tomcat - Tomcat 管理器 - 活动目录身份验证
问题描述
我想知道如何使用 Active Directory 来访问 tomcat manager 应用程序上的角色?
这个想法是使特定 LDAP 组对 http://localhost:8080/manager 应用程序的访问成为可能。
我浏览了网络,但没有找到完整的解决方案。
此致
解决方案
我找到了解决方案;我创建了一个 JNDIRealm 不要求我的 AD 进行身份验证
<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm className="org.apache.catalina.realm.JNDIRealm"
debug="99"
connectionURL="ldap://LDAPSERVER:PORT"
connectionName="LDAP_USER"
connectionPassword="LDAP_PWD"
adcompat="true"
referrals="follow"
userBase="OU=Users,DC=company,DC=com"
userSearch="(sAMAccountName={0})"
userSubtree="true"
userRoleName="memberOf"
roleBase="OU=Groups,DC=company,DC=com"
roleName="cn"
roleSearch="(member={0})"
roleSubtree="true"
roleNested="true"
authentication="simple"
/>
</Realm>
然后,我修改了我的 tomcat 管理器应用程序的 web.xml,想法是添加应该有权访问应用程序的所需 AD 组:
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
version="4.0"
metadata-complete="true">
<display-name>Tomcat Manager Application</display-name>
<description>
A scriptable management web application for the Tomcat Web Server;
Manager lets you view, load/unload/etc particular web applications.
</description>
<request-character-encoding>UTF-8</request-character-encoding>
<servlet>
<servlet-name>Manager</servlet-name>
<servlet-class>org.apache.catalina.manager.ManagerServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>2</param-value>
</init-param>
</servlet>
<servlet>
<servlet-name>HTMLManager</servlet-name>
<servlet-class>org.apache.catalina.manager.HTMLManagerServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>2</param-value>
</init-param>
<!-- Uncomment this to show proxy sessions from the Backup manager or a
StoreManager in the sessions list for an application
<init-param>
<param-name>showProxySessions</param-name>
<param-value>true</param-value>
</init-param>
-->
<multipart-config>
<!-- 50MB max -->
<max-file-size>52428800</max-file-size>
<max-request-size>52428800</max-request-size>
<file-size-threshold>0</file-size-threshold>
</multipart-config>
</servlet>
<servlet>
<servlet-name>Status</servlet-name>
<servlet-class>org.apache.catalina.manager.StatusManagerServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
</servlet>
<servlet>
<servlet-name>JMXProxy</servlet-name>
<servlet-class>org.apache.catalina.manager.JMXProxyServlet</servlet-class>
</servlet>
<!-- Define the Manager Servlet Mapping -->
<servlet-mapping>
<servlet-name>Manager</servlet-name>
<url-pattern>/text/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Status</servlet-name>
<url-pattern>/status/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>JMXProxy</servlet-name>
<url-pattern>/jmxproxy/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>HTMLManager</servlet-name>
<url-pattern>/html/*</url-pattern>
</servlet-mapping>
<filter>
<filter-name>CSRF</filter-name>
<filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
<init-param>
<param-name>entryPoints</param-name>
<param-value>/html,/html/,/html/list,/index.jsp</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CSRF</filter-name>
<servlet-name>HTMLManager</servlet-name>
</filter-mapping>
<!-- Define a Security Constraint on this Application -->
<!-- NOTE: None of these roles are present in the default users file -->
<security-constraint>
<web-resource-collection>
<web-resource-name>HTML Manager interface (for humans)</web-resource-name>
<url-pattern>/html/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>manager-gui</role-name>
<role-name>MY_AUTHORIZED_AD_GROUP</role-name>
</auth-constraint>
</security-constraint>
<!-- Define the Login Configuration for this Application -->
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<!-- Security roles referenced by this web application -->
<security-role>
<description>
The role that is required to access the HTML Manager pages
</description>
<role-name>manager-gui</role-name>
</security-role>
<security-role>
<description>
The role that is required to access to the Manager Status pages
</description>
<role-name>MY_AUTHORIZED_AD_GROUP</role-name>
</security-role>
<security-role-ref>
<role-name>manager-gui</role-name>
<role-link>MY_AUTHORIZED_AD_GROUP</role-link>
</security-role-ref>
<error-page>
<error-code>401</error-code>
<location>/WEB-INF/jsp/login.jsp</location>
</error-page>
<error-page>
<error-code>403</error-code>
<location>/WEB-INF/jsp/403.jsp</location>
</error-page>
<error-page>
<error-code>404</error-code>
<location>/WEB-INF/jsp/404.jsp</location>
</error-page>
</web-app>
推荐阅读
- githooks - 如何过滤 git hook post-commit 到特定文件?
- java - 如何从 Android 中的 Firebase 中获取基于不同子项的总数据
- python - 我有一个 HTML 表单,我需要在用户单击提交按钮后在表单下方显示计算值
- java - “字符串中的段数”不适用于特定输入
- javascript - 从其他组件传递值以使用反应挂钩发布 json 数据
- java - 如何在不填充图案的情况下打印图案?
- vb.net - Visual Basic 在文本文件的开头写乱码
- bash - 在 bash 脚本的参数中使用通配符
- cors - 使用 PUT 方法上传到 Google Cloud Storage 时没有 Access-Control-Allow-Origin,并且在 gsutil 中配置了 cors
- elasticsearch - Logstash 启动但它不会将数据加载到 elasticsearch