JSP项目集成Waffle JAAS对接AD Kerberos认证后遇403错误求助

Alright, let's break down why you're hitting a 403 error even after successfully logging in with your Active Directory credentials. The core issue here is almost always a role mismatch between what Waffle pulls from AD and what your web app's security constraints are expecting.

Let's walk through the fixes step by step:

1. Fix the Role Mapping Discrepancy #

Your web.xml is restricting access to users with the Everyone role, but Waffle's WindowsLoginModule by default only adds roles that match the AD security groups your user is a member of. A quick reality check: Everyone isn't a default built-in group in AD—you might be thinking of Domain Users, which is automatically assigned to all domain users.

Option A: Use an AD Group Your User Actually Belongs To #

First, confirm which AD groups your test user is part of (e.g., Domain Users). Then update your web.xml to match that group:

<security-role>
  <role-name>Domain Users</role-name>
</security-role>
<security-constraint>
  <display-name>Waffle Security Constraint</display-name>
  <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>Domain Users</role-name>
  </auth-constraint>
</security-constraint>

Option B: Configure Waffle to Add an "Everyone" Role Automatically #

If you want to keep using Everyone in your security rules, tweak your login.conf to tell Waffle to inject this role for all authenticated users:

Jaas {
  waffle.jaas.WindowsLoginModule sufficient
    debug="true"
    addGuestRole="false"
    addDomainUsersRole="true"
    addEveryoneRole="true";
};

The addEveryoneRole="true" flag will create an Everyone RolePrincipal for every user who logs in, perfectly matching your existing web.xml constraint.

2. Tweak Your JAASRealm Configuration #

Your context.xml setup is close, but add the loginConfigName attribute explicitly to ensure Tomcat uses the correct JAAS entry from your login.conf:

<Context>
  <Realm className="org.apache.catalina.realm.JAASRealm"
         appName="Jaas"
         loginConfigName="Jaas"
         userClassNames="waffle.jaas.UserPrincipal"
         roleClassNames="waffle.jaas.RolePrincipal"
         useContextClassLoader="false"
         debug="true" />
</Context>

This removes any ambiguity about which JAAS configuration Tomcat should use for authentication.

3. Verify JAAS Policy Accessibility #

Your jaas.policy is permissive enough, but make sure Tomcat can actually read it. Add this system property to your Tomcat startup script (e.g., catalina.sh or catalina.bat) to point to the file's location:

-Djava.security.auth.policy=/full/path/to/your/jaas.policy

4. Enable Debug Logging for Troubleshooting #

If you're still stuck, turn on verbose logging to see exactly which roles Waffle is returning. Add these lines to Tomcat's conf/logging.properties:

org.apache.catalina.realm.JAASRealm.level = FINE
waffle.jaas.level = FINE

This will log every principal and role during authentication, making it easy to spot any mismatches.

After making these changes, restart Tomcat and test again. The 403 error should disappear once your security roles align between AD, Waffle, and your web app.

内容的提问来源于stack exchange，提问作者jimmy