diff --git a/ejb-security/README.md b/ejb-security/README.md new file mode 100644 index 0000000000..1bd8b55613 --- /dev/null +++ b/ejb-security/README.md @@ -0,0 +1,61 @@ +EJB Security Example + +Author: Sherif Makary, RH MW SA + +This example demonstrates the use of JEE declarative security to control access to EJB 3 and Security in JBoss EAP 6 + +The example can be deployed using Maven from the command line or from Eclipse using JBoss Tools. + +To set up Maven or JBoss Tools in Eclipse, refer to the Getting Started Developing Applications Guide. + +To deploy to JBoss AS 7, start JBoss AS 7 and type mvn package jboss-as:deploy. The application is deployed to http://localhost:8080/jboss-as-secured-servlet/CallSecuredEJBServlet. You can read more details in the Getting Started Developing Applications Guide. + +To implement EJB security, you need to: +-Add a security-domain to your jboss-web.xml +-Configure a security domain in standalone.xml +-Have users.properties and roles.properties files in WEB-INF/classes directory of your web application + +To implement EJB declerative security, you need to: +-Add security annotations to your EJB declaration +-Make sure the allowed user role is the same as the role defined in roles.properties file +-Make sure the security domain referenced in jboss-web.xml is defined in the EAP 6 standalone.xml, this is the configuration snipt: + + + + + + + + + + + + + + + + + +For references, please refer to: + +Getting Started Developing Applications Guide. +JBoss AS7: Security : EJB3 Security. + +Test Scenario: +-After successful war deployment to EAP 6 +-Run the url http://localhost:8080/jboss-as-ejb-security/CallSecuredEJBServlet +-You should get a browser log-in challenge +-After successful login using admin/admin, the browser will display some security info: + +"Successfully called Secured EJB + +Principal : admin + +Remote User : admin + +Authentication Type : BASIC +" + + +-Change the role in roles.properties to "gooduser1" +-Redeploy the war and refresh the browser and clear the active login and you should get a security exception. diff --git a/ejb-security/pom.xml b/ejb-security/pom.xml new file mode 100644 index 0000000000..33b8759741 --- /dev/null +++ b/ejb-security/pom.xml @@ -0,0 +1,114 @@ + + + 4.0.0 + + org.jboss.as.quickstarts + jboss-as-ejb-security + 7.0.2.CR4 + war + JBoss AS Quickstarts: ejb-security + JBoss AS Quickstarts: ejb-security + + http://jboss.org/jbossas + + + Apache License, Version 2.0 + repo + http://www.apache.org/licenses/LICENSE-2.0.html + + + + + + + UTF-8 + + + + + + + + org.jboss.spec + jboss-javaee-6.0 + 3.0.0.Beta1-redhat-1 + pom + import + + + + + + + + + javax.enterprise + cdi-api + provided + + + + + org.jboss.spec.javax.annotation + jboss-annotations-api_1.1_spec + provided + + + + + org.jboss.spec.javax.servlet + jboss-servlet-api_3.0_spec + provided + + + + org.jboss.spec.javax.ejb + jboss-ejb-api_3.1_spec + + + + + + jboss-as-ejb-security + + + maven-war-plugin + 2.1.1 + + + false + + + + + org.jboss.as.plugins + jboss-as-maven-plugin + 7.1.0.CR1 + + + + maven-compiler-plugin + 2.3.1 + + 1.6 + 1.6 + + + + + + diff --git a/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/CallSecuredEJBServlet.java b/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/CallSecuredEJBServlet.java new file mode 100644 index 0000000000..679657aa16 --- /dev/null +++ b/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/CallSecuredEJBServlet.java @@ -0,0 +1,91 @@ +/* + * JBoss, Home of Professional Open Source + * Copyright 2011, Red Hat, Inc. and/or its affiliates, + * and individual contributors as indicated by the @author tags. + * See the copyright.txt in the distribution for a + * full listing of individual contributors. + * This copyrighted material is made available to anyone wishing to use, + * modify, copy, or redistribute it subject to the terms and conditions + * of the GNU Lesser General Public License, v. 2.1. + * This program is distributed in the hope that it will be useful, but WITHOUT A + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A + * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. + * You should have received a copy of the GNU Lesser General Public License, + * v.2.1 along with this distribution; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301, USA. + * + * (C) 2012, + * @author Sherif Makary Red Hat MW SA.*/ + +package org.jboss.as.quickstarts.ejb_security; + +import java.io.IOException; +import java.io.PrintWriter; +import javax.ejb.EJB; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.jboss.as.quickstarts.ejb_security.SecuredEJB; + +/** + *

