SiteMinder SSO在weblogic10的变更

SiteMinder SSO在weblogic10的变化
1.问题描述：

      在weblogic8下，siteminder sso agent(Servlet) 如果用户没用权限会跳转到wls_http_bridge_not_authorized.jsp页面，而在weblogic10下却直接跳转到403页面?

      首先说明一下Assert Provider的作用：

      .认证cookie的有效性;
      .调用authentication provider.authorize()的获取角色。

    
     核心代码在com.netegrity.wlsextensions.Servlet.java

     从sso登陆的日志分析：
   
     //1.先登陆某个系统A后,跳转系统B的weclome页面
     Target from ServletAuthentication.getTargetURLForFormAuthentication is http://xxxxxx:80/index.screen>

     //2.因为没有登陆过系统B，容器跳转到login page url (/login), 进入Servlet的service(HttpServletRequest req, HttpServletResponse response),带着cookie
      Found SMSESSION cookie ap311F3+FKgWA1m/PuVr7GHe3E1fhirjMy1HNrt0XSKwE…>

     //3.没有登陆过系统B，所以request.getPrincipal为null
      Principal from request is null>     

     //4.根据cookie 认证合法性，并获取角色列表
      User [YANGJUN, r_xxxx, ……..] authenticated.>

     //5.重定向到原始url,因为容器判断该用户没有此url的权限，weblogic8重定向到login page(/login),weblogic10 却跳转到403页面而不是login page(/login)
      Redirecting to Target with http://xxxxxx:80/index.screen>

      以下只有 weblogic8才有效
     //6.重新进入Servlet的service(HttpServletRequest req, HttpServletResponse response)
      Target from ServletAuthentication.getTargetURLForFormAuthentication is http://xxxx:80/index.screen>
      Found SMSESSION cookie ap311F3+FKgWA1m/PuVr7GHe3E1fhirjMy1HNrt0XSKwE….>

      //7.判断isSamePrincipal,发现用户名重复,如果有重复，说明原先登陆过，而且是因为没有权限重定向的
        Authorization failure>
        Principals from SMSESSION cookie is [YANGJUN, r_xxxxxx, …….>
        YANGJUN equals YANGJUN>

     //8.跳转到没有权限的页面wls_http_bridge_not_authorized.jsp

      weblogic10与weblogic8跳转代码差异：
   
  

Weblogic8   weblogic.servlet.security.internal. FormSecurityModule.java   boolean checkUserPerm()       if(webAppSecurity.isFullSecurityDelegationRequired())        {            ServletRequestImpl servletrequestimpl = WebAppServletContext.getOriginalRequest(httpservletrequest);            if(checkPerm(servletrequestimpl, resourceconstraint, null))                return true;        }        stuffSession(httpservletrequest, httpservletresponse);        try        {            webAppSecurity.sendLoginPage(httpservletrequest, httpservletresponse);  //跳转到login page        }        catch(ServletException servletexception) { }        return false; Weblogic10     weblogic.servlet.security.internal. FormSecurityModule.java     boolean checkUserPerm(HttpServletRequest httpservletrequest, HttpServletResponse httpservletresponse, SessionInternal sessioninternal, ResourceConstraint resourceconstraint, AuthenticatedSubject authenticatedsubject, boolean flag)        throws IOException, ServletException    {        if(httpservletrequest.getRequestURI().endsWith("j_security_check"))            return processJSecurityCheck(httpservletrequest, httpservletresponse, sessioninternal);        if(authenticatedsubject != null)            return processLoggedInUser(httpservletrequest, httpservletresponse, authenticatedsubject);        if(webAppSecurity.isFullSecurityDelegationRequired() && webAppSecurity.hasPermission(httpservletrequest, httpservletresponse, null, resourceconstraint))            return true;        if(flag && webAppSecurity.hasAuthFilters())        {            invokeAuthFilterChain(httpservletrequest, httpservletresponse);            return false;        }        if(isForbidden(resourceconstraint))  //直接跳转到403            sendForbiddenResponse(httpservletrequest, httpservletresponse);        else                                                 //首次登陆跳转到login            sendLoginPage(httpservletrequest, httpservletresponse);        return false;    }

    SiteMinder sso agent Servlet for weblgoic10 的代码可以简化，删除判断没有权限判断的代码。