Add Java EE Security 1.0 API examples by vinayvishal · Pull Request #1 · javaee/tutorial-examples · GitHub

Demonstrates built-in DatabaseIdentityStore usage as specified in JSR 375. Details can be found in the README of this example.

@bbuerkle, this is the first example demonstrating usage of built-in DatabaseIdentityStore. Details on how the application works and how JSR 375 plays a role is captured in README of this application.

Vinay - I can only comment on the grammar. Is that what you would like me to do? Also- I think you should add Will Hopkins to this review.
Thanks,
Barbara

Overall, this looks great. I do have a few comments on ways we can better illustrate the API, and I think we need to eliminate the PlaintextPasswordHash. In general, we should be illustrating secure ways of doing things, not insecure ways. Is an LDAP example feasible? I think LDAP is more common than Database.

We might want to use the LdapIdentityStore provider instead of database, as this will be a more common case.

Agree, may be I will try to include LdapIdentityStore one as a seperate example and retain this one as well.

I think "groups" is more accurate than "roles" in this context.

Done

Done.

We should not use PlaintextPasswordHash -- we don't want to even suggest that someone could do this. If we put it out there as an example, it will inevitably be included in at least some applications, and it's a huge security hole. The issue is moot if we use LdapIdentityStore. If we stay with this, we should make at least some minimal attempt to do hashing, but a "simple" hash might also be the wrong thing to do, because it may also be insecure, but will fool people into thinking they're doing secure password hashing. Password hashing is hard to get right on your own, which is the entire reason for having the Pbkdf2PasswordHash -- better to use that, unless we're going to put the effort into implementing some other secure password hash algorithm.

I will replace PlaintextPasswordHash with Pbkdf2PasswordHash. I will try to include LdapIdentityStore as a separate example.

Database example has been modified to use Pbkdf2PasswordHash. If time permits I will try to add an example with LdapIdentityStore.

These parameters are meaningless, and therefore may be more likely to confuse than educate. If you want to have parameters, you should supply a PasswordHash impl that will actually use them. If you write your own, you should include an initialize() method that processes any parameters that you show.

I will modify accordingly.

Pbkdf2PasswordHash is being used, these parameters have been replace now:

public String[] getDyna() {
         return new String[]{"Pbkdf2PasswordHash.Algorithm=PBKDF2WithHmacSHA512", "Pbkdf2PasswordHash.SaltSizeBytes=64"};
     }

Perhaps use result.getCallerPrincipal().getName(), which will demonstrate that the caller name can be passed as a string. I hope that passing CallerPrincipal as an argument does not become a pattern, because CallerPrincipal, ultimately, is not the platform caller principal in GF, and likely won't be on other platforms either. It is also not an "interesting" application caller principal, because it adds no value for an application. It carries nothing but a name. So it ends up as an extra principal carried around by the subject, but adding no value, and is passed here only because it happens to be returned by IdentityStoreHandler.

This is an area where I think the spec could have used more work to clarify the purpose and use of CallerPrincipal; unfortunately we ran out of time.

Done.

Switched to BasicAuthenticationMechanism, got addressed as part of that.

Maybe use the BasicAuthenticationMechanism instead, for this example? It will invoke any configured identity store.

Agree. Will modify accordingly.

Similar comment to above -- use result.getCallerPrincipal().getName()? It's probably reasonable to just use result.getCallerPrincipal() sometimes; we should show both methods in the various examples.

Right. I will keep that in mind while adding examples in glassfish-samples. for tutorial-examples, I will change it to getName().

As you suggested, I will be using BasicAuthenticationMechanism for this example, hence this too will get addressed as part of that.

Version 1.0

Will update it to 1.0.

Use BasicAuthenticationMechanism instead, for this example?

Yes, I will change it accordingly.

Maybe add a comment that this is for illustrative purposes only, and that a real IdentityStore should include secure storage and credential validation capabilities? This example is so trivial that it's obviously not usable, but we don't want to encourage the use of hard-coded/in-memory stores, or user databases trivially provided as unencrypted files, etc.

Right. I will add the comment as suggested.

Hi Vinay - I edited the readme's for both examples.

Change to: This example demonstrates how you can configure a "DatabaseIdentityStore" to point to a backend database and then use it as an "IdentityStore."

Done.

In this example, "the" following users are defined, along with the roles they are in. (add the and comma)

Done.

You should not use real names here. It is best to use something more generic like Joe, Sam, Tom, Sue.

Done.

...the authentication mechanism bundled with the application comes into effect and authentication is performed against the ...

Done.

Post authentication, the application also verifies the roles the caller is in and sends the details as part of the response.

Done.

In GlassFish 5.0, role to group mapping is enabled by default. Therefore, you do not need to bundle web.xml with the application to provide mapping between roles and groups.

Done.

...the roles the user is in get returned as part of the response.

This class is going to be replaced completely with BasicAuthenticationMechanism as noted above.

Note that the container needs to be made aware of the supported roles, which is achieved with the help of the '@DeclareRoles' annotation as shown above.

Done.

In this example, we are using the credentials of user 'reza' to make a request and to validate the response according to the credentials specified in 'TestIdentityStore' above.
or
In this example, we are using the credentials of user 'reza' to make a request and to determine if the response is consistent with the credentials specified in 'TestIdentityStore' above.

Not sure which one is technically correct.

The former one, have replaced accordingly.

After the application is deployed, we can make a request to the application using the URL shown below:"

Done.

@bbuerkle , I have incorporated most of the comments in README, please feel free to modify the contents if you still find any grammatical errors.

@wmhopkins , I will try to include LdapIdentityStore as a separate example. I will update the examples to incorporate your comments and will push the changes to PR.

Done.

The former one, have replaced accordingly.

Done.

Will update it to 1.0.

Yes, I will change it accordingly.

Right. I will add the comment as suggested.

…xamples

Being replaced by #3 .
Closing this one due to merge issues.

Add Java EE Security 1.0 API examples

af3e2a4

vinayvishal requested review from arindam-bandyopadhyay, bbuerkle and yaminikb August 23, 2017 10:20

vinayvishal self-assigned this Aug 23, 2017

Vinay Vishal added 2 commits August 27, 2017 12:40

Add example demonstrating custom identity store

2298932

Add custom_identity_store module

0db26a0

vinayvishal requested review from bshannon and wmhopkins August 27, 2017 07:23

wmhopkins suggested changes Aug 29, 2017

View reviewed changes

bbuerkle approved these changes Aug 29, 2017

View reviewed changes

vinayvishal commented Sep 1, 2017

View reviewed changes

Vinay Vishal and others added 9 commits September 1, 2017 14:51

Incorporate review comments

b22fa1f

Update copyright

0e67b0a

Incorporate review comments

51485be

add resource element

aaf0623

[maven-release-plugin] rollback the release of 8.0

4a03b38

add empty

28c7cc8

add empty file to ear projects

30bf5ce

Update security-api version

2c21f33

Merge remote-tracking branch 'upstream/master' into javaee-security-e…

1f559d8

…xamples

sameer-pandit force-pushed the master branch from 30bf5ce to a993cf1 Compare September 12, 2017 06:41

add empty file to simple-flow

dfa9c53

sameer-pandit force-pushed the master branch from a993cf1 to 760ba08 Compare September 12, 2017 06:51

Sameer Pandit added 4 commits September 12, 2017 12:21

[maven-release-plugin] prepare release 8.0

f5eabe7

[maven-release-plugin] prepare for next development iteration

84eae93

[maven-release-plugin] rollback the release of 8.0

4383a56

release script changes

f0e034a

Sameer Pandit and others added 20 commits September 15, 2017 14:00

[maven-release-plugin] prepare release 8.0

bb5b63d

[maven-release-plugin] rollback the release of 8.0

9e9cf5e

[maven-release-plugin] prepare release 8.0

587ef36

[maven-release-plugin] prepare for next development iteration

ae6c056

updated copyright year

305f038

change back to 8.0-SNAPSHOT

dcd25b5

Add Java EE Security 1.0 API examples

79018e1

Add example demonstrating custom identity store

00b86c4

Add custom_identity_store module

9bd790d

Incorporate review comments

4805606

Update copyright

009a6a9

Incorporate review comments

14b6e3d

add resource element

3a19bb0

[maven-release-plugin] rollback the release of 8.0

6a6f123

add empty

0f5de90

Update security-api version

284ff83

Update version

865a525

Remove promoted repo details

0b9d287

Update version

44aac95

Resolve merge conflicts

e4b47f0

vinayvishal closed this Sep 20, 2017

vinayvishal deleted the javaee-security-examples branch September 20, 2017 12:02

vinayvishal mentioned this pull request Sep 20, 2017

Add JSR375 Security API 1.0 Examples #3

Merged

+                  dataSourceLookup="${'jdbc/__default'}", // points to database bundled with Glassfish
+                  callerQuery="#{'select password from caller where name = ?'}",
+                  groupsQuery="select group_name from caller_groups where caller_name = ?",
+                  hashAlgorithm = PlaintextPasswordHash.class,

