JavaWebApp提供域用户鉴权的方法

思考了一下，有两种方法，

一种是使用LDAP访问域服务器(389端口)进行用户校验

另一种方法是使用samba组织的jcifs使用NTLM方式进行校验

第一种方法暂时不提，下面着重说一下第二种方法

----------------------------------------------------------

NTLM校验又分为两种，一种是使用共享目录的方式进行校验，如下

<wbr>&lt;filter&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;filter-name&gt;NtlmHttpFilter&lt;/filter-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;filter-class&gt;jcifs.http.NtlmHttpFilter&lt;/filter-class&gt;<wbr><wbr><br><wbr><wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;init-param&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-name&gt;jcifs.http.domainController&lt;/param-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-value&gt;192.168.2.15&lt;/param-value&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;/init-param&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;init-param&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-name&gt;jcifs.smb.client.logonShare&lt;/param-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-value&gt;JCIFSACL&lt;/param-value&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;/init-param&gt;<wbr><wbr><br><wbr> &lt;/filter&gt;<wbr><wbr><br><wbr><wbr><wbr><br><wbr> &lt;filter-mapping&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;filter-name&gt;NtlmHttpFilter&lt;/filter-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;url-pattern&gt;/*&lt;/url-pattern&gt;<wbr><wbr><br><wbr>&lt;/filter-mapping&gt;</wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr>

这种方法是通过虚拟一个名为：JCIFS***_&&_%%的用户来访问认证计算机进行认证的。其中***表示当前tomcat计算机的IP的第一位，&&表示最后一位，%%是一个序列数<wbr><wbr></wbr></wbr>

----------------------------------------------------------

另一种是通过域控制器进行校验，由于手头没有域控制器，暂时无法验证这种方式的正确性

<filter><wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;filter-name&gt;NtlmHttpFilter&lt;/filter-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;filter-class&gt;jcifs.http.NtlmHttpFilter&lt;/filter-class&gt;<wbr><wbr><br><wbr><wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;init-param&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-name&gt;jcifs.smb.client.domain&lt;/param-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-value&gt;NYC-USERS&lt;/param-value&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;/init-param&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;init-param&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-name&gt;jcifs.netbios.wins&lt;/param-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>&lt;param-value&gt;10.169.10.77,10.169.10.66&lt;/param-value&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;/init-param&gt;<wbr><wbr><br><wbr> &lt;/filter&gt;<wbr><wbr><br><wbr><wbr><wbr><br><wbr> &lt;filter-mapping&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;filter-name&gt;NtlmHttpFilter&lt;/filter-name&gt;<wbr><wbr><br><wbr><wbr><wbr><wbr><wbr>&lt;url-pattern&gt;/*&lt;/url-pattern&gt;<wbr><wbr><br><wbr>&lt;/filter-mapping&gt;</wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr>

jcifs.smb.client.domain应该指的是域名，而jcifs.netbios.wins就应该是相应的Wins服务器了，一般来说这里填写域控制器的IP