+ * Simple Servlet calling secured ejb + * using Servlet 3 security annotations + * Upon successful authentication and authorization the servlet + * will call the secured ejb and retrieve the principal name + *

+ * + * + * + * @author Sherif Makary MW SA + * + */ +@SuppressWarnings("serial") +@WebServlet("/CallSecuredEJBServlet") + +public class CallSecuredEJBServlet extends HttpServlet { + + static String PAGE_HEADER = ""; + + static String PAGE_FOOTER = ""; + + //Injecting the Secured EJB + @EJB + private SecuredEJB securedEJB; + + /** + *

+ * Servlet entry point method which calls securedEJB.getSecurityInfo() + *

+ * */ + + @Override + protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + PrintWriter writer = resp.getWriter(); + //Get user principal + String principal = null; + String authType = null; + String remoteUser=null; + + //Get security principal + principal = securedEJB.getSecurityInfo(); + //Get user name from login principal + remoteUser = req.getRemoteUser(); + //Get authentication type + authType = req.getAuthType(); + + + writer.println(PAGE_HEADER); + writer.println("

" + "Successfully called Secured EJB " + "

"); + writer.println("

" + "Principal : " + principal + "

"); + writer.println("

" + "Remote User : " + remoteUser +"

"); + writer.println("

" + "Authentication Type : " + authType + "

"); + writer.println(PAGE_FOOTER); + writer.close(); + } + +} diff --git a/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/SecuredEJB.java b/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/SecuredEJB.java new file mode 100644 index 0000000000..f822a68b2e --- /dev/null +++ b/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/SecuredEJB.java @@ -0,0 +1,40 @@ +/* + * JBoss, Home of Professional Open Source + * Copyright 2011, Red Hat, Inc. and/or its affiliates, + * and individual contributors as indicated by the @author tags. + * See the copyright.txt in the distribution for a + * full listing of individual contributors. + * This copyrighted material is made available to anyone wishing to use, + * modify, copy, or redistribute it subject to the terms and conditions + * of the GNU Lesser General Public License, v. 2.1. + * This program is distributed in the hope that it will be useful, but WITHOUT A + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A + * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. + * You should have received a copy of the GNU Lesser General Public License, + * v.2.1 along with this distribution; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301, USA. + * + * (C) 2012, + * @author Sherif Makary Red Hat MW SA.*/ + + +package org.jboss.as.quickstarts.ejb_security; + +import javax.ejb.Local;; + + +/** + *

+ * Simple secured ejb Interface + *

+ * + * @author Sherif Makary MW SA + * + */ + +@Local +public interface SecuredEJB { + public String getSecurityInfo(); + +} \ No newline at end of file diff --git a/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/SecuredEJBBean.java b/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/SecuredEJBBean.java new file mode 100644 index 0000000000..6e87af5b45 --- /dev/null +++ b/ejb-security/src/main/java/org/jboss/as/quickstarts/ejb_security/SecuredEJBBean.java @@ -0,0 +1,67 @@ +/* + * JBoss, Home of Professional Open Source + * Copyright 2011, Red Hat, Inc. and/or its affiliates, + * and individual contributors as indicated by the @author tags. + * See the copyright.txt in the distribution for a + * full listing of individual contributors. + * This copyrighted material is made available to anyone wishing to use, + * modify, copy, or redistribute it subject to the terms and conditions + * of the GNU Lesser General Public License, v. 2.1. + * This program is distributed in the hope that it will be useful, but WITHOUT A + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A + * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. + * You should have received a copy of the GNU Lesser General Public License, + * v.2.1 along with this distribution; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301, USA. + * + * (C) 2012, + * @author Sherif Makary Red Hat MW SA.*/ + + +package org.jboss.as.quickstarts.ejb_security; + +import javax.ejb.Stateless; +import org.jboss.as.quickstarts.ejb_security.SecuredEJB; +import java.security.Principal; +import javax.ejb.SessionContext; +import javax.annotation.Resource; +import javax.annotation.security.RolesAllowed; + +/** + *

