In the JOnAS distribution, there is an example named earsample
,
showing how to use the security.
This chapter describes in more details this example, in
order to illustrate how the security capabilities of JOnAS should be
used. The example is a session bean whose methods are protected.
The user calling this bean must be authorized to access these methods.
Since there is at the present time no authentification in JOnAS, we rely on Tomcat to make the identification and authentification steps.
To run the earsample
example, see in the
More complex examples
section in the "Getting Started" chapter of the JOnAS documentation.
This example shows how to access an EJB whose methods are protected.
In order to make this example convenient to run, all the deployment phase is hidden. Now we will have a closer look of what is needed to set up a secured EJB in JOnAS.
To run this example, the first thing to do is to configure Tomcat since JOnAS relies on it to identify and authenticate the user of a servlet.
This is done in two steps:
... <security-constraint> <web-resource-collection> <web-resource-name>Protected Area</web-resource-name> <url-pattern>/secured/*</url-pattern> ... </web-resource-collection> <auth-constraint> <role-name>tomcat</role-name> ... </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>Example Basic Authentication Area</realm-name> </login-config> ...This means that:
http://<hostname>:<port>/earsample/secured/...
are protected.
tomcat
role can access
these URLs.BASIC
, that is to say
that a dialog box will be opened when you will access these
URLs, asking you to enter an User ID and a
password.tomcat
.tomcat-users.xml
file located
in your $CATALINA_HOME/conf/
directory for Tomcat 4.1.x.<tomcat-users> <user name="tomcat" password="tomcat" roles="tomcat" /> ... </tomcat-users>This means that the user with the name (or User ID)
tomcat
is in the role tomcat
and is
authentified thanks to the password tomcat
. $CATALINA_HOME/conf/server.xml
file. <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
debug="0" resourceName="UserDatabase"/>
<Realm className="org.objectweb.security.catalina41.realm.UserDatabaseRealm"
debug="0" resourceName="UserDatabase"/>
or
<Realm className="org.objectweb.security.catalina41.realm.MemoryRealm"
debug="0"/>
or another org.objectweb.security.catalina41.realm.*
class
Now, let's take a look on how to configure the security in JOnAS (More details are provided in the
Security Management
section of the JOnAS documentation).
It is very similar to the setting up of Tomcat. It includes the following steps:
ejb-jar.xml
file).
<ejb-jar> ... <session> <ejb-name>Op</ejb-name> ... </session> ... <assembly-descriptor> <security-role> <role-name>tomcat</role-name> </security-role> <method-permission> <role-name>tomcat</role-name> <method> <ejb-name>Op</ejb-name> <method-name>*</method-name> </method> </method-permission> ... </assembly-descriptor> </ejb-jar>This means that:
tomcat
is defined.Op
session bean (*
is a shortcut to indicate all the methods of the EJB).tomcat
role.tomcat = tomcatThis file is very similar to the
tomcat-users.xml
file
(even if it is a properties file
and not an XML file). It stipulates that the tomcat
name
(on the left side of =
) is in
the tomcat role
(on the right side). tomcat-users.xml
file, there is no
password since JOnAS is not currently able to authenticate user.
In this example, there are some notions to well understand:
tomcat
role defined on the
tomcat-users.xml
file is local to
Tomcat. It is used to authorize access to the servlet.
tomcat
role defined on the
jonas-users.properties
file is local to
JOnAS. It is used to authorize access to the methods of the bean.tomcat
for both, for
convenience but it was not mandatory.
tomcat-users.xml
and
jonas-users.properties
files must be the same. Using security differs depending on we use Jeremie or RMI (see Configuring Security)
-secpropag
option of GenIC tool