整理版---mule安全认证.doc

Mule安全证书的管理
概念
安全性围绕的主题有验证、授权、消息完整性等。实现异常处理机制是实现安全机制的前提条件，因为你将遇到诸如验证或授权失败等异常。MULE和SERVICEMIX中的输入消息验证和授权安全技术，比如轻量级目录访问协议（LDAP）和JAVA验证和授权服务（JAAS）。
Ø Mule ESB安全管理(Mule Sercurity Manager)
—端点利用传输的特定细节或普通的认证方法对请求信息进行验证。
—在Mule ESB管理者处定义安全管理者 。
—配置安全过滤器。
有四种策略配置：
· JAAS Security
· PGP Security
· Acegi Security
· Component Authorization Using Acegi

mule安全管理配置
1．在mule中的配置
<mule-configuration>
<security-manager>
<security-provider name="memory-dao"
className="org.mule.extras.acegi.AcegiProviderAdapter">
<properties>
<container-property name="delegate" reference="daoAuthenticationProvider"/>
</properties>
</security-provider>
</security-manager>
....
</mule-configuration>
2．mule配置

<container-context
className="org.mule.extras.spring.SpringContainerContext">
<properties>
<property name="configFile" value="securityContext.xml"/>
</properties>
</container-context>

<beans>
<bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
<property name="userDetailsService">
<ref bean="inMemoryDaoImpl"/>
</property>
</bean>

<bean id="inMemoryDaoImpl" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
<property name="userMap">
<value>
ross=ross,ROLE_ADMIN
anon=anon,ROLE_ANONYMOUS
</value>
</property>
</bean>
</beans>
3．加密策略
<security-manager>
<encryption-strategy name="PBE"
className="org.mule.impl.security.PasswordBasedEncryptionStrategy">
<properties>
<property name="password" value="mule"/>
</properties>
</encryption-strategy>
</security-manager>
上面的加密策略可以被引用
<transformers>
<transformer name="EncryptedToByteArray"
className="org.mule.transformers.encryption.DecryptionTransformer">
<properties>
<property name="strategyName" value="PBE"/>
</properties>
</transformer>
</transformers>
4．端口策略文件
<endpoint address="http://localhost:4567">
<security-filter
className="org.mule.extras.acegi.filters.http.HttpBasicAuthenticationFilter">
<properties>
<property name="realm" value="mule-realm"/>
</properties>
</security-filter>
</endpoint>

<endpoint address="http://localhost:4567">
<security-filter useProviders="default,another"
className="org.mule.extras.acegi.filters.http.HttpBasicAuthenticationFilter"/>
</endpoint>
5．Spring安全策略配置
<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesource.org/schema/mule/core/2.2"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:spring="http://www.springframework.org/schema/beans"
xmlns:http="http://www.mulesource.org/schema/mule/http/2.2"
xmlns:mule-ss="http://www.mulesource.org/schema/mule/spring-security/2.2"
xmlns:ss="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.mulesource.org/schema/mule/core/2.2 http://www.mulesource.org/schema/mule/core/2.2/mule.xsd
http://www.mulesource.org/schema/mule/http/2.2 http://www.mulesource.org/schema/mule/http/2.2/mule-http.xsd
http://www.mulesource.org/schema/mule/spring-security/2.2
http://www.mulesource.org/schema/mule/spring-security/2.2/mule-spring-security.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-2.0.xsd">

<mule-ss:security-manager>
<mule-ss:delegate-security-provider name="memory-provider" delegate-ref="authenticationManager" />
</mule-ss:security-manager>

<spring:beans>
<ss:authentication-manager alias="authenticationManager" />

<ss:authentication-provider>
<ss:user-service id="userService">
<ss:user name="ross" password="ross" authorities="ROLE_ADMIN" />
<ss:user name="anon" password="anon" authorities="ROLE_ANON" />
</ss:user-service>
</ss:authentication-provider>
</spring:beans>
...cut...
</mule>

<?xml version="1.0" encoding="UTF-8"?> 
<mule xmlns="http://www.mulesoft.org/schema/mule/core" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
      xmlns:spring="http://www.springframework.org/schema/beans" 
      xmlns:mule-ss="http://www.mulesoft.org/schema/mule/spring-security" 
      xmlns:ss="http://www.springframework.org/schema/security" 
      xmlns:http="http://www.mulesoft.org/schema/mule/http" 
      xsi:schemaLocation=" 
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd 
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/3.0/mule.xsd 
        http://www.mulesoft.org/schema/mule/spring-security/3.0 
        http://www.mulesoft.org/schema/mule/spring-security/3.0/mule-spring-security.xsd 
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-2.0.xsd 
       http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/3.0/mule-http.xsd 
        "> 

    <spring:beans> 
        <ss:authentication-manager alias="authenticationManager"/> 

        <ss:authentication-provider> 
            <ss:user-service id="userService"> 
                <ss:user name="john" password="password" authorities="ROLE_ADMIN"/> 
            </ss:user-service> 
        </ss:authentication-provider> 
    </spring:beans> 

    <mule-ss:security-manager> 
        <mule-ss:delegate-security-provider name="memory-dao" delegate-ref="authenticationManager"/> 
    </mule-ss:security-manager> 

