You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by se...@apache.org on 2015/10/15 12:20:43 UTC
cxf-fediz git commit: [FEDIZ-131] Adding first 2 demos - they can be
run with any JAX-RS impl with the minimum amount of updates
Repository: cxf-fediz
Updated Branches:
refs/heads/master ee4556c78 -> c875b8adf
[FEDIZ-131] Adding first 2 demos - they can be run with any JAX-RS impl with the minimum amount of updates
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/c875b8ad
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/c875b8ad
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/c875b8ad
Branch: refs/heads/master
Commit: c875b8adf8c306d615436a7cb62816df903b75e8
Parents: ee4556c
Author: Sergey Beryozkin <sb...@gmail.com>
Authored: Thu Oct 15 11:20:28 2015 +0100
Committer: Sergey Beryozkin <sb...@gmail.com>
Committed: Thu Oct 15 11:20:28 2015 +0100
----------------------------------------------------------------------
examples/jaxrsSimpleWebapp/README.txt | 81 ++++++++++
examples/jaxrsSimpleWebapp/pom.xml | 98 ++++++++++++
.../fediz/example/FederationApplication.java | 30 ++++
.../cxf/fediz/example/FederationService.java | 118 +++++++++++++++
.../src/main/resources/log4j.properties | 22 +++
.../src/main/resources/ststrust.jks | Bin 0 -> 3908 bytes
.../src/main/webapp/META-INF/context.xml | 22 +++
.../src/main/webapp/WEB-INF/web.xml | 135 +++++++++++++++++
.../src/main/webapp/index.html | 25 +++
.../src/main/webapp/secure/test.html | 25 +++
examples/jaxrsSpringSecurityWebapp/README.txt | 74 +++++++++
examples/jaxrsSpringSecurityWebapp/pom.xml | 151 +++++++++++++++++++
.../cxf/fediz/example/FederationService.java | 125 +++++++++++++++
.../src/main/resources/log4j.properties | 22 +++
.../src/main/resources/ststrust.jks | Bin 0 -> 3908 bytes
.../WEB-INF/applicationContext-security.xml | 101 +++++++++++++
.../src/main/webapp/WEB-INF/fediz_config.xml | 56 +++++++
.../src/main/webapp/WEB-INF/web.xml | 87 +++++++++++
.../src/main/webapp/index.html | 25 +++
.../src/main/webapp/secure/test.html | 25 +++
examples/pom.xml | 2 +
21 files changed, 1224 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/README.txt
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/README.txt b/examples/jaxrsSimpleWebapp/README.txt
new file mode 100644
index 0000000..900de36
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/README.txt
@@ -0,0 +1,81 @@
+JAX-RS Simple Web Application Demo
+==================================
+
+This demo shows how to build and deploy an SSO protected JAX-RS web application
+using Apache CXF Fediz.
+
+The demo uses Apache CXF CXFServlet.
+If you work with Jersey or RESTEasy - please replace CXF specific declarations with your
+preferred JAX-RS implementation's Servlet declaration. The application code
+is a portable JAX-RS code.
+
+Running this sample consists of four steps:
+
+- Configure the Tomcat-IDP and Servlet Container for RP instances
+- Building the demo using Maven
+- Deploying the demo to the RP instance
+- Testing the demo
+
+Please review the README in the samples main directory before continuing.
+
+Configure the Tomcat-IDP and Servlet Container for RP instances
+---------------------------------------------------------------
+First, make sure the separate Tomcat instance hosting the Fediz IDP and IDP
+STS has been configured and is running as described here:
+http://cxf.apache.org/fediz-idp.html. Confirm the STS is active by
+checking that the WSDL is viewable from the browser using the URL given
+on that page--don't proceed further unless it is.
+
+The benefit of using Spring Security which is packaged with the demo application
+there are no plugin deployments required for the RP Servlet Container.
+See this wiki page for instructions:
+http://cxf.apache.org/fediz-spring.html -- the "HTTPS Configuration" sections
+are the only parts that need configuration for this sample.
+
+
+Demo Web Application
+--------------------
+The main code lives in the class FederationService. This JAX-RS Service is protected
+and can be accessed only if the browser user is authenticated. The purpose of
+the FederationServlet is to illustrate the usage of the Spring Security API and
+Configuration to get the authenticated user and to check the roles he has. Further,
+the FederationServlet shows how to access claims data (user data) which were
+stored in the SAML token by using the Fediz interface FedizPrincipal.
+Beyond that, the FederationService illustrates how to access the SAML token
+if required. The classes SecurityTokenThreadLocal.java and FederationFilter.java
+can be used to achieve that. You could get this information directly from the
+HTTP session.
