6.4.2.1. 引入类库

从 http://www.ioplex.com 下载这个库，然后把这个 JAR 上传到 build.gradle 脚本中注册的一个仓库中。仓库可以是 mavenLocal() 或者内部仓库（私仓）。

在 build.gradle 中的 web 模块配置部分添加以下依赖：

  1. configure(webModule) {
  2.     ...
  3.     dependencies {
  4.         compile('com.company.thirdparty:jespa:1.1.17')  // from a custom repository
  5.         compile('jcifs:jcifs:1.3.17')                   // from Maven Central
  6.         ...

在 web 模块创建一个 LoginProvider 的实现类：

  1. package com.company.sample.web;
  3. import com.company.sample.config.ActiveDirectoryConfig;
  4. import com.company.sample.web.sys.DomainAliasesResolver;
  5. import com.google.common.collect.ImmutableMap;
  6. import com.haulmont.cuba.core.global.ClientType;
  7. import com.haulmont.cuba.core.global.GlobalConfig;
  8. import com.haulmont.cuba.core.sys.AppContext;
  9. import com.haulmont.cuba.core.sys.ConditionalOnAppProperty;
  10. import com.haulmont.cuba.security.auth.*;
  11. import com.haulmont.cuba.security.global.LoginException;
  12. import com.haulmont.cuba.web.auth.WebAuthConfig;
  13. import com.haulmont.cuba.web.security.LoginProvider;
  14. import jespa.http.HttpSecurityService;
  15. import jespa.ntlm.NtlmSecurityProvider;
  16. import jespa.security.PasswordCredential;
  17. import jespa.security.SecurityProviderException;
  18. import org.apache.commons.lang3.StringUtils;
  19. import org.slf4j.Logger;
  20. import org.slf4j.LoggerFactory;
  21. import org.springframework.core.Ordered;
  22. import org.springframework.stereotype.Component;
  24. import javax.annotation.Nullable;
  25. import javax.annotation.PostConstruct;
  26. import javax.inject.Inject;
  27. import javax.servlet.FilterChain;
  28. import javax.servlet.ServletException;
  29. import javax.servlet.ServletRequest;
  30. import javax.servlet.ServletResponse;
  31. import javax.servlet.http.HttpServletRequest;
  32. import java.io.IOException;
  33. import java.io.Serializable;
  34. import java.util.HashMap;
  35. import java.util.Map;
  37. import static com.haulmont.cuba.web.security.ExternalUserCredentials.EXTERNAL_AUTH_USER_SESSION_ATTRIBUTE;
  39. @ConditionalOnAppProperty(property = "activeDirectory.integrationEnabled", value = "true")
  40. @Component("sample_JespaAuthProvider")
  41. public class JespaAuthProvider extends HttpSecurityService implements LoginProvider, Ordered {
  43.     private static final Logger log = LoggerFactory.getLogger(JespaAuthProvider.class);
  45.     @Inject
  46.     private GlobalConfig globalConfig;
  47.     @Inject
  48.     private WebAuthConfig webAuthConfig;
  49.     @Inject
  50.     private DomainAliasesResolver domainAliasesResolver;
  51.     @Inject
  52.     private AuthenticationService authenticationService;
  54.     private static Map<String, DomainInfo> domains = new HashMap<>();
  55.     private static String defaultDomain;
  57.     @PostConstruct
  58.     public void init() throws ServletException {
  59.         initDomains();
  61.         Map<String, String> properties = new HashMap<>();
  62.         properties.put("jespa.bindstr", getBindStr());
  63.         properties.put("jespa.service.acctname", getAcctName());
  64.         properties.put("jespa.service.password", getAcctPassword());
  65.         properties.put("jespa.account.canonicalForm", "3");
  66.         properties.put("jespa.log.path", globalConfig.getLogDir() + "/jespa.log");
  67.         properties.put("http.parameter.anonymous.name", "anon");
  68.         fillFromSystemProperties(properties);
  70.         try {
  71.             super.init(JespaAuthProvider.class.getName(), null, properties);
  72.         } catch (SecurityProviderException e) {
  73.             throw new ServletException(e);
  74.         }
  75.     }
  77.     @Nullable
  78.     @Override
  79.     public AuthenticationDetails login(Credentials credentials) throws LoginException {
  80.         LoginPasswordCredentials lpCredentials = (LoginPasswordCredentials) credentials;
  82.         String login = lpCredentials.getLogin();
  83.         // parse domain by login
  84.         String domain;
  85.         int atSignPos = login.indexOf("@");
  86.         if (atSignPos >= 0) {
  87.             String domainAlias = login.substring(atSignPos + 1);
  88.             domain = domainAliasesResolver.getDomainName(domainAlias).toUpperCase();
  89.         } else {
  90.             int slashPos = login.indexOf('\\');
  91.             if (slashPos <= 0) {
  92.                 throw new LoginException("Invalid name: %s", login);
  93.             }
  94.             String domainAlias = login.substring(0, slashPos);
  95.             domain = domainAliasesResolver.getDomainName(domainAlias).toUpperCase();
  96.         }
  98.         DomainInfo domainInfo = domains.get(domain);
  99.         if (domainInfo == null) {
  100.             throw new LoginException("Unknown domain: %s", domain);
  101.         }
  103.         Map<String, String> securityProviderProps = new HashMap<>();
  104.         securityProviderProps.put("bindstr", domainInfo.getBindStr());
  105.         securityProviderProps.put("service.acctname", domainInfo.getAcctName());
  106.         securityProviderProps.put("service.password", domainInfo.getAcctPassword());
  107.         securityProviderProps.put("account.canonicalForm", "3");
  108.         fillFromSystemProperties(securityProviderProps);
  110.         NtlmSecurityProvider provider = new NtlmSecurityProvider(securityProviderProps);
  111.         try {
  112.             PasswordCredential credential = new PasswordCredential(login, lpCredentials.getPassword().toCharArray());
  113.             provider.authenticate(credential);
  114.         } catch (SecurityProviderException e) {
  115.             throw new LoginException("Authentication error: %s", e.getMessage());
  116.         }
