Skip to content

Commit

Permalink
JDF-158 Add custom authorization example using @SecurityBindingType f…
Browse files Browse the repository at this point in the history 
…rom DeltaSpike
  • Loading branch information
@rafabene @pmuir
rafabene authored and pmuir committed Dec 23, 2012
1 parent f2fd7da commit e59400f
Show file tree
Hide file tree
Showing 19 changed files with 1,010 additions and 2 deletions.
2 changes: 1 addition & 1 deletion .gitignore
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,4 @@ bin
*.log
.clover
*.swp
!/wicket-war/src/main/resources/META-INF/MANIFEST.MF
!/wicket-war/src/main/resources/META-INF/MANIFEST.MF
1 change: 0 additions & 1 deletion README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -617,4 +617,3 @@ When instructed to use Byteman to halt the application, perform the following st

When you are done testing the quickstart, remember to restore the configuration file with the backup copy you made in step 2 above.


100 changes: 100 additions & 0 deletions deltaspike-security/README.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,100 @@
jboss-as-deltaspike-projectstage: Demonstrate the creation of a custom authorization example using @SecurityBindingType from DeltaSpike
======================================================
Author: Rafael Benevides
Level: Beginner
Technologies: JSF, CDI, Deltaspike
Summary: Demonstrate the creation of a custom authorization example using @SecurityBindingType from DeltaSpike
Prerequisites:
Target Product: WFK

What is it?
-----------

SecurityBinding is a feature of the security module that acts by intercepting method calls, and performing a security check before invocation is allowed to proceed.

To use it, it's needed to create a security parameter binding annotation. In this application we created `@AdminAllowed` and `@GuestAllowed` annotations.

The application also defines an `Authorizer` class that implements behavior for both `SecurityBindingType`. This class is simply a CDI bean which declares a @Secures method, qualified with the security binding annotation we created.

This `Authorizer` is integrated with JAAS so the check is delegated to JAAS API through `FacesContext`, but any other ways to check if the method is allowed could be used.

Both annotations was applied to methods on `SecuredController` class.


System requirements
-------------------

All you need to build this project is Java 6.0 (Java SDK 1.6) or better, Maven 3.0 or better.

The application this project produces is designed to be run on JBoss Enterprise Application Platform 6 or JBoss AS 7.


Configure Maven
---------------

If you have not yet done so, you must [Configure Maven](../README.md#mavenconfiguration) before testing the quickstarts.



Add an Application User
----------------
This quickstart uses secured management interfaces and requires that you create an application user to access the running application. Instructions to set up the quickstart application user can be found here: [Add an Application User](../README.md#addapplicationuser)


Start JBoss Enterprise Application Platform 6 or JBoss AS 7
-------------------------

1. Open a command line and navigate to the root of the JBoss server directory.
2. The following shows the command line to start the server with the web profile:

For Linux: JBOSS_HOME/bin/standalone.sh
For Windows: JBOSS_HOME\bin\standalone.bat

Build and Deploy the Quickstart
-------------------------

_NOTE: The following build command assumes you have configured your Maven user settings. If you have not, you must include Maven setting arguments on the command line. See [Build and Deploy the Quickstarts](../README.md#buildanddeploy) for complete instructions and additional options._

1. Make sure you have started the JBoss Server as described above.
2. Open a command line and navigate to the root directory of this quickstart.
3. Type this command to build and deploy the archive:

mvn clean package jboss-as:deploy
4. This will deploy `target/jboss-as-deltaspike-security.war` to the running instance of the server.

Access the application
---------------------

Access the running application in a browser at the following URL: <localhost:8080/jboss-as-deltaspike-security/>

When you try to access the application, you're redirected to a Login form already filled. (remember to setup the Application User).

Log in application and you see the secured page showing your username and two buttons.

Click on `Guest Method` button and realize that you will see the following message: `You executed a @GuestAllowed method`.