+
+
+Building the demo using Maven
+-----------------------------
+From the base directory of this sample (i.e., where this README file is
+located), the pom.xml file is used to build and run the demo. From a
+command prompt, enter:
+
+ mvn clean install (builds the demo and creates a WAR file for Servlet deployment)
+
+
+Deploying the demo to Tomcat
+----------------------------
+Either manually copy this sample's generated WAR file to the Tomcat-RP's
+webapps folder, or use the Tomcat Maven Plugin as described in the README file
+in the example folder root.
+It's recommended to not deploy this WAR into Servlet Container where Fediz is
+integrated into the Security Layer of the Container itself.
+
+
+Test the demo
+-------------
+Enter the following URL into the browser (TCP port depends on your HTTP settings):
+
+https://localhost:10443/fedizhelloworld/secure/fedservlet
+
+The browser is redirected to the IDP and prompts for username and password. As described
+in the IDP installation, the following users are already set up:
+
+User: alice Password: ecila
+User: bob Password: bob
+User: ted Password: det
+
+
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/pom.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/pom.xml b/examples/jaxrsSimpleWebapp/pom.xml
new file mode 100644
index 0000000..3950a9e
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/pom.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache.cxf.fediz</groupId>
+ <artifactId>examples</artifactId>
+ <version>1.3.0-SNAPSHOT</version>
+ </parent>
+ <groupId>org.apache.cxf.fediz.examples</groupId>
+ <artifactId>jaxrsSimpleWebapp</artifactId>
+ <name>Fediz Example: JAX-RS Simple Webapp</name>
+ <packaging>war</packaging>
+ <properties>
+ <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+ </properties>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.cxf.fediz</groupId>
+ <artifactId>fediz-core</artifactId>
+ <version>${project.version}</version>
+ <scope>provided</scope>
+ </dependency>
+ <!-- Use an alternative JAX-RS implementation dependencies if you do not work with CXF JAX-RS -->
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+ <version>${cxf.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-log4j12</artifactId>
+ <version>${slf4j.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <version>${commons.lang.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ <version>${log4j.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>javax.mail</groupId>
+ <artifactId>mail</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>javax.jms</groupId>
+ <artifactId>jms</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>com.sun.jdmk</groupId>
+ <artifactId>jmxtools</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>com.sun.jmx</groupId>
+ <artifactId>jmxri</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ </dependencies>
+ <build>
+ <plugins>
+ <plugin>
+ <!--for mvn tomcat:deploy/:undeploy/:redeploy -->
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>tomcat-maven-plugin</artifactId>
+ <version>1.1</version>
+ <configuration>
+ <server>myTomcat</server>
+ <url>http://localhost:10080/manager/text</url>
+ <path>/${project.build.finalName}</path>
+ </configuration>
+ </plugin>
+ </plugins>
+ <!-- Name of the generated WAR file -->
+ <finalName>fedizhelloworld</finalName>
+ </build>
+</project>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationApplication.java
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationApplication.java b/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationApplication.java
new file mode 100644
index 0000000..8e86ff3
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationApplication.java
@@ -0,0 +1,30 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.fediz.example;
+
+import java.util.Collections;
+import java.util.Set;
+
+import javax.ws.rs.core.Application;
+
+public class FederationApplication extends Application {
+ public Set<Object> getSingletons() {
+ return Collections.<Object>singleton(new FederationService());
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java b/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java
new file mode 100644
index 0000000..fa31a87
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java
@@ -0,0 +1,118 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.example;
+
+import java.io.StringWriter;
+import java.security.Principal;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.ResponseBuilder;
+import javax.ws.rs.core.SecurityContext;
+import javax.ws.rs.core.UriInfo;
+import javax.xml.transform.OutputKeys;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+
+import org.w3c.dom.Element;
+
+import org.apache.commons.lang3.StringEscapeUtils;
+import org.apache.cxf.fediz.core.Claim;
+import org.apache.cxf.fediz.core.ClaimCollection;
+import org.apache.cxf.fediz.core.FedizPrincipal;
