Wildfly 16迁移至30：Elytron与JDBC Realm摘要认证配置问题

Wildfly 16原有配置 #

(1) JDBC认证授权配置（SHA-256哈希+Base64编码） #

<security-domain name="j-lawyer-security" cache-type="default">
    <authentication>
        <login-module code="Database" flag="required">
            <module-option name="dsJndiName" value="java:/jlawyerdb"/>
            <module-option name="principalsQuery" value="select password from security_users where principalId=?"/>
            <module-option name="rolesQuery" value="select role, 'Roles' from security_roles where principalId=?"/>
            <module-option name="unauthenticatedIdentity" value="anonymous"/>
            <module-option name="hashAlgorithm" value="SHA-256"/>
            <module-option name="hashEncoding" value="base64"/>
            <module-option name="hashUserPassword" value="true"/>
            <module-option name="hashStorePassword" value="false"/>
        </login-module>
    </authentication>
</security-domain>

应用代码直接引用此安全域。

(2) 远程EJB客户端代码 #

Properties properties = new Properties();
properties.put("jboss.naming.client.ejb.context", true);

// begin: for JMS only
properties.put(Context.INITIAL_CONTEXT_FACTORY, "org.wildfly.naming.client.WildFlyInitialContextFactory");
properties.put(Context.PROVIDER_URL, "http-remoting://localhost:8080");
properties.put(Context.SECURITY_PRINCIPAL, "admin");
properties.put(Context.SECURITY_CREDENTIALS, pwString);
properties.put("jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT", "false");
properties.put("jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS", "false");
properties.put("jboss.naming.client.connect.options.org.xnio.Options.SSL_ENABLED", "false");
properties.put("jboss.naming.client.connect.options.org.xnio.Options.SSL_STARTTLS", "false");

InitialContext ic = new InitialContext(properties);
SecurityServiceRemote remote = (SecurityServiceRemote) ic.lookup("ejb:j-lawyer-server/j-lawyer-server-ejb//SecurityService!com.jdimension.jlawyer.services.SecurityServiceRemote");
remote.dummy();

(3) REST API使用HTTP Basic认证 #

上述EJB客户端与HTTP Basic认证协同工作正常。

Wildfly 30配置尝试 #

(1) 安全域配置 #

<security-realms>
    <identity-realm name="local" identity="$local"/>
    <jdbc-realm name="ApplicationRealm">
        <principal-query sql="select password from security_users where principalId=?" data-source="somedb">
            <clear-password-mapper password-index="1"/>
        </principal-query>
        <principal-query sql="select role, 'Roles' from security_roles where principalId=?" data-source="jlawyerdb">
            <attribute-mapping>
                <attribute to="Roles" index="1"/>
            </attribute-mapping>
        </principal-query>
    </jdbc-realm>
</security-realms>

(2) Elytron模块配置 #

<http>
    <http-authentication-factory name="application-http-authentication" security-domain="ApplicationDomain" http-server-mechanism-factory="global">
        <mechanism-configuration>
            <mechanism mechanism-name="BASIC">
                <mechanism-realm realm-name="ApplicationRealm"/>
            </mechanism>
        </mechanism-configuration>
    </http-authentication-factory>
    <provider-http-server-mechanism-factory name="global"/>
</http>
<sasl>
    <sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
        <mechanism-configuration>
            <mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
            <mechanism mechanism-name="DIGEST-SHA-256">
                <mechanism-realm realm-name="ApplicationRealm"/>
            </mechanism>
        </mechanism-configuration>
    </sasl-authentication-factory>

(3) Undertow模块配置 #

<application-security-domains>
    <application-security-domain name="other" security-domain="ApplicationDomain"/>
</application-security-domains>

遇到的问题 #

• 远程EJB客户端可成功查找，但调用业务逻辑失败；仅当传入SHA-256哈希并Base64编码后的密码时认证才能成功，相当于服务器按明文密码处理，与Wildfly16逻辑不符。
• HTTP客户端（浏览器访问带REST后端的Web应用）弹出凭证输入框，但无论输入明文密码还是哈希值均无法通过认证。
• 开启TRACE级日志后，显示认证授权成功，但权限检查失败（如访问/swagger-ui/的GET权限不通过）。

技术问询 #

1. 从概念层面看，我的配置是否存在错误？
2. Web应用的HTTP Basic认证与哈希密码能否和远程EJB客户端协同工作？
3. 使用哈希密码时，远程客户端是否需要传入哈希值？若是，浏览器如何处理（无法生成该值）？
4. 因Elytron文档存在过时或不完整的情况，是否有类似的配置示例可供参考？

内容的提问来源于stack exchange，提问作者j-dimension