java – Tomcat 7嵌套CombinedRealm,LockoutRealm和DataSourceRealm

<CombinedRealm>
  <LockoutRealm>
     <DataSourceRealm/>
  </LockoutRealm>
  <UserDatabaseRealm/>
</CombinedRealm>

这似乎不起作用 – 是否可以将Tomms中的Realms嵌套两个以上级别？我在日志中收到警告：

No rules found matching 'Server/Service/Engine/Realm/Realm/Realm'.

其背后的想法是,Web服务有一些不能被锁定的关键用户(例如,作为DOS)和一些普通用户,这些用户可能拥有较弱的密码,其中lockoutRealm应该是活动的.我相信其他人一直处于这种状况.

如果还有其他方法可以实现这一点(例如LockoutRealm的白名单),请告诉我.

单点登录也是必需的.

我想扩展现有的LockoutRealm代码以及永远不会锁定的帐户列表将是一个选项,但我不是那么热衷于编写我自己的Realm,我宁愿不在该级别上添加自定义代码给Tomcat,因为这将复杂的设置为其他人和每个Tomcat更新它可能会破坏等.

谢谢你的帮助！

这是我的测试配置的server.xml的相关部分：

<Engine name="Catalina" defaultHost="localhost">

  <Realm className="org.apache.catalina.realm.CombinedRealm">

    <!-- Lockout realm for the DB users -->
    <Realm className="org.apache.catalina.realm.LockOutRealm">
      <!-- PRIMARY: DataSourceRealm with user DB -->
      <Realm className="org.apache.catalina.realm.DataSourceRealm"
         dataSourceName="jdbc/authority"
         userTable="user" userNameCol="username" 
         userCredCol="password" digest="SHA"
         userRoleTable="user_role" roleNameCol="rolename" />
    </Realm>

    <!-- FALLBACK:
         This Realm uses the UserDatabase configured in the global JNDI
         resources under the key "UserDatabase".  Any edits
         that are performed against this UserDatabase are immediately
         available for use by the Realm.  -->
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           resourceName="UserDatabase"/>

  </Realm>

  <Host name="localhost"  appBase="webapps"
        unpackWARs="true" autoDeploy="true">

    <!-- SingleSignOn valve,share authentication between web applications
         Documentation at: /docs/config/valve.html -->
    <Valve className="org.apache.catalina.authenticator.SingleSignOn" />

    <!-- Access log processes all example.
         Documentation at: /docs/config/valve.html
         Note: The pattern used is equivalent to using pattern="common" -->
    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log." suffix=".txt"
           pattern="%h %l %u %t &quot;%r&quot; %s %b" />

  </Host>
</Engine>