ejb - 非法参数异常 : No handler can be found for the key 'javax.security.auth.Subject.container'

Question

我基本上遵循本教程: https://www.ibm.com/developerworks/java/library/j-javaee8-security-api-4/index.html?ca=drs-

我的开发环境:TomEE 8.0 M1 Plume

pom.xml

    <dependency>
        <groupId>org.glassfish.soteria</groupId>
        <artifactId>javax.security.enterprise</artifactId>
        <version>1.0</version>
    </dependency>
    <dependency>
        <groupId>javax</groupId>
        <artifactId>javaee-api</artifactId>
        <version>8.0</version>
        <scope>provided</scope>
    </dependency>

应用程序配置:

@CustomFormAuthenticationMechanismDefinition(
        loginToContinue = @LoginToContinue(
                loginPage = "/login.xhtml",
                errorPage = "/login.xhtml?error",
                useForwardToLogin = true
        )
)

@ApplicationScoped
@Named
public class ApplicationConfig {
}

测试Servlet:

@WebServlet("/test")
public class TestServlet extends HttpServlet {

    @Inject
    SecurityContext securityContext;

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        securityContext.isCallerInRole("admin");
    }
}

转到http://localhost:8080/test ，我得到这个异常:

    05-Dec-2018 16:38:39.132 SEVERE [http-nio-8080-exec-219] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [servlet.TestServlet] in context with path [] threw exception
 java.lang.IllegalArgumentException: No handler can be found for the key 'javax.security.auth.Subject.container'
    at javax.security.jacc.PolicyContext.getContext(PolicyContext.java:91)
    at org.glassfish.soteria.authorization.JACC$2.run(JACC.java:175)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.glassfish.soteria.authorization.JACC.getFromContext(JACC.java:173)
    at org.glassfish.soteria.authorization.JACC.getSubject(JACC.java:73)
    at org.glassfish.soteria.authorization.JACC.isCallerInRole(JACC.java:78)
    at org.glassfish.soteria.authorization.spi.impl.ReflectionAndJaccCallerDetailsResolver.isCallerInRole(ReflectionAndJaccCallerDetailsResolver.java:82)
    at org.glassfish.soteria.SecurityContextImpl.isCallerInRole(SecurityContextImpl.java:89)
    at servlet.TestServlet.doGet(TestServlet.java:20)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:634)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.openejb.server.httpd.EEFilter.doFilter(EEFilter.java:65)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.tomee.catalina.OpenEJBValve.invoke(OpenEJBValve.java:44)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:607)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.tomee.catalina.OpenEJBSecurityListener$RequestCapturer.invoke(OpenEJBSecurityListener.java:97)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:668)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:770)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

我有 Spring 和 Spring Security 背景，但对 CDI 和 EJB 很陌生。

您能告诉我如何配置该处理程序还是我遗漏了什么？

谢谢!

Answer 1

该错误是由于TomEE没有完全实现Soteria默认授权SPI(“ReflectionAndJaccCallerDetailsResolver”)所依赖的JACC而导致的。

请注意，TomEE 实际上确实支持 JACC，只是不完全支持。

这里有几个选项(从简单到更具挑战性):

1. 显而易见的；等待 TomEE 8 Final，它应该可以以某种方式完成这项工作(使用他们自己的 EE 安全实现或其他方式)
2. 实现 Soteria 用于授权的 SPI，并调用 TomEE/Tomcat native API 来执行与默认实现现在使用 JACC 相同的操作。
3. 为 TomEE 做出贡献并实现其 JACC 实现中缺失的部分(或为 Tomcat 做出仅 Web 实现的贡献)。已经有一个 JIRA 可以做到这一点，请参阅 TOMEE-1912

我一直计划为 2. 提供一个示例，并使 SPI 在 Soteria 1.1 中更加明显，但不幸的是还没有抽出时间。