  118.         TrustedClientCredentials trustedCredentials = new TrustedClientCredentials(
  119.                 lpCredentials.getLogin(),
  120.                 webAuthConfig.getTrustedClientPassword(),
  121.                 lpCredentials.getLocale(),
  122.                 lpCredentials.getParams());
  124.         trustedCredentials.setClientInfo(lpCredentials.getClientInfo());
  125.         trustedCredentials.setClientType(ClientType.WEB);
  126.         trustedCredentials.setIpAddress(lpCredentials.getIpAddress());
  127.         trustedCredentials.setOverrideLocale(lpCredentials.isOverrideLocale());
  128.         trustedCredentials.setSyncNewUserSessionReplication(lpCredentials.isSyncNewUserSessionReplication());
  130.         Map<String, Serializable> targetSessionAttributes;
  131.         Map<String, Serializable> sessionAttributes = lpCredentials.getSessionAttributes();
  132.         if (sessionAttributes != null
  133.                 && !sessionAttributes.isEmpty()) {
  134.             targetSessionAttributes = new HashMap<>(sessionAttributes);
  135.             targetSessionAttributes.put(EXTERNAL_AUTH_USER_SESSION_ATTRIBUTE, true);
  136.         } else {
  137.             targetSessionAttributes = ImmutableMap.of(EXTERNAL_AUTH_USER_SESSION_ATTRIBUTE, true);
  138.         }
  139.         trustedCredentials.setSessionAttributes(targetSessionAttributes);
  141.         return authenticationService.login(trustedCredentials);
  142.     }
  144.     @Override
  145.     public boolean supports(Class<?> credentialsClass) {
  146.         return LoginPasswordCredentials.class.isAssignableFrom(credentialsClass);
  147.     }
  149.     @Override
  150.     public int getOrder() {
  151.         return HIGHEST_PLATFORM_PRECEDENCE + 50;
  152.     }
  154.     @Override
  155.     public void destroy() {
  156.     }
  158.     @Override
  159.     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
  160.             throws IOException, ServletException {
  162.         HttpServletRequest httpServletRequest = (HttpServletRequest) request;
  163.         if (httpServletRequest.getHeader("User-Agent") != null) {
  164.             String ua = httpServletRequest.getHeader("User-Agent")
  165.                     .toLowerCase();
  167.             boolean windows = ua.contains("windows");
  168.             boolean gecko = ua.contains("gecko") && !ua.contains("webkit");
  170.             if (!windows && gecko) {
  171.                 chain.doFilter(request, response);
  172.                 return;
  173.             }
  174.         }
  175.         super.doFilter(request, response, chain);
  176.     }
  178.     private void initDomains() {
  179.         String domainsStr = AppContext.getProperty("activeDirectory.domains");
  180.         if (StringUtils.isEmpty(domainsStr)) {
  181.             return;
  182.         }
  184.         String[] strings = domainsStr.split(";");
  185.         for (int i = 0; i < strings.length; i++) {
  186.             String domain = strings[i];
  187.             domain = domain.trim();
  189.             if (StringUtils.isEmpty(domain)) {
  190.                 continue;
  191.             }
  193.             String[] parts = domain.split("\\|");
  194.             if (parts.length != 4) {
  195.                 log.error("Invalid ActiveDirectory domain definition: " + domain);
  196.                 break;
  197.             } else {
  198.                 domains.put(parts[0], new DomainInfo(parts[1], parts[2], parts[3]));
  199.                 if (i == 0) {
  200.                     defaultDomain = parts[0];
  201.                 }
  202.             }
  203.         }
  204.     }
  206.     public String getDefaultDomain() {
  207.         return defaultDomain != null ? defaultDomain : "";
  208.     }
  210.     public String getBindStr() {
  211.         return getBindStr(getDefaultDomain());
  212.     }
  214.     public String getBindStr(String domain) {
  215.         initDomains();
  216.         DomainInfo domainInfo = domains.get(domain);
  217.         return domainInfo != null ? domainInfo.getBindStr() : "";
  218.     }
  220.     public String getAcctName() {
  221.         return getAcctName(getDefaultDomain());
  222.     }
  224.     public String getAcctName(String domain) {
  225.         initDomains();
  226.         DomainInfo domainInfo = domains.get(domain);
  227.         return domainInfo != null ? domainInfo.getAcctName() : "";
  228.     }
  230.     public String getAcctPassword() {
  231.         return getAcctPassword(getDefaultDomain());
  232.     }
  234.     public String getAcctPassword(String domain) {
  235.         initDomains();
  236.         DomainInfo domainInfo = domains.get(domain);
  237.         return domainInfo != null ? domainInfo.getAcctPassword() : "";
  238.     }
  240.     public void fillFromSystemProperties(Map<String, String> params) {
  241.         for (String name : AppContext.getPropertyNames()) {
  242.             if (name.startsWith("jespa.")) {
  243.                 params.put(name, AppContext.getProperty(name));
  244.             }
  245.         }
  246.     }
  248.     public static class DomainInfo {
  250.         private final String bindStr;
  251.         private final String acctName;
  252.         private final String acctPassword;
  254.         DomainInfo(String bindStr, String acctName, String acctPassword) {
  255.             this.acctName = acctName;
  256.             this.acctPassword = acctPassword;
  257.             this.bindStr = bindStr;
  258.         }
  260.         public String getBindStr() {
  261.             return bindStr;
  262.         }
  264.         public String getAcctName() {
  265.             return acctName;
  266.         }
  268.         public String getAcctPassword() {
  269.             return acctPassword;
  270.         }
  271.     }
  272. }