+ * Simple secured ejb + * using ejb security annotations + *

+ * + * @author Sherif Makary MW SA + * + */ + +public @Stateless class SecuredEJBBean implements SecuredEJB { + + private Principal principal= null; + + //Inject Session Context + @Resource SessionContext ctx; + + /** + *

+ * sample Secured ejb method using security annotations + *

+ * + */ + + @Override + @RolesAllowed({"gooduser"}) + public String getSecurityInfo() + { + //Session context injected using the resource annotation + principal = ctx.getCallerPrincipal(); + + return principal.toString(); + } + + + +} diff --git a/ejb-security/src/main/webapp/WEB-INF/beans.xml b/ejb-security/src/main/webapp/WEB-INF/beans.xml new file mode 100644 index 0000000000..2a9ad07cf5 --- /dev/null +++ b/ejb-security/src/main/webapp/WEB-INF/beans.xml @@ -0,0 +1,7 @@ + + + \ No newline at end of file diff --git a/ejb-security/src/main/webapp/WEB-INF/classes/roles.properties b/ejb-security/src/main/webapp/WEB-INF/classes/roles.properties new file mode 100644 index 0000000000..2b517e5b70 --- /dev/null +++ b/ejb-security/src/main/webapp/WEB-INF/classes/roles.properties @@ -0,0 +1 @@ +admin=gooduser \ No newline at end of file diff --git a/ejb-security/src/main/webapp/WEB-INF/classes/users.properties b/ejb-security/src/main/webapp/WEB-INF/classes/users.properties new file mode 100644 index 0000000000..3a80e82a86 --- /dev/null +++ b/ejb-security/src/main/webapp/WEB-INF/classes/users.properties @@ -0,0 +1 @@ +admin=admin diff --git a/ejb-security/src/main/webapp/WEB-INF/jboss-web.xml b/ejb-security/src/main/webapp/WEB-INF/jboss-web.xml new file mode 100644 index 0000000000..a6519c798e --- /dev/null +++ b/ejb-security/src/main/webapp/WEB-INF/jboss-web.xml @@ -0,0 +1,6 @@ + + + + WebSecurityBasic + true + \ No newline at end of file diff --git a/ejb-security/src/main/webapp/WEB-INF/web.xml b/ejb-security/src/main/webapp/WEB-INF/web.xml new file mode 100644 index 0000000000..d5e399aa53 --- /dev/null +++ b/ejb-security/src/main/webapp/WEB-INF/web.xml @@ -0,0 +1,24 @@ + + + + + + * + /* + + + gooduser + + + + gooduser + + + BASIC + WebSecurityBasic + + + diff --git a/ejb-security/src/main/webapp/index.html b/ejb-security/src/main/webapp/index.html new file mode 100644 index 0000000000..b515ef7142 --- /dev/null +++ b/ejb-security/src/main/webapp/index.html @@ -0,0 +1,7 @@ + + + + + + + diff --git a/servlet-security/README.md b/servlet-security/README.md new file mode 100644 index 0000000000..800a0dcd31 --- /dev/null +++ b/servlet-security/README.md @@ -0,0 +1,64 @@ +Servlet Security Example + +Author: Sherif Makary, RH MW SA + +This example demonstrates the use of JEE declarative security to control access to Servlets Servlet 3 and Security in JBoss EAP 6 + +The example can be deployed using Maven from the command line or from Eclipse using JBoss Tools. + +To set up Maven or JBoss Tools in Eclipse, refer to the Getting Started Developing Applications Guide. + +To deploy to JBoss AS 7, start JBoss AS 7 and type mvn package jboss-as:deploy. The application is deployed to http://localhost:8080/jboss-as-servlet-security/SecuredServlet. You can read more details in the Getting Started Developing Applications Guide. + +To implement web security, you need to: +-Add a security-constraint to your web.xml under web-inf +-Add a security-domain to your jboss-web.xml +-Configure a security domain in standalone.xml +-Have users.properties and roles.properties files in WEB-INF/classes directory of your web application + +To implement Servlet declerative security, you need to: +-Add security annotations to your Servlet declaration +-Make sure the