Jetty 9 HashLoginService

问题:

My objective is to prompt user for a login into the website before displaying the first page. Page is served over HTTPS.

Using Jetty 9.2 and below are the respective configurations done:

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    id="WebApp_ID" version="3.0">
    <display-name>test-jetty</display-name>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.htm</welcome-file>
        <welcome-file>index.jsp</welcome-file>
        <welcome-file>default.html</welcome-file>
        <welcome-file>default.htm</welcome-file>
        <welcome-file>default.jsp</welcome-file>
    </welcome-file-list>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Secured area</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Test Realm</realm-name>
    </login-config>
</web-app>

Also done the configuration at {jetty.home}/etc/jetty.xml:

<Configure id="Server" class="org.eclipse.jetty.server.Server”>
…
<Call name="addBean">
        <Arg>
                <New class="org.eclipse.jetty.security.HashLoginService">
                        <Set name="name">Test Realm</Set>
                        <Set name="config"><SystemProperty name="jetty.home" default="."/>/etc/realm.properties</Set>
                        <Set name="refreshInterval">5</Set>
                        <Call name="start"></Call>
                </New>
        </Arg>
    </Call>
</Configure>

and also setup the realm.properties file at {jetty.home}/etc/realm.properties:

admin: CRYPT:1a97ec915dcd5bd27d34ef8a7a86f918,admin

after restarted jetty, there are no errors in log file, neither do the login prompt works when loading the server page at https://localhost:8443

Any ideas what did I missed?

Thanks /d

回答1:

Ok, just found out that I missed out two entries in web.xml: <security-role> and <auth-constraint>.

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    id="WebApp_ID" version="3.0">
    <display-name>test-jetty</display-name>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.htm</welcome-file>
        <welcome-file>index.jsp</welcome-file>
        <welcome-file>default.html</welcome-file>
        <welcome-file>default.htm</welcome-file>
        <welcome-file>default.jsp</welcome-file>
    </welcome-file-list>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Secured area</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Test Realm</realm-name>
    </login-config>
    <security-role>
        <role-name>admin</role-name>
    </security-role>
</web-app>