Re: Again SecurityFilter integration with JBoss

Hi,

No problems emailing me - I just sometimes miss personally directed
emails amongst the 200 emails I get a day! Anyway...

Right, yep I've heard of some issues with that version of JBoss - more
specifically it appears to be the Tomcat...

Lately, I'm afraid I have been working on JBoss 4 and I do have it all
working in that, but in order to do so I've had to use JBoss Aspects...
Not ideal but I needed to add a tiny bit of functionality into
securityfilter. So instead of playing with the securityfilter code
directly I used aspects.

Anyway, it looks like I will need a JBoss 3 version in the very near
future (2 weeks) so over the next couple of weeks I'll be sorting out
how to do it on JBoss 3. The problem will need source-level changes to
securityfilter though... :-(

Now maybe I can persuade the securityfilter team to make a tiny change
to the design of one class and add small configuration option... ?


Regards,


Sean

On Fri, 2004-03-05 at 16:03, Renato Romano wrote:
> Sorry to bore you again with my questions, please feel free to stop me
> !!
> I found the classes your realm was looking for in jboos.jar, and added
> to the classpath, but something is still wrong, because user credentials
> (getUserPrincipal().getName() end isUserInRole()) works correctly on the
> web tier, but are not propagated in EJB calls. Maybe the jndi names of
> securityManager are different ? I'm using Jboss 3.2.2
>=20
> Thanks again
>=20
> Renato Romano
>=20
> ____________________________________
> Renato Romano
> Sistemi e Telematica S.p.A.
> Calata Grazie - Vial Al Molo Giano
> 16127 - GENOVA
>=20
> e-mail: [email protected]
> Tel.:   010 2712603
> _____________________________________
>=20
>=20
> -----Original Message-----
> From: Renato Romano [mailto:[email protected]]=20
> Sent: venerd=EC 5 marzo 2004 15.43
> To: '[email protected]'
> Subject: SecurityFilter integration with JBoss
>=20
>=20
> I found on the securityfilter mailing list the following code you post,
> and I was very glad of it because declarative servlet security has
> several problems I had to face, and securityfilter was the good
> alternative, but without propagation of user identity on EJB calls it
> was uneseful to me. SO I picked up your code and I'm now trying to use
> it as a SecurityFilter realm in my app, but could not resolve some Jboss
> import (specifically
>=20
> import org.jboss.security.AuthenticationManager;
> import org.jboss.security.RealmMapping;
> import org.jboss.security.SubjectSecurityManager;
>=20
> I use jbossall-client.jar in the jboss/client dir from Jboss 3.2.2
>=20
> I would be very grateful if you could hint me something about those
> classes, or their replacement in the actual Jboss distribution. Thanks
> anyway
>=20
> Best Regards
>=20
> Renato Romano
>=20
>=20
> Here's you message:
>=20
>  Hi All,
> =20
>  New to securityfilter, couldn't find any talk of integration with
> JBoss/Jetty, so did a little playing of my own and came up with the
> following code. It's a realm class that authenticates the user against
> the Web application's realm (usually via JAAS in JBoss).
> =20
>  The nice upside is that the Principal is correctly instantiated (well
> appears to be) within the container and so propagated to the EJB layer.
> =20
>  Regards,
> =20
>  Sean
> =20
>  (I'm no JBoss expert, but it works for me and would value anyone else
> who knows better, their opinion).
> =20
>  --=20
>  Dr. Sean Radford, MBBS, MSc
>  <[email protected]>
>  http://bladesys.demon.co.uk/
>  Blade Systems
> =20
>  =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> =20
>  /*
>   * @author sradford
>   * <p>Created 07-Jul-2003</p>
>   * <p>Copyright =C2=A9 2002-2003, Aegeus Technology Limited.
>   * <p>All rights reserved.</p>
>   * <p>Use at you desire with no liability to the author.</p>
>   */
>  package com.aegeus.securityfilter
> =20
>  import java.security.Principal;
>  import java.util.HashSet;
>  import java.util.Set;
> =20
>  import javax.naming.Context;
>  import javax.naming.InitialContext;
>  import javax.naming.NamingException;
> =20
>  import org.apache.commons.logging.Log;
>  import org.apache.commons.logging.LogFactory;
>  import org.jboss.security.AuthenticationManager;
>  import org.jboss.security.RealmMapping;
>  import org.jboss.security.SecurityAssociation;
>  import org.jboss.security.SimplePrincipal;
>  import org.jboss.security.SubjectSecurityManager;
>  import org.securityfilter.realm.SecurityRealmInterface;
> =20
>  /**
>   * @author sradford
>   *
>   */
>  public class JBossRealm implements SecurityRealmInterface {
> =20
>  	private static final Log log =3D
> LogFactory.getLog(JBossRealm.class);
> =20
>  	private InitialContext iniCtx =3D null;
>  	private Context securityCtx =3D null;
> =20
>=20
>  	/* (non-Javadoc)
>  	 * @see
> org.securityfilter.realm.SecurityRealmInterface#authenticate(java.lang.S
> tring,
> java.lang.String)
>  	 */
>  	public Principal authenticate(String username, String password)
> {
>  		try {
>  			SubjectSecurityManager subSecMgr =3D
> getSecurityManager();
>  			SimplePrincipal p =3D new
> SimplePrincipal(username);
>  			char[] pChars =3D password.toCharArray();
>  			if (subSecMgr.isValid(p, pChars)) {
>  				SecurityAssociation.setPrincipal(p);
> =20
> SecurityAssociation.setCredential(pChars);
>  				return p;
>  			}
>  		} catch (Exception e) {
>  			log.debug(e);
>  		}
>  		return null;
>  	}
> =20
>=20
>  	/* (non-Javadoc)
>  	 * @see
> org.securityfilter.realm.SecurityRealmInterface#isUserInRole(java.securi
> ty.Principal,
> java.lang.String)
>  	 */
>  	public boolean isUserInRole(Principal principal, String
> rolename) {
>  		Set set =3D new HashSet();
>  		set.add(new SimplePrincipal(rolename));
>  		try {
>  			return
> getRealmMapping().doesUserHaveRole(principal, set);
>  		} catch (NamingException e) {
>  			log.debug(e);
>  			return false;
>  		}
>  	}
> =20
>  	private SubjectSecurityManager getSecurityManager()
>  		throws NamingException {
>  		try {
>  			AuthenticationManager authMgr =3D
>  				(AuthenticationManager)
> getSecurityContext().lookup(
>  					"securityMgr");
>  			if (authMgr instanceof SubjectSecurityManager) {
>  				return (SubjectSecurityManager) authMgr;
>  			}
>  			throw new IllegalStateException(
>  				"java:comp/env/security is not of type
> SubjectSecurityManager: "
>  					+ authMgr.getClass().getName());
>  		} catch (NamingException e) {
>  			log.error(
>  				"java:comp/env/security does not appear
> to be correctly set up",
>  				e);
>  			throw e;
>  		}
>  	}
> =20
>  	private RealmMapping getRealmMapping() throws NamingException {
>  		try {
>  			return (RealmMapping)
> getSecurityContext().lookup("realmMapping");
>  		} catch (NamingException e) {
>  			log.error(
>  				"java:comp/env/security does not appear
> to be correctly set up",
>  				e);
>  			throw e;
>  		}
> =20
>  	}
> =20
>  	private synchronized InitialContext getInitialContext()
>  		throws NamingException {
>  		if (iniCtx =3D=3D null) {
>  			iniCtx =3D new InitialContext();
>  		}
>  		return iniCtx;
>  	}
> =20
>  	private synchronized Context getSecurityContext() throws
> NamingException {
>  		if (securityCtx =3D=3D null) {
>  			securityCtx =3D
>  				(Context)
> getInitialContext().lookup("java:comp/env/security");
>  		}
>  		return securityCtx;
>  	}
> =20
>=20
>  }
>=20
> ____________________________________
> Renato Romano
> Sistemi e Telematica S.p.A.
> Calata Grazie - Vial Al Molo Giano
> 16127 - GENOVA
>=20
> e-mail: [email protected]
> Tel.:   010 2712603
> _____________________________________
--=20
Dr. Sean Radford, MBBS, MSc
[email protected]
http://bladesys.demon.co.uk/



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click