WebSphere Liberty Profile部署Spring Boot uber JAR如何配置安全约束

Great to hear you're leveraging Liberty's Spring Boot support! Let's walk through how to get your security role bindings working properly for your uber JAR, since the traditional ibm-ws-bnd.xml approach doesn't apply here.

1. Confirm Server.xml Application-Bnd Support #

First off: WebSphere Liberty 18.0.0.2 does support <application-bnd> for Spring Boot uber JARs deployed with type="spring". Your existing server.xml configuration for role mapping is valid—we just need to add the missing pieces to enforce HTTP authentication and tie it all together.

2. Add Security Constraints Directly in Server.xml #

Since your uber JAR doesn't have a web.xml or support the ibm-ws-bnd.xml in META-INF, you can define the web resource constraints directly inside the <application> block in your server.xml. This replaces the configuration you would have put in ibm-ws-bnd.xml:

<application id="x" name="x" type="spring" location="${server.config.dir}/apps/spring-boot-uber.jar">
    <!-- Your existing role binding configuration -->
    <application-bnd>
        <security-role name="Authenticated">
            <special-subject type="ALL_AUTHENTICATED_USERS"/>
        </security-role>
        <security-role name="SUPER_USERS">
            <group name="My_Admins"/>
        </security-role>
    </application-bnd>

    <!-- Add web security constraints here -->
    <web-bnd>
        <security-constraint>
            <web-resource-collection>
                <web-resource-name>all</web-resource-name>
                <url-pattern>/*</url-pattern>
                <http-method>GET</http-method>
                <http-method>PUT</http-method>
                <http-method>HEAD</http-method>
                <http-method>TRACE</http-method>
                <http-method>POST</http-method>
                <http-method>DELETE</http-method>
                <http-method>OPTIONS</http-method>
            </web-resource-collection>
            <auth-constraint>
                <role-name>Authenticated</role-name>
            </auth-constraint>
        </security-constraint>
        <security-role>
            <description>All authenticated users</description>
            <role-name>Authenticated</role-name>
        </security-role>
        <security-role>
            <description>Super users</description>
            <role-name>SUPER_USERS</role-name>
        </security-role>
    </web-bnd>
</application>

3. Enable Required Liberty Features #

Make sure your server.xml has the necessary features enabled to support Spring Boot and application security:

<featureManager>
    <feature>springBoot-2.0</feature> <!-- Adjust based on your Spring Boot version; 18.0.0.2 supports 1.5 and 2.0 -->
    <feature>appSecurity-2.0</feature>
    <feature>servlet-4.0</feature> <!-- Match your Spring Boot's Servlet API version -->
</featureManager>

<!-- Example: Configure a basic user registry (replace with your actual registry) -->
<basicRegistry id="basic" realm="MyAppRealm">
    <user name="adminUser" password="securePass123"/>
    <group name="My_Admins">
        <member name="adminUser"/>
    </group>
</basicRegistry>

<!-- Enable basic authentication for web apps -->
<webAppSecurity allowFailOverToBasicAuth="true" />

4. Why Your Previous ibm-ws-bnd.xml Didn't Work #

Liberty doesn't automatically process ibm-ws-bnd.xml from the META-INF directory of a Spring Boot uber JAR deployed as type="spring". This binding file is intended for traditional WAR/EAR deployments. For Spring Boot JARs, all binding and security configuration needs to be defined directly in server.xml as we did above.

5. Verify the Setup #

After updating your server.xml:

• Restart Liberty to apply the changes
• Test accessing your application endpoints—you should be prompted for authentication
• Log in with a user in the My_Admins group to confirm they have access to resources restricted to SUPER_USERS

内容的提问来源于stack exchange，提问作者planetjones