+import org.apache.cxf.fediz.core.SecurityTokenThreadLocal;
+
+
+
+@Path("/")
+public class FederationService {
+
+ @GET
+ public Response get(@Context UriInfo uriInfo,
+ @Context SecurityContext securityContext) {
+
+ ResponseBuilder rb = Response.ok().type("text/html");
+
+ StringBuilder out = new StringBuilder();
+ out.append("<html>");
+ out.append("<head><title>WS Federation Spring Security Example</title></head>");
+ out.append("<body>");
+ out.append("<h1>Hello World</h1>");
+ out.append("Hello world<br>");
+ out.append("Request url: " + uriInfo.getAbsolutePath().toString() + "<p>");
+
+ out.append("<br><b>User</b><p>");
+ Principal p = securityContext.getUserPrincipal();
+ if (p != null) {
+ out.append("Principal: " + p.getName() + "<p>");
+ }
+
+ out.append("<br><b>Roles</b><p>");
+ List<String> roleListToCheck = Arrays.asList("Admin", "Manager", "User", "Authenticated");
+ for (String item: roleListToCheck) {
+ out.append("Has role '" + item + "': "
+ + ((securityContext.isUserInRole(item)) ? "<b>yes</b>" : "no") + "<p>");
+ }
+
+ if (p instanceof FedizPrincipal) {
+ FedizPrincipal fp = (FedizPrincipal)p;
+
+ out.append("<br><b>Claims</b><p>");
+ ClaimCollection claims = fp.getClaims();
+ for (Claim c: claims) {
+ out.append(c.getClaimType().toString() + ": " + c.getValue() + "<p>");
+ }
+ } else {
+ out.append("Principal is not instance of FedizPrincipal");
+ }
+
+ Element el = SecurityTokenThreadLocal.getToken();
+ if (el != null) {
+ out.append("<p>Bootstrap token...");
+ String token = null;
+ try {
+ TransformerFactory transFactory = TransformerFactory.newInstance();
+ Transformer transformer = transFactory.newTransformer();
+ StringWriter buffer = new StringWriter();
+ transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
+ transformer.transform(new DOMSource(el), new StreamResult(buffer));
+ token = buffer.toString();
+ @SuppressWarnings("deprecation")
+ String escapedXml = StringEscapeUtils.escapeXml(token);
+ out.append("<p>" + escapedXml);
+ } catch (Exception ex) {
+ out.append("<p>Failed to transform cached element to string: " + ex.toString());
+ }
+ } else {
+ out.append("<p>Bootstrap token not cached in thread local storage");
+ }
+
+ out.append("</body>");
+
+ return rb.entity(out.toString()).build();
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/resources/log4j.properties
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/resources/log4j.properties b/examples/jaxrsSimpleWebapp/src/main/resources/log4j.properties
new file mode 100644
index 0000000..e16244a
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/resources/log4j.properties
@@ -0,0 +1,22 @@
+# Set root category priority to INFO and its only appender to CONSOLE.
+log4j.rootLogger=INFO, CONSOLE
+log4j.logger.org.springframework=INFO, CONSOLE
+log4j.additivity.org.springframework=false
+log4j.logger.org.springframework.security=DEBUG, CONSOLE
+log4j.additivity.org.springframework.security=false
+log4j.logger.org.apache.cxf.fediz=DEBUG, CONSOLE
+log4j.additivity.org.apache.cxf.fediz=false
+
+# CONSOLE is set to be a ConsoleAppender using a PatternLayout.
+log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
+log4j.appender.CONSOLE.Threshold=DEBUG
+log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
+log4j.appender.CONSOLE.layout.ConversionPattern=%d [%t] %-5p %c %x - %m%n
+
+# LOGFILE is set to be a File appender using a PatternLayout.
+log4j.appender.LOGFILE=org.apache.log4j.FileAppender
+log4j.appender.LOGFILE.File=fedizhelloworld.log
+log4j.appender.LOGFILE.Append=false
+log4j.appender.LOGFILE.Threshold=DEBUG
+log4j.appender.LOGFILE.layout=org.apache.log4j.PatternLayout
+log4j.appender.LOGFILE.layout.ConversionPattern=%d [%t] %-5p %c %x - %m%n
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/resources/ststrust.jks
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/resources/ststrust.jks b/examples/jaxrsSimpleWebapp/src/main/resources/ststrust.jks
new file mode 100644
index 0000000..ef5a844
Binary files /dev/null and b/examples/jaxrsSimpleWebapp/src/main/resources/ststrust.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/webapp/META-INF/context.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/webapp/META-INF/context.xml b/examples/jaxrsSimpleWebapp/src/main/webapp/META-INF/context.xml
new file mode 100644
index 0000000..a789b58
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/webapp/META-INF/context.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<Context>
+ <Valve className="org.apache.cxf.fediz.tomcat7.FederationAuthenticator" configFile="conf/fediz_config.xml" />
+</Context>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/webapp/WEB-INF/web.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/webapp/WEB-INF/web.xml b/examples/jaxrsSimpleWebapp/src/main/webapp/WEB-INF/web.xml
new file mode 100644
index 0000000..895f62e
