Question

我正在研究有关粗粒度授权的Restlet教程示例：

public class MyApiWithRoleAuthorization extends Application {

//Define role names
public static final String ROLE_USER = "user";
public static final String ROLE_OWNER = "owner";

@Override
public Restlet createInboundRoot() {
    //Create the authenticator, the authorizer and the router that will be protected
    ChallengeAuthenticator authenticator = createAuthenticator();
    RoleAuthorizer authorizer = createRoleAuthorizer();
    Router router = createRouter();

    Router baseRouter = new Router(getContext());

    //Protect the resource by enforcing authentication then authorization
    authorizer.setNext(Resource0.class);
    authenticator.setNext(baseRouter);

    //Protect only the private resources with authorizer
    //You could use several different authorizers to authorize different roles
    baseRouter.attach("/resourceTypePrivate", authorizer);
    baseRouter.attach("/resourceTypePublic", router);
    return authenticator;
}

private ChallengeAuthenticator createAuthenticator() {
    ChallengeAuthenticator guard = new ChallengeAuthenticator(
            getContext(), ChallengeScheme.HTTP_BASIC, "realm");

    //Create in-memory users with roles
    MemoryRealm realm = new MemoryRealm();
    User user = new User("user", "user");
    realm.getUsers().add(user);
    realm.map(user, Role.get(this, ROLE_USER));
    User owner = new User("owner", "owner");
    realm.getUsers().add(owner);
    realm.map(owner, Role.get(this, ROLE_OWNER));

    //Attach verifier to check authentication and enroler to determine roles
    guard.setVerifier(realm.getVerifier());
    guard.setEnroler(realm.getEnroler());
    return guard;
}

private RoleAuthorizer createRoleAuthorizer() {
    //Authorize owners and forbid users on roleAuth's children
    RoleAuthorizer roleAuth = new RoleAuthorizer();
    roleAuth.getAuthorizedRoles().add(Role.get(this, ROLE_OWNER));
    roleAuth.getForbiddenRoles().add(Role.get(this, ROLE_USER));
    return roleAuth;
}

private Router createRouter() {
    //Attach Server Resources to given URL
    Router router = new Router(getContext());
    router.attach("/resource1/", Resource1.class);
    router.attach("/resource2/", Resource2.class);
    return router;
}

public static void main(String[] args) throws Exception {
    //Attach application to http://localhost:9000/v1
    Component c = new Component();
    c.getServers().add(Protocol.HTTP, 9000);
    c.getDefaultHost().attach("/v1", new MyApiWithRoleAuthorization());
    c.start();
}

}

我创建了一个用于检查用户凭据的类：

public class Resource1 extends ServerResource{

@Get
public String represent() throws Exception {
    User user = getRequest().getClientInfo().getUser();
    String identifier = user.getIdentifier();
    char[] pass = user.getSecret();

    return this.getClass().getSimpleName() + " found ! User: " + identifier + 
            "; password = " + charArrayToString(pass) ;

}

private String charArrayToString(char[] chars ) {
 String result = "";
 for (char c : chars){
     result += c;
 }
 return result;

}

}

当我转到资源http://localhost:9000/v1/resourceTypePublic/resource1/时，应用程序要求提供凭据，我输入“user”，“user”（或“所有者”，“所有者”）。但我得到内部服务器错误。原因是变量传递给return语句

return this.getClass().getSimpleName() + " found ! User: " + identifier + 
            "; password = " + charArrayToString(pass) ;

具有空值。没有此变量的语句可以正常工作：

return this.getClass().getSimpleName() + " found ! User: " + identifier;

并返回用户登录信息。但秘密呢？尽管输入了用户密码，为什么它会返回空值？

Answer 1

使用声明

创建的用户对象

User user = getRequest().getClientInfo().getUser();

不包含有关密码的信息，尽管它有字段密码。还有另一种获取用户凭据的方法：

char[] pass = getChallengeResponse().getSecret();

如何从请求中获取用户凭据？

1 个答案: