JASS Security through Database With Jboss 7.1.1

JASS Security through Database With Jboss 7.1.1

  May 27, 2012    Suraj Chhetry

---

JAAS can be used for two purposes:

1. for authentication of users, to reliably and securely determine who is currently executing Java code, regardless of whether the code is running as an application, an applet, a bean, or a servlet; and
2. for authorization of users to ensure they have the access control rights (permissions) required to do the actions performed.

For more details information about JASS Security can be found here . 


Let's go step by step to use JASS Security with JBOSS 7.1.1

1. Open file JBOSS_HOME/standalone/configure/standalone.xml in editor.
2. Search <security-domains> tag
3. Add below lines inside <security-domains> tag

<security-domain name=”JASS-Security”>

<authentication>

<login-module code=”Database” flag=”required”>

<!– -Here TEST_DS is  DataSource–>

<module-option name=”dsJndiName” value=”java:jboss/datasources/TEST_DS”/>

<module-option name=”principalsQuery” value=”select password from users where username=?”/>

<module-option name=”rolesQuery” value=”select rolename, ‘Roles’ from roles where username=?”/>

<module-option name=”unauthenticatedIdentity” value=”guest”/>

<!– Please mention password encryption algorithm–>

<module-option name=”hashAlgorithm” value=”SHA-256″/>

<module-option name=”hashEncoding” value=”base64″/>

</login-module>

</authentication>

</security-domain>

Add new file named as  jboss-web.xml inside WEB-INF folder

1. Add these line on jboss-web.xml

<?xml version=”1.0″ encoding=”UTF-8″?>

<jboss-web>

<security-domain>java:/jaas/JASS-Security</security-domain>

</jboss-web>

1. Adjust below line in web.xml

<security-constraint>

<display-name>security</display-name>

<web-resource-collection>

<web-resource-name>faces</web-resource-name>

<description />

<url-pattern>/resources/*</url-pattern>

<url-pattern>/javax.faces.resource/*</url-pattern>

<url-pattern>/services/*</url-pattern>

</web-resource-collection>

</security-constraint>

<security-constraint>

<display-name>security</display-name>

<web-resource-collection>

<web-resource-name>faces</web-resource-name>

<description />

<url-pattern>/*</url-pattern>

</web-resource-collection>

<auth-constraint>

<description />

<role-name>Administrator</role-name>

<role-name>Agent</role-name>

<role-name>Reporter</role-name>

</auth-constraint>

</security-constraint>

<!– Admin –>

<security-constraint>

<display-name>security</display-name>

<web-resource-collection>

<web-resource-name>faces</web-resource-name>

<description />

<url-pattern>/admin/*</url-pattern>

</web-resource-collection>

<auth-constraint>

<description />

<role-name>Administrator</role-name>

</auth-constraint>

</security-constraint>

<login-config>

<auth-method>FORM</auth-method>

<form-login-config>

<form-login-page>/login.jsf</form-login-page>

<form-error-page>/login.jsf/msg=error</form-error-page>

</form-login-config>

</login-config>

<security-role>

<description />

<role-name>Administrator</role-name>

</security-role>

<security-role>

<description />

<role-name>Agent</role-name>

</security-role>

<security-role>

<description />

<role-name>Reporter</role-name>

</security-role>

1. Now Login Page

<form action=”j_security_check” method=”post”>

<br />

<h:panelGrid columns=”2″>

<h:outputLabel for=”j_username”>Username: </h:outputLabel>

<input type=”text” name=”j_username” />

<h:outputLabel for=”j_password”>Password: </h:outputLabel>

<input type=”password” name=”j_password” />

</h:panelGrid>

<br />

<br />

<input type=”submit” value=”Login” />

</form>

 Run application it should ask for login 

Happy JASS