allowed user role is the same as the role defined in roles.properties file + +-Make sure the security domain referenced in jboss-web.xml is defined in the EAP 6 standalone.xml, this is the configuration snipt: + + + + + + + + + + + + + + + + + +For references, please refer to: +BossAS7: Secure my Web App : How Do I?. +JBoss AS7 : Security Domain Model . + +Test Scenario: +-After successful war deployment to EAP 6 +-Run the url http://localhost:8080/jboss-as-servlet-security/SecuredServlet +-You should get a browser log-in challenge +-After successful login using admin/admin, the browser will display some security info: + +" Successfully called Secured Servlet + +Principal : admin + +Remote User : admin + +Authentication Type : BASIC +" + + + +-Change the role in roles.properties to "gooduser1" +-Redeploy the war and refresh the browser and clear the active login and you should get a security exception. + diff --git a/servlet-security/pom.xml b/servlet-security/pom.xml new file mode 100644 index 0000000000..ea4fafc5b7 --- /dev/null +++ b/servlet-security/pom.xml @@ -0,0 +1,110 @@ + + + 4.0.0 + + org.jboss.as.quickstarts + jboss-as-servlet-security + 7.0.2.CR4 + war + JBoss AS Quickstarts: servlet-security + JBoss AS Quickstarts: servlet-security + + http://jboss.org/jbossas + + + Apache License, Version 2.0 + repo + http://www.apache.org/licenses/LICENSE-2.0.html + + + + + + + UTF-8 + + + + + + + + org.jboss.spec + jboss-javaee-6.0 + 3.0.0.Beta1-redhat-1 + pom + import + + + + + + + + + javax.enterprise + cdi-api + provided + + + + + org.jboss.spec.javax.annotation + jboss-annotations-api_1.1_spec + provided + + + + + org.jboss.spec.javax.servlet + jboss-servlet-api_3.0_spec + provided + + + + + + + jboss-as-servlet-security + + + maven-war-plugin + 2.1.1 + + + false + + + + + org.jboss.as.plugins + jboss-as-maven-plugin + 7.1.0.CR1 + + + + maven-compiler-plugin + 2.3.1 + + 1.6 + 1.6 + + + + + + diff --git a/servlet-security/src/main/java/org/jboss/as/quickstarts/servlet_security/SecuredServlet.java b/servlet-security/src/main/java/org/jboss/as/quickstarts/servlet_security/SecuredServlet.java new file mode 100644 index 0000000000..32d2fb54df --- /dev/null +++ b/servlet-security/src/main/java/org/jboss/as/quickstarts/servlet_security/SecuredServlet.java @@ -0,0 +1,85 @@ +/* + * JBoss, Home of Professional Open Source + * Copyright 2011, Red Hat, Inc. and/or its affiliates, + * and individual contributors as indicated by the @author tags. + * See the copyright.txt in the distribution for a + * full listing of individual contributors. + * This copyrighted material is made available to anyone wishing to use, + * modify, copy, or redistribute it subject to the terms and conditions + * of the GNU Lesser General Public License, v. 2.1. + * This program is distributed in the hope that it will be useful, but WITHOUT A + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A + * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. + * You should have received a copy of the GNU Lesser General Public License, + * v.2.1 along with this distribution; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301, USA. + * + * (C) 2012, + * @author Sherif Makary Red Hat MW SA.*/ + +package org.jboss.as.quickstarts.servlet_security; + +import java.io.IOException; +import java.security.Principal; +import java.io.PrintWriter; + +import javax.annotation.security.DeclareRoles; +import javax.inject.Inject; +import javax.servlet.ServletException; +import javax.servlet.annotation.HttpConstraint; +import javax.servlet.annotation.ServletSecurity; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +/** + *

