如何自定义Tomcat Realm实现我们的用户认证需求

        // -----------------------------------------------Directory Server Instance Variables/**
     *  The type of authentication to use.
     */protected String authentication = null;/**
     * The connection username for the directory server we will contact.
     */protected String ldapConnectionName = null;/**
     * The connection password for the directory server we will contact.
     */protected String ldapConnectionPassword = null;/**
     * The connection URL for the directory server we will contact.
     */protected String ldapConnectionURL = null;/**
     * The directory context linking us to our directory server.
     */protected DirContext context = null;/**
     * The JNDI context factory used to acquire our InitialContext.  By
     * default, assumes use of an LDAP server using the standard JNDI LDAP
     * provider.
     */protected String contextFactory = "com.sun.jndi.ldap.LdapCtxFactory";/**
     * How aliases should be dereferenced during search operations.
     */protected String derefAliases = null;/**
     * Constant that holds the name of the environment property for specifying
     * the manner in which aliases should be dereferenced.
     */public final static String DEREF_ALIASES = "java.naming.ldap.derefAliases";/**
     * The protocol that will be used in the communication with the
     * directory server.
     */protected String protocol = null;/**
     * Should we ignore PartialResultExceptions when iterating over NamingEnumerations?
     * Microsoft Active Directory often returns referrals, which lead
     * to PartialResultExceptions. Unfortunately there's no stable way to detect,
     * if the Exceptions really come from an AD referral.
     * Set to true to ignore PartialResultExceptions.
     */protected boolean adCompat = false;/**
     * How should we handle referrals?  Microsoft Active Directory often returns
     * referrals. If you need to follow them set referrals to "follow".
     * Caution: if your DNS is not part of AD, the LDAP client lib might try
     * to resolve your domain name in DNS to find another LDAP server.
     */protected String referrals = null;/**
     * The base element for user searches.
     */protected String userBase = "";/**
     * The message format used to search for a user, with "{0}" marking
     * the spot where the username goes.
     */protected String userSearch = null;/**
     * The MessageFormat object associated with the current
     * <code>userSearch</code>.
     */protected MessageFormat userSearchFormat = null;/**
     * Should we search the entire subtree for matching users?
     */protected boolean userSubtree = false;/**
     * The attribute name used to retrieve the user password.
     */protected String userPassword = null;/**
     * A string of LDAP user patterns or paths, ":"-separated
     * These will be used to form the distinguished name of a
     * user, with "{0}" marking the spot where the specified username
     * goes.
     * This is similar to userPattern, but allows for multiple searches
     * for a user.
     */protected String[] userPatternArray = null;/**
     * The message format used to form the distinguished name of a
     * user, with "{0}" marking the spot where the specified username
     * goes.
     */protected String ldapUserPattern = null;/**
     * An array of MessageFormat objects associated with the current
     * <code>userPatternArray</code>.
     */protected MessageFormat[] userPatternFormatArray = null;/**
     * An alternate URL, to which, we should connect if ldapConnectionURL fails.
     */protected String ldapAlternateURL;/**
     * The number of connection attempts.  If greater than zero we use the
     * alternate url.
     */protected int connectionAttempt = 0;/**
     * The timeout, in milliseconds, to use when trying to create a connection
     * to the directory. The default is 5000 (5 seconds).
     */protected String connectionTimeout = "5000";// --------------------------------------------------JDBC Instance Variables/**
     * The connection username to use when trying to connect to the database.
     */protected String jdbcConnectionName = null;/**
     * The connection password to use when trying to connect to the database.
     */protected String jdbcConnectionPassword = null;/**
     * The connection URL to use when trying to connect to the database.
     */protected String jdbcConnectionURL = null;/**
     * The connection to the database.
     */protected Connection dbConnection = null;/**
     * Instance of the JDBC Driver class we use as a connection factory.
     */protected Driver driver = null;/**
     * The JDBC driver name to use.
     */protected String jdbcDriverName = null;/**
     * The PreparedStatement to use for identifying the roles for
     * a specified user.
     */protected PreparedStatement preparedRoles = null;/**
     * The string manager for this package.
     */protected static final StringManager sm =StringManager.getManager(Constants.Package);/**
     * The column in the user role table that names a role
     */protected String roleNameCol = null;/**
     * The column in the user role table that holds the user's name
     */protected String userNameCol = null;/**
     * The table that holds the relation between user's and roles
     */protected String userRoleTable = null;/**
     * Descriptive information about this Realm implementation.
     */protected static final String info = "XXXXXX";/**
     * Descriptive information about this Realm implementation.
     */protected static final String name = "XXXRealm";