Now, click on `Admin Method` button and you will be redirected to a error page with the following exception: `org.apache.deltaspike.security.api.authorization.AccessDeniedException`

Undeploy the Archive
--------------------

1. Make sure you have started the JBoss Server as described above.
2. Open a command line and navigate to the root directory of this quickstart.
3. When you are finished testing, type this command to undeploy the archive:

mvn jboss-as:undeploy


Run the Quickstart in JBoss Developer Studio or Eclipse
-------------------------------------

You can also start the server and deploy the quickstarts from Eclipse using JBoss tools. For more information, see [Use JBoss Developer Studio or Eclipse to Run the Quickstarts](../README.md#useeclipse)

Debug the Application
------------------------------------

If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.

mvn dependency:sources
mvn dependency:resolve -Dclassifier=javadoc

196 changes: 196 additions & 0 deletions deltaspike-security/pom.xml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,196 @@
<?xml version="1.0"?>
<!-- JBoss, Home of Professional Open Source Copyright 2012, Red Hat, Inc.
and/or its affiliates, and individual contributors by the @authors tag. See
the copyright.txt in the distribution for a full listing of individual contributors.
Licensed under the Apache License, Version 2.0 (the "License"); you may not
use this file except in compliance with the License. You may obtain a copy
of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required
by applicable law or agreed to in writing, software distributed under the
License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
OF ANY KIND, either express or implied. See the License for the specific
language governing permissions and limitations under the License. -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>org.jboss.as.quickstarts</groupId>
<artifactId>jboss-as-deltaspike-security</artifactId>
<version>7.1.2-SNAPSHOT</version>
<packaging>war</packaging>
<name>JBoss AS Quickstarts: DeltaSpike Security</name>
<description>DeltaSpike Security: shows a custom authorization example using @SecurityBindingType from DeltaSpike</description>

<url>http://jboss.org/jbossas</url>
<licenses>
<license>
<name>Apache License, Version 2.0</name>
<distribution>repo</distribution>
<url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
</license>
</licenses>

<properties>
<!-- Explicitly declaring the source encoding eliminates the following
message: -->
<!-- [WARNING] Using platform encoding (UTF-8 actually) to copy filtered
resources, i.e. build is platform dependent! -->
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<!-- JBoss dependency versions -->
<version.org.jboss.as.plugins.maven.plugin>7.3.Final</version.org.jboss.as.plugins.maven.plugin>
<version.org.jboss.bom>1.0.4.CR4</version.org.jboss.bom>

<!-- other plugin versions -->
<version.compiler.plugin>2.3.1</version.compiler.plugin>
<version.war.plugin>2.1.1</version.war.plugin>

<!-- maven-compiler-plugin -->
<maven.compiler.target>1.6</maven.compiler.target>
<maven.compiler.source>1.6</maven.compiler.source>
</properties>

<dependencyManagement>
<dependencies>
<!-- JBoss distributes a complete set of Java EE 6 APIs including
a Bill of Materials (BOM). A BOM specifies the versions of a "stack" (or
a collection) of artifacts. We use this here so that we always get the correct
versions of artifacts. Here we use the jboss-javaee-6.0-with-deltaspike stack
(you can read this as the JBoss stack of the Java EE 6 APIs with Deltaspike).
You can actually use this stack with any version of JBoss AS that implements
Java EE 6, not just JBoss AS 7! -->
<dependency>
<groupId>org.jboss.bom</groupId>
<artifactId>jboss-javaee-6.0-with-deltaspike</artifactId>
<version>${version.org.jboss.bom}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>

<dependencies>

<!-- Import the Servlet API, we use provided scope as the API is included
in JBoss AS 7 -->
<dependency>
<groupId>org.jboss.spec.javax.servlet</groupId>
<artifactId>jboss-servlet-api_3.0_spec</artifactId>
<scope>provided</scope>
</dependency>

<!-- Import the CDI API, we use provided scope as the API is included
in JBoss AS 7 -->
<dependency>
<groupId>javax.enterprise</groupId>
<artifactId>cdi-api</artifactId>
<scope>provided</scope>
</dependency>

<!-- Import the Common Annotations API (JSR-250), we use provided
scope as the API is included in JBoss AS 7 -->
<dependency>
<groupId>org.jboss.spec.javax.annotation</groupId>
<artifactId>jboss-annotations-api_1.1_spec</artifactId>
<scope>provided</scope>
</dependency>

<!-- Import the JSF API, we use provided scope as the API is included
in JBoss AS 7 -->
<dependency>
<groupId>org.jboss.spec.javax.faces</groupId>
<artifactId>jboss-jsf-api_2.1_spec</artifactId>
<scope>provided</scope>
</dependency>

