JBoss下的单点登陆（SSO）技术实现分析

<security-constraint>
<!-- Sample Security Constraint -->
<web-resource-collection>
<!-- We're going to protect this resource and make it available only to users in "role1". --> 
<web-resource-name>public-resources</web-resource-name>
<url-pattern>/resources/**//*</url-pattern>
<http-method>HEAD</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>protected-resources</web-resource-name>
<url-pattern>/josso/*</url-pattern>
<url-pattern>/protected/*</url-pattern>
<http-method>HEAD</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>role1</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login-redirect.jsp</form-login-page>
<form-error-page>/login-redirect.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role >
<description>Role 1</description>
<role-name>role1</role-name>
</security-role>

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE ejb-jar PUBLIC '-//Sun Microsystems, Inc.//DTD Enterprise JavaBeans 2.0//EN' 'http://java.sun.com/dtd/ejb-jar_2_0.dtd'>
<ejb-jar>
<display-name>Partner Component</display-name>
<enterprise-beans>
<session>
<ejb-name>PartnerComponentEJB</ejb-name>
<home>org.josso.samples.ejb.PartnerComponentHome</home>
<remote>org.josso.samples.ejb.PartnerComponent</remote>
<ejb-class>org.josso.samples.ejb.PartnerComponentEJB</ejb-class>
<session-type>Stateless</session-type>
<transaction-type>Container</transaction-type>
</session>
</enterprise-beans>

<assembly-descriptor>
<security-role>
<description>Role 1</description>
<role-name>role1</role-name>
</security-role>

<method-permission>
<description>Security attributes for 'PartnerComponenttEJB' methods</description>
<role-name>role1</role-name>
<method>
<ejb-name>PartnerComponentEJB</ejb-name>
<method-name>*</method-name>
</method>
</method-permission>

<container-transaction>
<method>
<ejb-name>PartnerComponentEJB</ejb-name>
<method-name>*</method-name>
</method>
<trans-attribute>Required</trans-attribute>
</container-transaction>
</assembly-descriptor>
</ejb-jar>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE jboss PUBLIC
"-//JBoss//DTD JBOSS 3.0//EN"
"http://www.jboss.org/j2ee/dtd/jboss_3_0.dtd">
<jboss>
<security-domain>java:/jaas/josso</security-domain>
<enterprise-beans>
<session>
<ejb-name>PartnerComponentEJB</ejb-name>
<jndi-name>josso/samples/PartnerComponentEJB</jndi-name>
</session>
</enterprise-beans>
</jboss>