  <mbean  name="XXXRealm"description="Custom XXXRealm..."domain="Catalina"group="Realm"type="com.myfirm.mypackage.XXXRealm"><attribute  name="className"description="Fully qualified class name of the managed object"type="java.lang.String"writeable="false"/><attribute  name="debug"description="The debugging detail level for this component"type="int"/>...</mbean>

<?xml version="1.0"?>  
<mbeans-descriptors>  <mbean  name="CoralXRRealm"  description="Implementation of Realm that works with a directory server accessed via the Java Naming and Directory Interface (JNDI) APIs and JDBC supported database"  domain="Catalina"  group="Realm"  type="org.opencoral.xreport.realm.CoralXRRealm">  <attribute   name="className"  description="Fully qualified class name of the managed object"  type="java.lang.String"  writeable="false"/>  <attribute   name="ldapConnectionName"  description="The connection username for the directory server we will contact"  type="java.lang.String"/>  <attribute   name="ldapConnectionPassword"  description="The connection password for the directory server we will contact"  type="java.lang.String"/>  <attribute   name="ldapConnectionURL"  description="The connection URL for the directory server we will contact"  type="java.lang.String"/>  <attribute   name="contextFactory"  description="The JNDI context factory for this Realm"  type="java.lang.String"/>  <attribute   name="digest"  description="Digest algorithm used in storing passwords in a non-plaintext format"  type="java.lang.String"/>  <attribute   name="userBase"  description="The base element for user searches"  type="java.lang.String"/>  <attribute   name="userPassword"  description="The attribute name used to retrieve the user password"  type="java.lang.String"/>  <attribute   name="ldapUserPattern"  description="The message format used to select a user"  type="java.lang.String"/>  <attribute   name="userSearch"  description="The message format used to search for a user"  type="java.lang.String"/>  <attribute   name="userSubtree"  description="Should we search the entire subtree for matching users?"  type="boolean"/>  <attribute   name="jdbcConnectionName"  description="The connection username to use when trying to connect to the database"  type="java.lang.String"/>  <attribute   name="jdbcConnectionPassword"  description="The connection URL to use when trying to connect to the database"  type="java.lang.String"/>  <attribute   name="jdbcConnectionURL"  description="The connection URL to use when trying to connect to the database"  type="java.lang.String"/>  <attribute   name="jdbcDriverName"  description="The JDBC driver to use"  type="java.lang.String"/>  <attribute   name="roleNameCol"  description="The column in the user role table that names a role"  type="java.lang.String"/>  <attribute   name="userNameCol"  description="The column in the user role table that holds the user's username"  type="java.lang.String"/>  <attribute   name="userRoleTable"  description="The table that holds the relation between user's and roles"  type="java.lang.String"/>  <operation name="start" description="Start" impact="ACTION" returnType="void" />  <operation name="stop" description="Stop" impact="ACTION" returnType="void" />  <operation name="init" description="Init" impact="ACTION" returnType="void" />  <operation name="destroy" description="Destroy" impact="ACTION" returnType="void" />  </mbean>  </mbeans-descriptors>  

<!-- This Realm uses the UserDatabase configured in the global JNDIresources under the key "UserDatabase".  Any editsthat are performed against this UserDatabase are immediatelyavailable for use by the Realm.  -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"resourceName="UserDatabase"/>

<Realm   className="org.apache.catalina.realm.JNDIRealm"connectionURL="ldap://localhost:389"userPattern="uid={0},ou=people,dc=mycompany,dc=com"roleBase="ou=groups,dc=mycompany,dc=com"roleName="cn"roleSearch="(uniqueMember={0})"
/>

<Realm className="org.apache.catalina.realm.JDBCRealm"driverName="org.gjt.mm.mysql.Driver"connectionURL="jdbc:mysql://localhost/authority?user=dbuser&password=dbpass"userTable="users" userNameCol="user_name" userCredCol="user_pass"userRoleTable="user_roles" roleNameCol="role_name"/>

<Realm  className="com.ustc.realm.CustomRealm"ldapConnectionURL="ldap://server ip:389"ldapUserPattern="uid={0},ou=people,dc=mycompany"jdbcDriverName="org.postgresql.Driver"jdbcConnectionURL="jdbc:postgresql://dbserver ip:port"jdbcConnectionName="xxx"jdbcConnectionPassword="xxx" digest="MD5"userRoleTable="user_roles"userNameCol="user_name"roleNameCol="role_name" />