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/webapp/WEB-INF/web.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+ version="3.0" metadata-complete="true">
+
+ <description>WS Federation Simple Web Application Example</description>
+ <display-name>WS Federation Simple Web Application Example</display-name>
+
+ <!-- Optional: Cache the security token in Thread Local Storage -->
+ <filter>
+ <filter-name>FederationFilter</filter-name>
+ <filter-class>org.apache.cxf.fediz.core.servlet.FederationFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>FederationFilter</filter-name>
+ <url-pattern>/secure/*</url-pattern>
+ </filter-mapping>
+
+ <!--
+ This is a CXF Servlet
+ If you do not work with CXF JAX-RS:
+ Use Jersey or RestEasy specific Servlet
+ -->
+ <servlet>
+ <servlet-name>FederationServlet</servlet-name>
+ <servlet-class>org.apache.cxf.jaxrs.servlet.CXFNonSpringJaxrsServlet</servlet-class>
+ <!--
+ All JAX-RS 2.0 implementation servlets will accept 'javax.ws.rs.Application' init parameters
+ -->
+ <init-param>
+ <param-name>javax.ws.rs.Application</param-name>
+ <param-value>org.apache.cxf.fediz.example.FederationApplication</param-value>
+ </init-param>
+ </servlet>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/admin/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/user/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/manager/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <security-role>
+ <role-name>Manager</role-name>
+ </security-role>
+ <security-role>
+ <role-name>User</role-name>
+ </security-role>
+ <security-role>
+ <role-name>Admin</role-name>
+ </security-role>
+ <security-role>
+ <role-name>Authenticated</role-name>
+ </security-role>
+
+ <security-constraint>
+ <web-resource-collection>
+ <web-resource-name>Protected Area</web-resource-name>
+ <url-pattern>/secure/*</url-pattern>
+ </web-resource-collection>
+ <auth-constraint>
+ <role-name>*</role-name>
+ </auth-constraint>
+ </security-constraint>
+
+ <security-constraint>
+ <web-resource-collection>
+ <web-resource-name>Protected Admin Area</web-resource-name>
+ <url-pattern>/secure/admin/*</url-pattern>
+ </web-resource-collection>
+ <auth-constraint>
+ <role-name>Admin</role-name>
+ </auth-constraint>
+ </security-constraint>
+
+ <security-constraint>
+ <web-resource-collection>
+ <web-resource-name>Protected Manager Area</web-resource-name>
+ <url-pattern>/secure/manager/*</url-pattern>
+ </web-resource-collection>
+ <auth-constraint>
+ <role-name>Manager</role-name>
+ </auth-constraint>
+ </security-constraint>
+
+ <security-constraint>
+ <web-resource-collection>
+ <web-resource-name>Protected User Area</web-resource-name>
+ <url-pattern>/secure/user/*</url-pattern>
+ </web-resource-collection>
+ <auth-constraint>
+ <role-name>User</role-name>
+ <role-name>Admin</role-name>
+ <role-name>Manager</role-name>
+ </auth-constraint>
+ </security-constraint>
+
+ <login-config>
+ <auth-method>WSFED</auth-method>
+ <realm-name>WSFED</realm-name>
+ </login-config>
+
+</web-app>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/webapp/index.html
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/webapp/index.html b/examples/jaxrsSimpleWebapp/src/main/webapp/index.html
new file mode 100644
index 0000000..1a1ef1d
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/webapp/index.html
@@ -0,0 +1,25 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML><HEAD><TITLE>WS Federation Tomcat Examples</TITLE>
+<META http-equiv=Content-Type content="text/html">
+</HEAD>
+<BODY>
+<P>
+<H3>Hello World</H3>
+<P></P>
+</BODY></HTML>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSimpleWebapp/src/main/webapp/secure/test.html
----------------------------------------------------------------------
diff --git a/examples/jaxrsSimpleWebapp/src/main/webapp/secure/test.html b/examples/jaxrsSimpleWebapp/src/main/webapp/secure/test.html
new file mode 100644
index 0000000..042ed67
--- /dev/null
+++ b/examples/jaxrsSimpleWebapp/src/main/webapp/secure/test.html
@@ -0,0 +1,25 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML><HEAD><TITLE>WS Federation Tomcat Examples</TITLE>
+<META http-equiv=Content-Type content="text/html">
+</HEAD>
+<BODY>
+<P>
+<H3>Secure Test</H3>
+<P></P>
+</BODY></HTML>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/README.txt
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/README.txt b/examples/jaxrsSpringSecurityWebapp/README.txt
new file mode 100644
index 0000000..8850742
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/README.txt
@@ -0,0 +1,74 @@
+JAX-RS Spring Security Web Application Demo
+==================================
+
+This demo shows how to build and deploy an SSO protected JAX-RS web application
+using Apache CXF Fediz and Spring Security.
+
+The demo uses Apache CXF CXFServlet and CXF JAX-RS Endpoint Spring declarations.