    <model name="springSecurityHttpModel"> 

        <service name="springSecurityHttpService"> 
            <inbound> 
                <http:inbound-endpoint address="http://localhost:8081/secure" exchange-pattern="request-response"> 
                    <mule-ss:http-security-filter realm="mule"/> 
                </http:inbound-endpoint> 
            </inbound> 
            <echo-component/> 
        </service> 
    </model> 
</mule> 

<mule-ss:security-manager>
<mule-ss:delegate-security-provider
name="ldap-security-provider"
delegate-ref="authenticationManager"/>
</mule-ss:security-manager>
<security-manager>
<password-encryption-strategy
name="passwordEncryption"
password="password"/>
</security-manager>
<model name="securityManagerHttpPbeModel">
<service name="securityManagerHttpPbeService">
<inbound>
<http:inbound-endpointaddress="http://localhost:8080/audit-trail-data"
synchronous="true">
<mule-ss:http-security-filter realm="audit-trail"/>
</http:inbound-endpoint>
</inbound>
<outbound>
<pass-through-router>
<jms:outbound-endpoint address="topic://audit-data">
<transformers>
<encrypt-transformer
strategy-ref="passwordEncryption"/>
</transformers>
</vm:outbound-endpoint>
</pass-through-router>
</outbound>
</service>
</model>
6.LDAP--mule配置
<spring:beans>
<ss:ldap-server
root="dc=clood,dc=com"
url="ldap://:389" />
<ss:ldap-authentication-provider
user-dn-pattern="uid={0},ou=people"
group-search-base="ou=groups"/>
<ss:authentication-manager alias="authenticationManager"/>
<mule-ss:security-manager>
<mule-ss:delegate-security-provider
name="memory-dao"
delegate-ref="authenticationManager"/>
</mule-ss:security-manager>
</spring:beans>
7.http策略配置
<spring:beans>
<ss:authentication-provider>
<ss:user-service id="userService">
<ss:user name="john" password="password" authorities="ROLE_ADMIN"/>
</ss:user-service>
</ss:authentication-provider>
<ss:authentication-manager alias="authenticationManager">
</spring:beans>
<mule-ss:security-manager>
<mule-ss:delegate-security-provider
name="memory-dao"
delegate-ref="authenticationManager"/>
</mule-ss:security-manager>
<model name="httpModel">
<service name="httpService">
<inbound>
<http:inbound-endpoint
address="http://localhost:8081/secure"
synchronous="true">
<mule-ss:http-security-filter realm="mule"/>
</http:inbound-endpoint>
</inbound>
<echo-component/>
</service>
</model>
8.Mule加密策略
<security-manager>
<password-encryption-strategy name="PBE" password="password"/>
</security-manager>
<model name="pbeModel">
<service name="pbeInService">
<inbound>
<jms:inbound-endpoint queue="messages.in"/>
</inbound>
<outbound>
<pass-through-router>
<jms:outbound-endpoint queue="services.decryption">
<transformers>
<encrypt-transformer strategy-ref="PBE"/>
<jms:object-to-jmsmessage-transformer/>
</transformers>
</jms:outbound-endpoint>
</pass-through-router>
</outbound>
</service>
<service name="pbeOutService">
<inbound>
<jms:inbound-endpoint queue="services.decryption">
<transformers>
<jms:jmsmessage-to-object-transformer/>
<decrypt-transformer strategy-ref="PBE"/>
</transformers>
</jms:inbound-endpoint>
</inbound>
<outbound>
<pass-through-router>
<jms:outbound-endpoint queue="messages.out"/>
</pass-through-router>
</outbound>
</service>
</model>
Spring配置
<spring:bean id="pgpKeyManager"
class="org.mule.module.pgp.PGPKeyRingImpl"
init-method="initialise">
<spring:property
name="publicKeyRingFileName"
value="conf/public.key.gpg"/>
<spring:propertyname="secretKeyRingFileName"
value="conf/secret.key.gpg"/>
<spring:property
name="secretAliasId"
value="0x7927DE78"/>
<spring:property
name="secretPassphrase"
value="mule"/>
</spring:bean>
<spring:bean id="credentialAccessor"
class="org.mule.security.MuleHeaderCredentialsAccessor"/>
<pgp:security-manager>
<pgp:security-provider
name="pgpSecurityProvider"
keyManager-ref="pgpKeyManager"/>
<pgp:keybased-encryption-strategy
name="keyBasedEncryptionStrategy"
keyManager-ref="pgpKeyManager"/>
</pgp:security-manager>
<model name="pgpModel">
<service name="pgpService">
<inbound>
<jms:inbound-endpoint
queue="messages.encrypted" />
</inbound>
<outbound>
<pass-through-router>
<vm:outbound-endpoint
path="services.decryption"/>
</pass-through-router>
</outbound>
</service>
<service name="out">
<inbound>
<vm:inbound-endpoint path="services.decryption">
<pgp:security-filter
strategyName="keyBasedEncryptionStrategy"
signRequired="true"
keyManager-ref="pgpKeyManager"
credentialsAccessor-ref="credentialAccessor"/>
</vm:inbound-endpoint>
</inbound>
<outbound>
<pass-through-router>
<jms:outbound-endpoint queue="messages.decrypted"/>
</pass-through-router>
</outbound>
</service>
</model>