+                  callerQuery="#{'select password from caller where name = ?'}",
+                  groupsQuery="select group_name from caller_groups where caller_name = ?",
+                  hashAlgorithm = PlaintextPasswordHash.class,
+                  hashAlgorithmParameters = {

+                              // and the container will actually handle the login after we return from
+                              // this method.
+                              return httpMessageContext.notifyContainerAboutLogin(
+                                  result.getCallerPrincipal(), result.getCallerGroups());

+                      <dependency>
+                         <groupId>javax.security.enterprise</groupId>
+                         <artifactId>javax.security.enterprise-api</artifactId>
+                         <version>1.0-b11</version>

+               * bundled with the application.
+               */
+              @RequestScoped
+              public class TestAuthenticationMechanism implements HttpAuthenticationMechanism {

		@@ -0,0 +1,251 @@
		# Built-in Database Identity Store
		JSR 375 mandates that a Java EE container MUST support built-in `IdentityStore` backed by a database.


		This example demonstrates how a `DatabaseIdentityStore` can be configured to point to a backend database and how it can then be used as an `IdentityStore`.

		In this example, following users are defined along with the roles they are in.

+                  private IdentityStoreHandler identityStoreHandler;
+                  @Override
+                  public AuthenticationStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext) throws AuthenticationException {


		public CredentialValidationResult validate(UsernamePasswordCredential usernamePasswordCredential) {

		if (usernamePasswordCredential.compareTo("reza", "secret1")) {


		To support this mandatory requirement, `DatabaseIdentityStore` comes bundled with Glassfish-RI.

		This example demonstrates how a `DatabaseIdentityStore` can be configured to point to a backend database and how it can then be used as an `IdentityStore`.

+              |alex|secret2|foo,bar|
+              |arjan|secret2|foo|
+              |werner|secret2|foo|


		When a request is made to the application with certain credentials, the authentication mechanism bundled with this application comes into affect and an authentication is done against the `DatabaseIdentityStore` as defined in the application.

		Post authentication, the application will also verify the roles the caller is in and will send the details as part of the response.

+              ```java
+              @DeclareRoles({ "foo", "bar", "kaz" })
+              ```
+              In Glassfish 5.0, role to group mapping is enabled by default. Hence there is no need to bundle `web.xml` with the application to provide mapping between roles and the groups in Glassfish.

+              return httpMessageContext.responseUnauthorized();
+              ```
+              When a request is made to the application, the roles the user is in, gets returned as part of the repsonse.

+              }
+              ```
+              Notice that, the container itself needs to be made aware of the supported roles and it is done with the help of `@DeclareRoles` annotation as shown above.


		`asadmin deploy <project>/target/custom-identity-store.war`

		Post which, a request can be made to the application using the URL shown below:

+              # Built-in Database Identity Store
+              JSR 375 mandates that a Java EE container MUST support built-in `IdentityStore` backed by a database.
+              To support this mandatory requirement, `DatabaseIdentityStore` comes bundled with Glassfish-RI.

Add Java EE Security 1.0 API examples by vinayvishal · Pull Request #1 · javaee/tutorial-examples · GitHub

Navigation Menu

Repository navigation

Add Java EE Security 1.0 API examples - #1

Add Java EE Security 1.0 API examples#1vinayvishal wants to merge 37 commits intojavaee:masterjavaee/tutorial-examples:masterfrom vinayvishal:javaee-security-examplesvinayvishal/tutorial-examples:javaee-security-examplesCopy head branch name to clipboard

Conversation

vinayvishal commented Aug 23, 2017

Uh oh!

vinayvishal commented Aug 23, 2017

Uh oh!

bbuerkle commented Aug 24, 2017

Uh oh!

wmhopkins left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bbuerkle left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Add Java EE Security 1.0 API examples#1
vinayvishal wants to merge 37 commits into
javaee:masterfrom
vinayvishal:javaee-security-examples