+ * Simple secured servlet using declarative security + * using Servlet 3 security annotations + * Upon successful authentication and authorization the servlet + * will display security principal name + *

+ * + * + * + * @author Sherif Makary MW SA + * + */ +@SuppressWarnings("serial") +@WebServlet("/SecuredServlet") +@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" })) + +public class SecuredServlet extends HttpServlet { + + static String PAGE_HEADER = ""; + + static String PAGE_FOOTER = ""; + + @Override + protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + PrintWriter writer = resp.getWriter(); + //Get user principal + Principal principal = null; + String authType = null; + String remoteUser=null; + + //Get security principal + principal = req.getUserPrincipal(); + //Get user name from login principal + remoteUser = req.getRemoteUser(); + //Get authentication type + authType = req.getAuthType(); + + + writer.println(PAGE_HEADER); + writer.println("

" + "Successfully called Secured Servlet " + "

"); + writer.println("

" + "Principal : " + principal.getName() + "

"); + writer.println("

" + "Remote User : " + remoteUser +"

"); + writer.println("

" + "Authentication Type : " + authType + "

"); + writer.println(PAGE_FOOTER); + writer.close(); + } + +} diff --git a/servlet-security/src/main/webapp/WEB-INF/beans.xml b/servlet-security/src/main/webapp/WEB-INF/beans.xml new file mode 100644 index 0000000000..2a9ad07cf5 --- /dev/null +++ b/servlet-security/src/main/webapp/WEB-INF/beans.xml @@ -0,0 +1,7 @@ + + + \ No newline at end of file diff --git a/servlet-security/src/main/webapp/WEB-INF/classes/roles.properties b/servlet-security/src/main/webapp/WEB-INF/classes/roles.properties new file mode 100644 index 0000000000..2b517e5b70 --- /dev/null +++ b/servlet-security/src/main/webapp/WEB-INF/classes/roles.properties @@ -0,0 +1 @@ +admin=gooduser \ No newline at end of file diff --git a/servlet-security/src/main/webapp/WEB-INF/classes/users.properties b/servlet-security/src/main/webapp/WEB-INF/classes/users.properties new file mode 100644 index 0000000000..3a80e82a86 --- /dev/null +++ b/servlet-security/src/main/webapp/WEB-INF/classes/users.properties @@ -0,0 +1 @@ +admin=admin diff --git a/servlet-security/src/main/webapp/WEB-INF/jboss-web.xml b/servlet-security/src/main/webapp/WEB-INF/jboss-web.xml new file mode 100644 index 0000000000..a6519c798e --- /dev/null +++ b/servlet-security/src/main/webapp/WEB-INF/jboss-web.xml @@ -0,0 +1,6 @@ + + + + WebSecurityBasic + true + \ No newline at end of file diff --git a/servlet-security/src/main/webapp/WEB-INF/web.xml b/servlet-security/src/main/webapp/WEB-INF/web.xml new file mode 100644 index 0000000000..d5e399aa53 --- /dev/null +++ b/servlet-security/src/main/webapp/WEB-INF/web.xml @@ -0,0 +1,24 @@ + + + + + + * + /* + + + gooduser + + + + gooduser + + + BASIC + WebSecurityBasic + + + diff --git a/servlet-security/src/main/webapp/index.html b/servlet-security/src/main/webapp/index.html new file mode 100644 index 0000000000..549a96fbd4 --- /dev/null +++ b/servlet-security/src/main/webapp/index.html @@ -0,0 +1,7 @@ + + + + + + +