+If you work with Jersey or RESTEasy - please replace CXF specific Servlet and Spring declarations with your preferred JAX-RS implementation's Servlet and Spring declarations. The application code
+is a portable JAX-RS code.
+
+Running this sample consists of four steps:
+
+- Configure the Tomcat-IDP and Servlet Container for RP instances
+- Building the demo using Maven
+- Deploying the demo to the RP instance
+- Testing the demo
+
+Please review the README in the samples main directory before continuing.
+
+Configure the Tomcat-IDP and Servlet Container for RP instances
+---------------------------------------------------------------
+First, make sure the separate Tomcat instance hosting the Fediz IDP and IDP
+STS has been configured and is running as described here:
+http://cxf.apache.org/fediz-idp.html. Confirm the STS is active by
+checking that the WSDL is viewable from the browser using the URL given
+on that page--don't proceed further unless it is.
+
+
+Demo Web Application
+--------------------
+The main code lives in the class FederationService. This JAX-RS Service is protected
+and can be accessed only if the browser user is authenticated. The purpose of
+the FederationService is to illustrate the usage of the Java Servlet Security
+API to get the authenticated user and to check the roles he has. Further,
+the FederationService shows how to access claims data (user data) which were
+stored in the SAML token by using the Fediz interface FedizPrincipal.
+Beyond that, the FederationService illustrates how to access the SAML token
+if required. The classes SecurityTokenThreadLocal.java and FederationFilter.java
+can be used to achieve that. You could get this information directly from the
+HTTP session.
+
+
+Building the demo using Maven
+-----------------------------
+From the base directory of this sample (i.e., where this README file is
+located), the pom.xml file is used to build and run the demo. From a
+command prompt, enter:
+
+ mvn clean install (builds the demo and creates a WAR file for Servlet deployment)
+
+
+Deploying the demo to Tomcat
+----------------------------
+Either manually copy this sample's generated WAR file to the Tomcat-RP's
+webapps folder, or use the Tomcat Maven Plugin as described in the README file
+in the example folder root.
+It's recommended to not deploy this WAR into Servlet Container where Fediz is
+integrated into the Security Layer of the Container itself.
+
+
+Test the demo
+-------------
+Enter the following URL into the browser (TCP port depends on your HTTP settings):
+
+https://localhost:10443/fedizhelloworld/secure/fedservlet
+
+The browser is redirected to the IDP and prompts for username and password. As described
+in the IDP installation, the following users are already set up:
+
+User: alice Password: ecila
+User: bob Password: bob
+User: ted Password: det
+
+
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/pom.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/pom.xml b/examples/jaxrsSpringSecurityWebapp/pom.xml
new file mode 100644
index 0000000..7d467d4
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/pom.xml
@@ -0,0 +1,151 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache.cxf.fediz</groupId>
+ <artifactId>examples</artifactId>
+ <version>1.3.0-SNAPSHOT</version>
+ </parent>
+ <groupId>org.apache.cxf.fediz.examples</groupId>
+ <artifactId>jaxrsSpringSecurityWebapp</artifactId>
+ <name>Fediz Example: SpringWebapp</name>
+ <packaging>war</packaging>
+ <properties>
+ <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+ </properties>
+ <dependencies>
+ <!-- Use an alternative JAX-RS implementation dependencies if you do not work with CXF JAX-RS -->
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+ <version>${cxf.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-log4j12</artifactId>
+ <version>${slf4j.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf.fediz</groupId>
+ <artifactId>fediz-spring</artifactId>
+ <version>${project.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-core</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-context</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-beans</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-web</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-aop</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-asm</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-jdbc</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-tx</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-expression</artifactId>
+ </exclusion>
+ </exclusions>
+
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-web</artifactId>
+ <version>${spring.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-aop</artifactId>
+ <version>${spring.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-expression</artifactId>
+ <version>${spring.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <version>${commons.lang.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ <version>${log4j.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>javax.mail</groupId>
+ <artifactId>mail</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>javax.jms</groupId>
+ <artifactId>jms</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>com.sun.jdmk</groupId>
+ <artifactId>jmxtools</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>com.sun.jmx</groupId>
