Question

我基本上是在遵循本教程： https://www.ibm.com/developerworks/java/library/j-javaee8-security-api-4/index.html?ca=drs-

我的开发环境：TomEE 8.0 M1 Plume

pom.xml

    <dependency>
        <groupId>org.glassfish.soteria</groupId>
        <artifactId>javax.security.enterprise</artifactId>
        <version>1.0</version>
    </dependency>
    <dependency>
        <groupId>javax</groupId>
        <artifactId>javaee-api</artifactId>
        <version>8.0</version>
        <scope>provided</scope>
    </dependency>

ApplicationConfig：

@CustomFormAuthenticationMechanismDefinition(
        loginToContinue = @LoginToContinue(
                loginPage = "/login.xhtml",
                errorPage = "/login.xhtml?error",
                useForwardToLogin = true
        )
)

@ApplicationScoped
@Named
public class ApplicationConfig {
}

TestServlet：

@WebServlet("/test")
public class TestServlet extends HttpServlet {

    @Inject
    SecurityContext securityContext;

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        securityContext.isCallerInRole("admin");
    }
}

转到http://localhost:8080/test，出现此异常：

    05-Dec-2018 16:38:39.132 SEVERE [http-nio-8080-exec-219] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [servlet.TestServlet] in context with path [] threw exception
 java.lang.IllegalArgumentException: No handler can be found for the key 'javax.security.auth.Subject.container'
    at javax.security.jacc.PolicyContext.getContext(PolicyContext.java:91)
    at org.glassfish.soteria.authorization.JACC$2.run(JACC.java:175)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.glassfish.soteria.authorization.JACC.getFromContext(JACC.java:173)
    at org.glassfish.soteria.authorization.JACC.getSubject(JACC.java:73)
    at org.glassfish.soteria.authorization.JACC.isCallerInRole(JACC.java:78)
    at org.glassfish.soteria.authorization.spi.impl.ReflectionAndJaccCallerDetailsResolver.isCallerInRole(ReflectionAndJaccCallerDetailsResolver.java:82)
    at org.glassfish.soteria.SecurityContextImpl.isCallerInRole(SecurityContextImpl.java:89)
    at servlet.TestServlet.doGet(TestServlet.java:20)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:634)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.openejb.server.httpd.EEFilter.doFilter(EEFilter.java:65)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.tomee.catalina.OpenEJBValve.invoke(OpenEJBValve.java:44)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:607)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.tomee.catalina.OpenEJBSecurityListener$RequestCapturer.invoke(OpenEJBSecurityListener.java:97)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:668)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:770)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

我来自Spring和Spring Security，但是刚接触CDI和EJB。

您能告诉我如何配置handler还是我遗漏了什么？

谢谢！

Answer 1

由于TomEE没有完全实现Soteria的默认授权SPI（“ ReflectionAndJaccCallerDetailsResolver”）所依赖的JACC，所以导致了该错误。

请注意，TomEE实际上确实完全支持JACC。

这里有几个选项（从简单到更具挑战性）：

显而易见；等待TomEE 8 final，这应该使该工作以一种或另一种方式（使用其自己的EE Security实施方式或其他方式）进行工作
实施Soteria用于授权的SPI，并调用TomEE / Tomcat本机API来执行与默认实现现在使用JACC相同的操作。
为TomEE做出贡献并在其JACC实现中实现缺失的位（或通过仅Web实现为Tomcat做出贡献）。已经有一个JIRA，请参见TOMEE-1912

我一直在计划为2.提供一个示例，并使SPI在Soteria 1.1中更加明显，但不幸的是还没有解决。

IllegalArgumentException：找不到键'javax.security.auth.Subject.container'的处理程序

1 个答案: