如何从请求中获取用户凭证？

Question

我上的Restlet教程示例工作有关的粗粒度授权：

public class MyApiWithRoleAuthorization extends Application { 

//Define role names 
public static final String ROLE_USER = "user"; 
public static final String ROLE_OWNER = "owner"; 

@Override 
public Restlet createInboundRoot() { 
    //Create the authenticator, the authorizer and the router that will be protected 
    ChallengeAuthenticator authenticator = createAuthenticator(); 
    RoleAuthorizer authorizer = createRoleAuthorizer(); 
    Router router = createRouter(); 

    Router baseRouter = new Router(getContext()); 

    //Protect the resource by enforcing authentication then authorization 
    authorizer.setNext(Resource0.class); 
    authenticator.setNext(baseRouter); 

    //Protect only the private resources with authorizer 
    //You could use several different authorizers to authorize different roles 
    baseRouter.attach("/resourceTypePrivate", authorizer); 
    baseRouter.attach("/resourceTypePublic", router); 
    return authenticator; 
} 

private ChallengeAuthenticator createAuthenticator() { 
    ChallengeAuthenticator guard = new ChallengeAuthenticator(
      getContext(), ChallengeScheme.HTTP_BASIC, "realm"); 

    //Create in-memory users with roles 
    MemoryRealm realm = new MemoryRealm(); 
    User user = new User("user", "user"); 
    realm.getUsers().add(user); 
    realm.map(user, Role.get(this, ROLE_USER)); 
    User owner = new User("owner", "owner"); 
    realm.getUsers().add(owner); 
    realm.map(owner, Role.get(this, ROLE_OWNER)); 

    //Attach verifier to check authentication and enroler to determine roles 
    guard.setVerifier(realm.getVerifier()); 
    guard.setEnroler(realm.getEnroler()); 
    return guard; 
} 

private RoleAuthorizer createRoleAuthorizer() { 
    //Authorize owners and forbid users on roleAuth's children 
    RoleAuthorizer roleAuth = new RoleAuthorizer(); 
    roleAuth.getAuthorizedRoles().add(Role.get(this, ROLE_OWNER)); 
    roleAuth.getForbiddenRoles().add(Role.get(this, ROLE_USER)); 
    return roleAuth; 
} 

private Router createRouter() { 
    //Attach Server Resources to given URL 
    Router router = new Router(getContext()); 
    router.attach("/resource1/", Resource1.class); 
    router.attach("/resource2/", Resource2.class); 
    return router; 
} 

public static void main(String[] args) throws Exception { 
    //Attach application to http://localhost:9000/v1 
    Component c = new Component(); 
    c.getServers().add(Protocol.HTTP, 9000); 
    c.getDefaultHost().attach("/v1", new MyApiWithRoleAuthorization()); 
    c.start(); 
} 

}

我创建一个类来检查用户凭据：

public class Resource1 extends ServerResource{ 

@Get 
public String represent() throws Exception { 
    User user = getRequest().getClientInfo().getUser(); 
    String identifier = user.getIdentifier(); 
    char[] pass = user.getSecret(); 

    return this.getClass().getSimpleName() + " found ! User: " + identifier + 
      "; password = " + charArrayToString(pass) ; 

} 

private String charArrayToString(char[] chars) { 
String result = ""; 
for (char c : chars){ 
    result += c; 
} 
return result; 

} 

} 

当我去到资源http://localhost:9000/v1/resourceTypePublic/resource1/的应用程序要求输入凭据，并输入“用户”，“用户”（或“所有者”，“所有者”）。但我得到内部服务器错误。原因在于变量回传中的声明

return this.getClass().getSimpleName() + " found ! User: " + identifier + 
      "; password = " + charArrayToString(pass) ; 

具有空值。没有此变量的声明正常工作：

return this.getClass().getSimpleName() + " found ! User: " + identifier; 

并返回用户登录。但是秘密呢？为什么尽管输入了用户密码，它仍会返回空值？

Answer 1

用户对象与声明

User user = getRequest().getClientInfo().getUser();

创建不包含有关密码的信息，尽管它有一个秘密的领域。还有另一种获取用户凭证的方式：

char[] pass = getChallengeResponse().getSecret();