Блог

У меня есть приложение JaxRS 2.0 EAR, развернутое на сервере Liberty Server 20.0.0.9

Я прочитал всю возможную документацию и все вопросы по stackoverflow, но не нашел никакого решения.

У меня есть API, защищенный ролями аннотаций, но при вызове я всегда получал 403 Http-кода.

Это моя конфигурация:

web.xml

 <!-- SECURITY ROLES -->
<security-role><role-name>Pippo</role-name></security-role>
<security-role><role-name>LOYALTY_ADMINISTRATOR</role-name></security-role>
<security-role><role-name>cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT</role-name></security-role>

<!-- SECURITY CONSTRAINTS -->
<security-constraint>
    <display-name>Test Back Office Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>Test Back Office</web-resource-name>
        <url-pattern>/testbo/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>Pippo</role-name>
        <role-name>LOYALTY_ADMINISTRATOR</role-name>
        <role-name>cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT</role-name>
    </auth-constraint>
</security-constraint>

<!-- AUTHENTICATION METHOD: Basic authentication -->
<login-config>
    <auth-method>MP-JWT</auth-method>
</login-config>
 

ibmapplication-bnd.xml

 <security-role name="AllAuthenticated">
     <special-subject type="ALL_AUTHENTICATED_USERS" />
</security-role>
<security-role name="Pippo">
    <group name="cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT" />
</security-role>
<security-role name="LOYALTY_ADMINISTRATOR">
    <group name="cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT" />
</security-role>
<security-role name="cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT">
    <group name="cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT" />
</security-role>
 

Класс приложения

 @LoginConfig(authMethod = "MP-JWT")

@ApplicationPath("website")
public class WebsiteApplication extends Application {
 

Мой Api

 @ApplicationScoped
@DeclareRoles({"Pippo", "LOYALTY_ADMINISTRATOR", "cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT"})
public class BackOfficeApiTestResource extends BaseApiResource implements BackOfficeTestApi {

    @Override
    @RolesAllowed("cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT")
    public void test1() throws Exception {
        System.out.println("test 1 called");
    }
    
    @Override
    @RolesAllowed("LOYALTY_ADMINISTRATOR")
    public void test2() throws Exception {
        System.out.println("test 1 called");
    }
    
    @Override
    @RolesAllowed("Pippo")
    public void test3() throws Exception {
        System.out.println("test 2 called");
    }
}
 

Содержимое токена JWT

 {
  "sub": "btelefonicacv",
  "token_type": "Bearer",
  "scope": [
    "api"
  ],
  "jti": "6JBgVnsl7s1eaI3v",
  "iss": "https://localhost:9445/oidc/endpoint/OP",
  "exp": 1617289174,
  "iat": 1617281974,
  "givenName": "MARIO",
  "sn": "ROSSI",
  "cn": "MARIO ROSSI",
  "groups": [
    "cn=LOYALTY_ADMINISTRATOR,ou=Groups,O=MYCOMPANY,C=IT"
  ],
  "upn": "uid=btelefonicacv,ou=People,O=MYCOMPANY,C=IT"
}
 

Любая помощь будет признательна

Спасибо