+ <artifactId>jmxri</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ </dependencies>
+ <build>
+ <plugins>
+ <plugin>
+ <!--for mvn tomcat:deploy/:undeploy/:redeploy -->
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>tomcat-maven-plugin</artifactId>
+ <version>1.1</version>
+ <configuration>
+ <server>myTomcat</server>
+ <url>http://localhost:10080/manager/text</url>
+ <path>/${project.build.finalName}</path>
+ </configuration>
+ </plugin>
+ </plugins>
+ <!-- Name of the generated WAR file -->
+ <finalName>fedizhelloworld</finalName>
+ </build>
+</project>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java b/examples/jaxrsSpringSecurityWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java
new file mode 100644
index 0000000..401fb01
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/java/org/apache/cxf/fediz/example/FederationService.java
@@ -0,0 +1,125 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.example;
+
+import java.io.StringWriter;
+import java.security.Principal;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.ResponseBuilder;
+import javax.ws.rs.core.SecurityContext;
+import javax.ws.rs.core.UriInfo;
+import javax.xml.transform.OutputKeys;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+
+import org.w3c.dom.Element;
+
+import org.apache.commons.lang3.StringEscapeUtils;
+import org.apache.cxf.fediz.core.Claim;
+import org.apache.cxf.fediz.core.ClaimCollection;
+import org.apache.cxf.fediz.core.SecurityTokenThreadLocal;
+import org.apache.cxf.fediz.spring.FederationUser;
+import org.apache.cxf.fediz.spring.authentication.FederationAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+
+
+@Path("/")
+public class FederationService {
+
+ @GET
+ public Response get(@Context UriInfo uriInfo,
+ @Context SecurityContext securityContext) {
+
+ ResponseBuilder rb = Response.ok().type("text/html");
+
+ StringBuilder out = new StringBuilder();
+ out.append("<html>");
+ out.append("<head><title>WS Federation Spring Security Example</title></head>");
+ out.append("<body>");
+ out.append("<h1>Hello World</h1>");
+ out.append("Hello world<br>");
+ out.append("Request url: " + uriInfo.getAbsolutePath().toString() + "<p>");
+
+ out.append("<br><b>User</b><p>");
+ Principal p = securityContext.getUserPrincipal();
+ if (p != null) {
+ out.append("Principal: " + p.getName() + "<p>");
+ }
+
+ // Access Spring security context
+ Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+ if (auth instanceof FederationAuthenticationToken) {
+ out.append("Roles of user:<p><ul>");
+ FederationAuthenticationToken fedAuthToken = (FederationAuthenticationToken) auth;
+ for (GrantedAuthority item : fedAuthToken.getAuthorities()) {
+ out.append("<li>" + item.getAuthority() + "</li>");
+ }
+ out.append("</ul>");
+
+ if (fedAuthToken.getUserDetails() instanceof FederationUser) {
+ out.append("<br><b>Claims</b><p>");
+ ClaimCollection claims = ((FederationUser) fedAuthToken.getUserDetails()).getClaims();
+ for (Claim c : claims) {
+ out.append(c.getClaimType().toString() + ": " + c.getValue() + "<p>");
+ }
+ } else {
+ out.append("FederationAuthenticationToken found but not FederationUser");
+ }
+
+ } else {
+ out.append("No FederationAuthenticationToken found in Spring Security Context.");
+ }
+
+ Element el = SecurityTokenThreadLocal.getToken();
+ if (el != null) {
+ out.append("<p>Bootstrap token...");
+ String token = null;
+ try {
+ TransformerFactory transFactory = TransformerFactory.newInstance();
+ Transformer transformer = transFactory.newTransformer();
+ StringWriter buffer = new StringWriter();
+ transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
+ transformer.transform(new DOMSource(el), new StreamResult(buffer));
+ token = buffer.toString();
+ @SuppressWarnings("deprecation")
+ String escapedXml = StringEscapeUtils.escapeXml(token);
+ out.append("<p>" + escapedXml);
+ } catch (Exception ex) {
+ out.append("<p>Failed to transform cached element to string: " + ex.toString());
+ }
+ } else {
+ out.append("<p>Bootstrap token not cached in thread local storage");
+ }
+
+ out.append("</body>");
+
+ return rb.entity(out.toString()).build();
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/resources/log4j.properties
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/resources/log4j.properties b/examples/jaxrsSpringSecurityWebapp/src/main/resources/log4j.properties
new file mode 100644
index 0000000..e16244a
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/resources/log4j.properties
@@ -0,0 +1,22 @@
+# Set root category priority to INFO and its only appender to CONSOLE.
+log4j.rootLogger=INFO, CONSOLE
+log4j.logger.org.springframework=INFO, CONSOLE
+log4j.additivity.org.springframework=false
+log4j.logger.org.springframework.security=DEBUG, CONSOLE
+log4j.additivity.org.springframework.security=false
+log4j.logger.org.apache.cxf.fediz=DEBUG, CONSOLE
+log4j.additivity.org.apache.cxf.fediz=false
+
+# CONSOLE is set to be a ConsoleAppender using a PatternLayout.
+log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
+log4j.appender.CONSOLE.Threshold=DEBUG
+log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
+log4j.appender.CONSOLE.layout.ConversionPattern=%d [%t] %-5p %c %x - %m%n
+
+# LOGFILE is set to be a File appender using a PatternLayout.