创建一个 bean 用来在 web 模块使用别名解析域名：

  1. package com.company.sample.web;
  3. import com.haulmont.cuba.core.sys.AppContext;
  4. import org.apache.commons.lang3.StringUtils;
  5. import org.slf4j.Logger;
  6. import org.slf4j.LoggerFactory;
  7. import org.springframework.stereotype.Component;
  9. import java.util.Arrays;
  10. import java.util.HashMap;
  11. import java.util.List;
  12. import java.util.Map;
  13. import java.util.stream.Collectors;
  15. @Component(DomainAliasesResolver.NAME)
  16. public class DomainAliasesResolver {
  18.     public static final String NAME = "sample_DomainAliasesResolver";
  20.     private static final Logger log = LoggerFactory.getLogger(DomainAliasesResolver.class);
  22.     private Map<String, String> aliases = new HashMap<>();
  24.     public DomainAliasesResolver() {
  25.         String domainAliases = AppContext.getProperty("activeDirectory.aliases");
  26.         if (StringUtils.isEmpty(domainAliases)) {
  27.             return;
  28.         }
  30.         List<String> aliasesPairs = Arrays.stream(StringUtils.split(domainAliases, ';'))
  31.                 .filter(StringUtils::isNotEmpty)
  32.                 .collect(Collectors.toList());
  34.         for (String aliasDefinition : aliasesPairs) {
  35.             String[] aliasParts = StringUtils.split(aliasDefinition, '|');
  36.             if (aliasParts == null
  37.                     || aliasParts.length != 2
  38.                     || StringUtils.isBlank(aliasParts[0])
  39.                     || StringUtils.isBlank(aliasParts[1])) {
  40.                 log.warn("Incorrect domain alias definition: '{}'", aliasDefinition);
  41.             } else {
  42.                 aliases.put(aliasParts[0].toLowerCase(), aliasParts[1]);
  43.             }
  44.         }
  45.     }
  47.     public String getDomainName(String alias) {
  48.         String alias_lc = alias.toLowerCase();
  50.         String domain = aliases.get(alias_lc);
  51.         if (domain == null) {
  52.             return alias;
  53.         }
  55.         log.debug("Resolved domain '{}' from alias '{}'", domain, alias);
  57.         return domain;
  58.     }
  59. }