method> 
    <realm-name>SPNEGO</realm-name> 
</login-config> 

<security-role> 
    <description>Allowed Users</description> 
    <role-name>AD_Group_Name</role-name> 
</security-role> 

、web.xmlへ：ごpom.xmlあなたが必要とするかもしれないいくつかの依存関係で

<jboss-web> 
    <security-domain>java:/jaas/SPNEGO</security-domain> 
    <valve> 
     <class-name>org.jboss.security.negotiation.NegotiationAuthenticator</class-name> 
    </valve> 
    <jacc-star-role-allow>true</jacc-star-role-allow> 
</jboss-web> 

：

<dependency> 
     <groupId>org.jboss.security</groupId> 
     <artifactId>jboss-negotiation-common</artifactId> 
     <version>2.3.8.Final-redhat-1</version> 
    </dependency> 

    <dependency> 
     <groupId>org.jboss.security</groupId> 
     <artifactId>jboss-security-spi</artifactId> 
     <version>2.0.4.SP2</version> 
    </dependency> 

standalone.xmlで：

<extensions> 
    <extension module="org.jboss.as.security"/> 
    <!-- all your other extensions --> 
</extensions> 
<system-properties> 
    <property name="java.security.krb5.realm" value="mydomain.com"/> 
    <property name="java.security.krb5.kdc" value="kdcserver.mydomain.com"/> 
    <!-- all your other properties --> 
</system-properties> 
<subsystem xmlns="urn:jboss:domain:security:1.2"> 
     <security-domains> 
      <security-domain name="other" cache-type="default"> 
       <authentication> 
        <login-module code="Remoting" flag="optional"> 
         <module-option name="password-stacking" value="useFirstPass"/> 
        </login-module> 
        <login-module code="RealmDirect" flag="required"> 
         <module-option name="password-stacking" value="useFirstPass"/> 
        </login-module> 
       </authentication> 
      </security-domain> 
      <security-domain name="jboss-web-policy" cache-type="default"> 
       <authorization> 
        <policy-module code="Delegating" flag="required"/> 
       </authorization> 
      </security-domain> 
      <security-domain name="jboss-ejb-policy" cache-type="default"> 
       <authorization> 
        <policy-module code="Delegating" flag="required"/> 
       </authorization> 
      </security-domain> 
      <security-domain name="host"> 
       <authentication> 
        <login-module code="com.sun.security.auth.module.Krb5LoginModule" flag="required"> 
         <module-option name="storeKey" value="true"/> 
         <module-option name="useKeyTab" value="true"/> 
         <module-option name="doNotPrompt" value="true"/> 
         <module-option name="debug" value="true"/> 
         <module-option name="keyTab" value="/path/to/your/server.keytab"/> 
         <module-option name="principal" value="HTTP/server.mydomain.com@MYDOMAIN.COM"/> 
        </login-module> 
       </authentication> 
      </security-domain> 
      <security-domain name="SPNEGO" cache-type="default"> 
       <authentication> 
        <login-module code="SPNEGO" flag="requisite"> 
         <module-option name="password-stacking" value="useFirstPass"/> 
         <module-option name="serverSecurityDomain" value="host"/> 
        </login-module> 
        <login-module code="AdvancedAdLdap" flag="required"> 
         <module-option name="password-stacking" value="useFirstPass"/> 
         <module-option name="bindDN" value="CN=MyCN,OU=MyOU,DC=mydomain,DC=com"/> 
         <module-option name="bindCredential" value="thepassword"/> 
         <module-option name="java.naming.provider.url" value="ldap://ldap.mydomain.com:389"/> 
         <module-option name="baseCtxDN" value="OU=MyOU,DC=mydomain,DC=com"/> 
         <module-option name="baseFilter" value="(userPrincipalName={0})"/> 
         <module-option name="roleAttributeID" value="memberOf"/> 
         <module-option name="rolesCtxDN" value="OU=MyOU,DC=mydomain,DC=com"/> 
         <module-option name="roleAttributeIsDN" value="true"/> 
         <module-option name="roleNameAttributeID" value="cn"/> 
         <module-option name="searchScope" value="SUBTREE_SCOPE"/> 
         <module-option name="recurseRoles" value="true"/> 
        </login-module> 
       </authentication> 
      </security-domain> 
      <security-domain name="LdapDomain" cache-type="default"> 
       <authentication> 
        <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required"> 
         <module-option name="java.naming.provider.url" value="ldap://ldap.mydomain.com:389"/> 
         <module-option name="bindDN" value="CN=MyCN,OU=MyOU,DC=mydomain,DC=com"/> 
         <module-option name="bindCredential" value="thepassword"/> 
         <module-option name="baseCtxDN" value="OU=MyOU,DC=mydomain,DC=com"/> 
         <module-option name="baseFilter" value="(sAMAccountName={0})"/> 
         <module-option name="rolesCtxDN" value="CN=MyCN,OU=MyOU,DC=mydomain,DC=com"/> 
         <module-option name="roleFilter" value="(sAMAccountName={0})"/> 
         <module-option name="roleAttributeID" value="memberOf"/> 
         <module-option name="roleNameAttributeID" value="cn"/> 
         <module-option name="searchScope" value="SUBTREE_SCOPE"/> 
        </login-module> 
       </authentication> 
      </security-domain> 
     </security-domains> 
    </subsystem>