<!-- Import the JPA API, we use provided scope as the API is included
in JBoss AS 7 -->
<dependency>
<groupId>org.hibernate.javax.persistence</groupId>
<artifactId>hibernate-jpa-2.0-api</artifactId>
<scope>provided</scope>
</dependency>

<!-- Import the JPA API, we use provided scope as the API is included
in JBoss AS 7 -->
<dependency>
<groupId>org.jboss.spec.javax.transaction</groupId>
<artifactId>jboss-transaction-api_1.1_spec</artifactId>
<scope>provided</scope>
</dependency>

<!-- Import the EJB API, we use provided scope as the API is included
in JBoss AS 7 -->
<dependency>
<groupId>org.jboss.spec.javax.ejb</groupId>
<artifactId>jboss-ejb-api_3.1_spec</artifactId>
<scope>provided</scope>
</dependency>

<!-- Deltaspike API. we use compile scope as we need its API -->
<dependency>
<groupId>org.apache.deltaspike.core</groupId>
<artifactId>deltaspike-core-api</artifactId>
<scope>compile</scope>
</dependency>

<!-- Deltaspike Impl. we use runtime scope as we its implementation
dependencies only on runtime -->
<dependency>
<groupId>org.apache.deltaspike.core</groupId>
<artifactId>deltaspike-core-impl</artifactId>
<scope>runtime</scope>
</dependency>

<!-- Deltaspike Security Module API. we use compile scope as we need
its API -->
<dependency>
<groupId>org.apache.deltaspike.modules</groupId>
<artifactId>deltaspike-security-module-api</artifactId>
<scope>compile</scope>
</dependency>

<!-- Deltaspike Security Impl. we use runtime scope as we its implementation
dependencies only on runtime -->
<dependency>
<groupId>org.apache.deltaspike.modules</groupId>
<artifactId>deltaspike-security-module-impl</artifactId>
<scope>runtime</scope>
</dependency>

</dependencies>

<build>
<!-- Set the name of the war, used as the context root when the app
is deployed -->
<finalName>${project.artifactId}</finalName>
<plugins>
<plugin>
<artifactId>maven-war-plugin</artifactId>
<version>${version.war.plugin}</version>
<configuration>
<!-- Java EE 6 doesn't require web.xml, Maven needs to
catch up! -->
<failOnMissingWebXml>false</failOnMissingWebXml>
</configuration>
</plugin>
<!-- JBoss AS plugin to deploy war -->
<plugin>
<groupId>org.jboss.as.plugins</groupId>
<artifactId>jboss-as-maven-plugin</artifactId>
<version>${version.org.jboss.as.plugins.maven.plugin}</version>
</plugin>
<!-- Compiler plugin enforces Java 1.6 compatibility and activates
annotation processors -->
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<version>${version.compiler.plugin}</version>
<configuration>
<source>${maven.compiler.source}</source>
<target>${maven.compiler.target}</target>
</configuration>
</plugin>
</plugins>
</build>

</project>

50 changes: 50 additions & 0 deletions ...-security/src/main/java/org/jboss/as/quickstarts/deltaspike/security/ErrorController.java
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2012, Red Hat, Inc., and individual contributors
* as indicated by the @author tags. See the copyright.txt file in the
* distribution for a full listing of individual contributors.
*
* This is free software; you can redistribute it and/or modify it
* under the terms of the GNU Lesser General Public License as
* published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This software is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this software; if not, write to the Free
* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
*/

package org.jboss.as.quickstarts.deltaspike.security;

import javax.enterprise.inject.Model;
import javax.faces.context.FacesContext;

/**
* @author <a href="mailto:benevides@redhat.com">Rafael Benevides</a>
*
*/
//The @Model stereotype is a convenience mechanism to make this a request-scoped bean that has an
//EL name
//Read more about the @Model stereotype in this FAQ:
//http://sfwk.org/Documentation/WhatIsThePurposeOfTheModelAnnotation
@Model
public class ErrorController {

//This method return the stack trace string from the Exception
public String getStackTrace() {
Throwable throwable = (Throwable) FacesContext.getCurrentInstance().getExternalContext().getRequestMap().get("javax.servlet.error.exception");
StringBuilder builder = new StringBuilder();
builder.append(throwable.getMessage()).append("\n");
for (StackTraceElement element : throwable.getStackTrace()) {
builder.append(element).append("\n");
}
return builder.toString();
}

}
Loading

0 comments on commit e59400f

Please sign in to comment.