+log4j.appender.LOGFILE=org.apache.log4j.FileAppender
+log4j.appender.LOGFILE.File=fedizhelloworld.log
+log4j.appender.LOGFILE.Append=false
+log4j.appender.LOGFILE.Threshold=DEBUG
+log4j.appender.LOGFILE.layout=org.apache.log4j.PatternLayout
+log4j.appender.LOGFILE.layout.ConversionPattern=%d [%t] %-5p %c %x - %m%n
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/resources/ststrust.jks
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/resources/ststrust.jks b/examples/jaxrsSpringSecurityWebapp/src/main/resources/ststrust.jks
new file mode 100644
index 0000000..ef5a844
Binary files /dev/null and b/examples/jaxrsSpringSecurityWebapp/src/main/resources/ststrust.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/applicationContext-security.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/applicationContext-security.xml b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/applicationContext-security.xml
new file mode 100644
index 0000000..fd3d4b5
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:sec="http://www.springframework.org/schema/security"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:jaxrs="http://cxf.apache.org/jaxrs"
+ xsi:schemaLocation="
+ http://www.springframework.org/schema/security
+ http://www.springframework.org/schema/security/spring-security-3.1.xsd
+ http://www.springframework.org/schema/beans
+ http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+ http://www.springframework.org/schema/util
+ http://www.springframework.org/schema/util/spring-util-3.0.xsd
+ http://www.springframework.org/schema/context
+ http://www.springframework.org/schema/context/spring-context-3.0.xsd
+ http://cxf.apache.org/jaxrs
+ http://cxf.apache.org/schemas/jaxrs.xsd">
+
+ <!--
+ This is a CXF JAX-RS Spring endpoint
+ If you do not work with CXF JAX-RS:
+ Use Jersey or RestEasy specific Spring integration mechanism to activate a JAX-RS endpoint
+ -->
+ <jaxrs:server address="/">
+ <jaxrs:serviceBeans>
+ <bean class="org.apache.cxf.fediz.example.FederationService"/>
+ </jaxrs:serviceBeans>
+ </jaxrs:server>
+
+ <!-- DISABLE in production as it might log confidential information about
+ the user -->
+ <sec:debug />
+
+ <sec:http entry-point-ref="federationEntryPoint"
+ use-expressions="true">
+ <sec:intercept-url pattern="/" access="permitAll" />
+ <sec:intercept-url pattern="/fediz" access="permitAll" />
+ <sec:intercept-url pattern="/index.html" access="permitAll" />
+ <sec:intercept-url pattern="/secure/fedservlet" access="isAuthenticated()" />
+ <sec:intercept-url pattern="/secure/manager/**" access="hasRole('ROLE_MANAGER')" />
+ <sec:intercept-url pattern="/secure/admin/**" access="hasRole('ROLE_ADMIN')" />
+ <sec:intercept-url pattern="/secure/user/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN','ROLE_MANAGER')" />
+ <sec:custom-filter ref="federationFilter" after="BASIC_AUTH_FILTER" />
+ <sec:session-management session-authentication-strategy-ref="sas" />
+ </sec:http>
+
+
+ <sec:authentication-manager alias="authManager">
+ <sec:authentication-provider ref="federationAuthProvider" />
+ </sec:authentication-manager>
+
+ <bean id="fedizConfig" class="org.apache.cxf.fediz.spring.FederationConfigImpl"
+ init-method="init" p:configFile="WEB-INF/fediz_config.xml" />
+
+ <bean id="federationEntryPoint"
+ class="org.apache.cxf.fediz.spring.web.FederationAuthenticationEntryPoint"
+ p:federationConfig-ref="fedizConfig" />
+
+ <bean id="federationFilter"
+ class="org.apache.cxf.fediz.spring.web.FederationAuthenticationFilter"
+ p:authenticationManager-ref="authManager">
+
+ <property name="authenticationFailureHandler">
+ <bean
+ class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler" />
+ </property>
+ </bean>
+
+ <bean id="federationAuthProvider"
+ class="org.apache.cxf.fediz.spring.authentication.FederationAuthenticationProvider"
+ p:federationConfig-ref="fedizConfig">
+ <property name="authenticationUserDetailsService">
+ <bean
+ class="org.apache.cxf.fediz.spring.authentication.GrantedAuthoritiesUserDetailsFederationService" />
+ </property>
+ </bean>
+
+ <bean id="sas"
+ class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy" />
+</beans>
+
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/fediz_config.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/fediz_config.xml b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/fediz_config.xml
new file mode 100644
index 0000000..529b645
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/fediz_config.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<!-- Place in Tomcat conf folder or other location as designated in this sample's file.
