What is tackled in the Java EE Security API (Java EE 8)

Transcription

1

2 What is tackled in the Java EE Security API (Java EE 8)

3 WHY UPDATE? ALREADY AVAILABLE? AGENDA JAVA EE SECURITY JSR-375 SOTERIA CONCEPTS DEMO

4 RUDY DE BUSSCHER C4J Senior Java Web Developer, Java Coach JSR-375 WHO AM I Java EE Security API Expert group member Java EE

5 Why Update? What is available? JSR-375 Concepts Authentication Mechanism WHY UPDATE? IdentityStore Authentication - Authorization Custom integration Security Context

6 WHY A NEW JSR? Java EE Security is viewed as not portable, abstract/confusing, antiquated Doesn't fit cloud app developer paradigm: requires app server configuration

7 TERMINOLOGY? What is that "something" where identities are stored? realm (Tomcat, some hints in Servlet spec) (auth) repository (auth) store login module (JAAS) identity manager (Undertow) authenticator (Resin, OmniSecurity, Seam security) authentication provider (Spring Security) Identity provider

8 JAVA EE SECURITY No JSR exists to address security overall Each JSR has his 'own' way They look at each other, but...

9 So what is standardised?

10 Why Update? What is available? JSR-375 Concepts Authentication Mechanism WHY UPDATE? IdentityStore Authentication - Authorization Custom integration Security Context

11 JASPIC Java Authentication Service Provider Interface for Containers Java EE 6 For custom logic BASIC/FORM/DIGEST Low Level (per request) Verbose

12

13 JACC Java Authorization Service Provider Contract for Containers J2EE 1.4 ERA C.O.M.P.L.E.X.I.T.Y Application Server Wide No Role Mapping specified

14 Why Update? What is available? JSR-375 Concepts Authentication Mechanism GOALS IdentityStore Authentication - Authorization Custom integration Security Context

15 JSR-375 EG discussions started March 2015 EG Members EE API veterans: many JSRs, many years struggling with Security API 3rd party security framework creators/developers EE platform security implementers 10/2016 : EG Updated, switch Spec Lead March 13, 2017 : Early Draft Review

16 Plug the portability holes Modernize GOALS Context Dependency Injection (CDI) Intercept at Access Enforcement Points: POJO methods Expression Language (EL) Enable Access Enforcement Points with complex rules App Developer Friendly Common security configurations not requiring server changes Annotation defaults not requiring XML

17 IDEAS Terminology API for Authentication Mechanism API for Identity Store JAVA EE 8 API for Security Context API for Password Aliasing API for Role/Permission Assignment JAVA EE 9 API for Authorization Interceptors +...

18 SOTERIA In Greek mythology, Soteria was the goddess of safety and salvation. RI of JSR-375 Should work on Java EE 7 WildFly 10+ Payara TomEE WebSphere Liberty

19 USING Existing blocks for authentication and authorization SOTERIA JASPIC JACC

20 OR SHOULD I PUT THE SAFE HARBOUR TEXT...

21 Why Update? What is available? JSR-375 Concepts Authentication Mechanism CONCEPTS IdentityStore Authentication - Authorization Custom integration Security Context

22 HTTP AUTHENTICATION MECHANISM How are credentials retrieved BASIC FORM classic j_security_check,... CustomForm programmatic Custom For JAX-RS endpoints,...

23 @CustomFormAuthenticationMechanismDefinition( logintocontinue loginpage="/login.xhtml", errorpage="" ) )

24 Why Update? What is available? JSR-375 Concepts Authentication Mechanism CONCEPTS IdentityStore Authentication - Authorization Custom integration Security Context

25 IDENTITYSTORE Verify credentials LDAP DATABASE with configurable queries EMBEDDED Easy for testing with hardcoded values Custom Whatever your need is

26 @LdapIdentityStoreDefinition( url = "ldap://localhost:33389/", basedn = "uid=ldap,ou=apps,dc=jsr375,dc=net", password = "changeoninstall", searchbase = "dc=jsr375,dc=net", searchexpression = "(&(uid=%s)(objectclass=person))", groupbasedn = "ou=group,dc=jsr375,dc=net" )

27 CDI Context and Dependency Injection concepts used for many artefacts. Extension to read the annotations and create required beans.

28 CDI -> beans.xml HttpAuthenticationMechanism required to activate Soteria

29 Demo BASIC IN MEMORY

30 Demo FORM IN JSF WITH LDAP

31 Why Update? What is available? JSR-375 Concepts Authentication Mechanism CONCEPTS IdentityStore Authentication - Authorization Custom integration Security Context

32 Authentication TRIPLE A Verifying that a user is who she says she is. Authorisation He can execute the allowed actions within their privilege. Accounting Audit

33 MULTI STORE Authentication / Authorisation From multiple sources! Examples Scenario 1 Authentication : LDAP Authorisation : Database

34 MULTI STORE(2) Scenario 2 Authentication : OAuth2 Authentication : Limited to certain Domain Authorization :... Scenario 3 Authentication :... Authorisation : Database Authorisation (In Test) : Extra roles/permissions

35 IDENTITY STORE HANDLER IdentityStoreHandler Handles multiple defined Identity Stores ValidationType on IdentityStore BOTH AUTHENTICATION AUTHORIZATION

36 @LdapIdentityStoreDefinition( url = "ldap://localhost:33389/", basedn = "uid=ldap,ou=apps,dc=jsr375,dc=net", password = "changeoninstall", searchbase = "dc=jsr375,dc=net", searchexpression = "(&(uid=%s)(objectclass=person))", groupbasedn = "ou=group,dc=jsr375,dc=net", ) authenticateonly = true

37 Demo MULTI STORE

38 Why Update? What is available? JSR-375 Concepts Authentication Mechanism CONCEPTS IdentityStore Authentication - Authorization Custom integration Security Context

39 EXTENSIBILITY interface HttpAuthenticationMechanism interface IdentityStore interface IdentityStoreHandler

40 Why Update? What is available? JSR-375 Concepts Authentication Mechanism CONCEPTS IdentityStore Authentication - Authorization Custom integration Security Context

41 SECURITY CONTEXT Identity Store Principal Info for Request Authentication Mechanism Security Context Authorization Interceptors USES DATA

42 GET INVOLVED Project page The starting point to all resources Users List Subscribe and contribute Github Soteria repository Fork and play!

43 Q & A