Websphere上的安全REST调用

我正尝试在WebSphere 8.5.0.2上创建一个安全的REST服务。我想保护使用基本身份验证。我修改了我的web.xml并尝试读取自动注入的SecurityContext。我得到一个自动注入的对象，但各种操作都失败了，例如， securityContext.getAuthenticationScheme（）; 我也将我的角色映射到所有已验证领域的用户。Websphere上的安全REST调用

我在Wink的文档中也找不到任何东西。我做错了什么？

我的web.xml

<?xml version="1.0" encoding="UTF-8"?> 
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0"> 
    <display-name>RESTModulation</display-name> 
    <!-- Wink SDK servlet configuration. 
     This servlet handles HTTP requests 
     of SDK web service on application server.--> 

<servlet> 
    <description> 
    JAX-RS Tools Generated - Do not modify</description> 
    <servlet-name>EntryRestServlet</servlet-name> 
    <servlet-class>com.ibm.websphere.jaxrs.server.IBMRestServlet</servlet-class> 
    <init-param> 
     <param-name>javax.ws.rs.Application</param-name> 
     <param-value>com.demo.DemoResourceApplication</param-value> 
    </init-param> 
    <load-on-startup>1</load-on-startup> 
</servlet> 
<servlet-mapping> 
    <servlet-name>EntryRestServlet</servlet-name> 
    <url-pattern> 
    /resources/*</url-pattern> 
</servlet-mapping> 
<security-constraint id="SecurityConstraint_1"> 
     <web-resource-collection id="WebResourceCollection_1"> 
     <web-resource-name>EntryRestServlet</web-resource-name> 
     <description>Protection area for Rest Servlet</description> 
     <url-pattern>/resources/</url-pattern> 
     <http-method>GET</http-method> 
     <http-method>POST</http-method> 
     </web-resource-collection> 
     <auth-constraint id="AuthConstraint_1"> 
     <description>Role1 for this rest servlet</description> 
     <role-name>Role1</role-name> 
     </auth-constraint> 
</security-constraint> 
<security-role id="SecurityRole_1"> 
     <description>This is Role1</description> 
     <role-name>Role1</role-name> 
</security-role>  
<login-config> 
     <auth-method>BASIC</auth-method> 
     <realm-name>defaultWIMFileBasedRealm</realm-name> 
</login-config> 
    <welcome-file-list> 
    <welcome-file>index.html</welcome-file> 
    <welcome-file>index.htm</welcome-file> 
    <welcome-file>index.jsp</welcome-file> 
    <welcome-file>default.html</welcome-file> 
    <welcome-file>default.htm</welcome-file> 
    <welcome-file>default.jsp</welcome-file> 
    </welcome-file-list> 
</web-app> 

========================================================================== 
Service implementation 

@Path("/MyTestService") 

public class MyTestService{ 

    @Context 
    SecurityContext securityContext; 

    @GET 
    @Path("/getUser1") 
    @Produces(MediaType.TEXT_PLAIN) 
    public Response doInquiry()throws Exception { 
     String jsonData= "{'user':'I am here '}"; 

     String authnScheme = securityContext.getAuthenticationScheme(); 
      System.out.println("authnScheme : " + authnScheme); 
      // retrieve the name of the Principal that invoked the resource 
      String username = securityContext.getUserPrincipal().getName(); 
      System.out.println("username : " + username); 
      // check if the current user is in Role1 
      Boolean isUserInRole = securityContext.isUserInRole("Role1"); 
      System.out.println("isUserInRole : " + isUserInRole); 
return Response.status(Response.Status.OK).entity(jsonData).build(); 
    } 
}

来源

2016-11-07 Sunil

你的意思是'失败'是什么意思？请添加系统结果您的代码结果和任何例外，如果他们存在。 – Gas

我没有通过从REST客户端正确的密码。提供正确的证书后，它已开始工作。

来源

2016-11-10 17:00:36 Sunil

Websphere上的安全REST调用

回答

相关问题