+ Keystore referenced below must have IDP STS' public cert included in it. This example uses the
+ ststrust Truststore (ststrust.jks) for this task.
+ In Fediz 1.0, one keystore was used for SSL and the STS public certificate.
+-->
+<FedizConfig>
+ <contextConfig name="/fedizhelloworld">
+ <audienceUris>
+ <audienceItem>urn:org:apache:cxf:fediz:fedizhelloworld</audienceItem>
+ </audienceUris>
+ <certificateStores>
+ <trustManager>
+ <keyStore file="ststrust.jks" password="storepass"
+ type="JKS" />
+ </trustManager>
+ </certificateStores>
+ <trustedIssuers>
+ <issuer certificateValidation="PeerTrust" />
+ </trustedIssuers>
+ <maximumClockSkew>1000</maximumClockSkew>
+ <protocol xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:type="federationProtocolType" version="1.0.0">
+ <realm>urn:org:apache:cxf:fediz:fedizhelloworld</realm>
+ <issuer>https://localhost:8443/fediz-idp/federation</issuer>
+ <roleDelimiter>,</roleDelimiter>
+ <roleURI>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role</roleURI>
+ <reply>/j_spring_fediz_security_check</reply>
+ <claimTypesRequested>
+ <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role" optional="false" />
+ <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" optional="true" />
+ <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" optional="true" />
+ <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" optional="true" />
+ </claimTypesRequested>
+ </protocol>
+ </contextConfig>
+</FedizConfig>
+
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/web.xml
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/web.xml b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/web.xml
new file mode 100644
index 0000000..e147017
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/WEB-INF/web.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+ version="3.0" metadata-complete="true">
+
+ <description>WS Federation Spring Example</description>
+ <display-name>WS Federation Spring Example</display-name>
+
+ <filter>
+ <filter-name>springSecurityFilterChain</filter-name>
+ <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
+ </filter>
+
+ <!-- Optional: Cache the security token in Thread Local Storage -->
+ <filter>
+ <filter-name>FederationFilter</filter-name>
+ <filter-class>org.apache.cxf.fediz.core.servlet.FederationFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>springSecurityFilterChain</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter-mapping>
+ <filter-name>FederationFilter</filter-name>
+ <url-pattern>/secure/*</url-pattern>
+ </filter-mapping>
+
+ <context-param>
+ <param-name>contextConfigLocation</param-name>
+ <param-value>/WEB-INF/applicationContext-security.xml</param-value>
+ </context-param>
+
+ <listener>
+ <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
+ </listener>
+
+ <!--
+ This is a CXF Servlet
+ If you do not work with CXF JAX-RS:
+ Use Jersey or RestEasy specific Servlet
+ -->
+ <servlet>
+ <servlet-name>FederationServlet</servlet-name>
+ <servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
+ </servlet>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/admin/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/user/fedservlet</url-pattern>
+ </servlet-mapping>
+
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/secure/manager/fedservlet</url-pattern>
+ </servlet-mapping>
+
+</web-app>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/webapp/index.html
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/webapp/index.html b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/index.html
new file mode 100644
index 0000000..1a1ef1d
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/index.html
@@ -0,0 +1,25 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML><HEAD><TITLE>WS Federation Tomcat Examples</TITLE>
+<META http-equiv=Content-Type content="text/html">
+</HEAD>
+<BODY>
+<P>
+<H3>Hello World</H3>
+<P></P>
+</BODY></HTML>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/jaxrsSpringSecurityWebapp/src/main/webapp/secure/test.html
----------------------------------------------------------------------
diff --git a/examples/jaxrsSpringSecurityWebapp/src/main/webapp/secure/test.html b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/secure/test.html
new file mode 100644
index 0000000..042ed67
--- /dev/null
+++ b/examples/jaxrsSpringSecurityWebapp/src/main/webapp/secure/test.html
@@ -0,0 +1,25 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML><HEAD><TITLE>WS Federation Tomcat Examples</TITLE>
+<META http-equiv=Content-Type content="text/html">
+</HEAD>
+<BODY>
+<P>
+<H3>Secure Test</H3>
+<P></P>
+</BODY></HTML>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c875b8ad/examples/pom.xml
----------------------------------------------------------------------
diff --git a/examples/pom.xml b/examples/pom.xml
index 6c6b939..e6c6490 100644
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -37,6 +37,8 @@
<module>springWebapp</module>
<module>spring2Webapp</module>
<module>springPreauthWebapp</module>
+ <module>jaxrsSimpleWebapp</module>
+ <module>jaxrsSpringSecurityWebapp</module>
</modules>
<profiles>