You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by bu...@apache.org on 2018/08/16 10:57:49 UTC
svn commit: r1034032 - in /websites/production/cxf/content:
cache/main.pageCache fediz-cxf.html fediz-websphere.html fediz.html
Author: buildbot
Date: Thu Aug 16 10:57:49 2018
New Revision: 1034032
Log:
Production update by buildbot for cxf
Modified:
websites/production/cxf/content/cache/main.pageCache
websites/production/cxf/content/fediz-cxf.html
websites/production/cxf/content/fediz-websphere.html
websites/production/cxf/content/fediz.html
Modified: websites/production/cxf/content/cache/main.pageCache
==============================================================================
Binary files - no diff available.
Modified: websites/production/cxf/content/fediz-cxf.html
==============================================================================
--- websites/production/cxf/content/fediz-cxf.html (original)
+++ websites/production/cxf/content/fediz-cxf.html Thu Aug 16 10:57:49 2018
@@ -110,14 +110,13 @@ Apache CXF -- Fediz CXF
<td height="100%">
<!-- Content -->
<div class="wiki-content">
-<div id="ConfluenceContent"><h1 id="FedizCXF-CXFPlugin(1.1/1.2)">CXF Plugin (1.1/1.2)</h1><p>The Fediz plugin for CXF contains two separate pieces of functionality. The first is a CallbackHandler that allows the SAML Token of the Web SSO session to be used by the CXF Web Services Stack, i.e. for delegation (available since 1.1). The second is a full WS-Federation RP plugin based solely on Apache CXF JAX-RS, which is container independent (available since 1.2.0).</p><h2 id="FedizCXF-CXFPluginsupportforWS-Federation">CXF Plugin support for WS-Federation</h2><p>The new CXF plugin for WS-Federation available from Fediz 1.2.0 means that it is now possible to add support for WS-Federation to your JAX-RS CXF service without having to specify a container-specific plugin. Here is an example Spring based configuration:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>CXF spring configuration</b></div><div cl
ass="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;"><bean id="serviceBean" class="org.apache.cxf.fediz.example.Service">
+<div id="ConfluenceContent"><h1 id="FedizCXF-CXFPlugin">CXF Plugin</h1><p>The Apache CXF Fediz plugin for an Apache CXF web service contains two separate pieces of functionality. The first is a CallbackHandler that allows the SAML Token of the Web SSO session to be used by the CXF Web Services Stack, i.e. for delegation (available since 1.1). The second is a full WS-Federation RP plugin based solely on Apache CXF JAX-RS, which is container independent (available since 1.2.0).</p><h2 id="FedizCXF-CXFPluginsupportforWS-Federation">CXF Plugin support for WS-Federation</h2><p>The new CXF plugin for WS-Federation available from Fediz 1.2.0 means that it is now possible to add support for WS-Federation to your JAX-RS CXF service without having to specify a container-specific plugin. Here is an example Spring based configuration:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>CXF spring configuration</b
></div><div class="codeContent panelContent pdl">
+<pre class="brush: java; gutter: false; theme: Default"><bean id="serviceBean" class="org.apache.cxf.fediz.example.Service">
</bean>
<bean id="fedizFilter" class="org.apache.cxf.fediz.cxf.plugin.FedizRedirectBindingFilter">
<property name="configFile" value="fediz_config.xml"/>
</bean>
-
<bean id="authorizationInterceptor"
class="org.apache.cxf.interceptor.security.SecureAnnotationsInterceptor">
@@ -137,7 +136,7 @@ Apache CXF -- Fediz CXF
</jaxrs:inInterceptors>
</jaxrs:server></pre>
</div></div><p>Here we have a JAX-RS service which is secured via the SecureAnnotationsInterceptor. For example:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>CXF Service Bean</b></div><div class="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;">@Path("/secure/")
+<pre class="brush: java; gutter: false; theme: Default">@Path("/secure/")
@Produces("text/html")
public class Service {
@Context
@@ -152,14 +151,14 @@ public class Service {
...
}</pre>
</div></div><p>The FedizRedirectBindingFilter is instantiated with a link to the Fediz plugin configuration and is added as a JAX-RS provider.</p><h2 id="FedizCXF-DelegationScenario">Delegation Scenario</h2><p>The subproject Fediz purpose is to provide Single Sign On for Web Applications which is independent of an underlying Web Services framework like Apache CXF. The Fediz plugins for Tomcat, Jetty, etc. are independent of Apache CXF, whereas the Fediz IDP leverages the capabilities of the CXF STS to issue SAML tokens with Claims information to build applications which use Claims Based Authorization with all the benefits.</p><p>If the Fediz protected web application integrates with another application using Web Services you need to bundle a Web Services framework like Apache CXF with your web application. If it is required to support impersonation to call the Web Service, the security context of the application server must be delegated to the Web Services stack thus it can make the
Web Service call on behalf of the browser user.</p><p>In release 1.1, the Fediz CXF plugin supports delegating the application server security context (SAML token) to the STS client of CXF. CXF is then able to request a security token for the target Web Service from the STS on behalf of the browser user. Prior to release 1.1, this Java code had to be developed by the application developer.</p><p>It is required that one of the other Fediz plugins are deployed to WS-Federation enable the application. After this step, the Fediz CXF plugin can be installed to integrate the Web SSO layer with the Web Services stack of Apache CXF.</p><h3 id="FedizCXF-Installation">Installation</h3><p>It's recommended to use Maven to resolve the dependencies as illustrated in the the example <code>wsclientWebapp</code>.</p><div class="code panel pdl" style="border-style: solid;border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;border-bottom-style: solid;"><b>pom.xm
l</b></div><div class="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;"> <dependency>
+<pre class="brush: java; gutter: false; theme: Default"> <dependency>
<groupId>org.apache.cxf.fediz</groupId>
<artifactId>fediz-cxf</artifactId>
- <version>1.1.0</version>
+ <version>1.4.5</version>
</dependency>
</pre>
</div></div><p>The example contains a README with instructions for building and deployment.</p><h3 id="FedizCXF-Configuration">Configuration</h3><p>Two configurations are required in <code>web.xml</code> to enable the <code>FederationFilter</code> to cache the security context in the thread local storage and in the spring configuration file <code>applicationContext.xml</code> to configure a callback handler to provide the STS client the security context stored in the thread local storage.</p><div class="code panel pdl" style="border-style: solid;border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;border-bottom-style: solid;"><b>web.xml</b></div><div class="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;"> <filter>
+<pre class="brush: java; gutter: false; theme: Default"> <filter>
<filter-name>FederationFilter</filter-name>
<filter-class>org.apache.cxf.fediz.core.servlet.FederationFilter</filter-class>
</filter>
@@ -170,7 +169,7 @@ public class Service {
</filter-mapping>
</pre>
</div></div><p>The <code>FederationFilter</code> is part of the library <code>fediz-core</code>.</p><div class="code panel pdl" style="border-style: solid;border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;border-bottom-style: solid;"><b>applicationContext.xml</b></div><div class="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;"> <bean id="delegationCallbackHandler"
+<pre class="brush: java; gutter: false; theme: Default"> <bean id="delegationCallbackHandler"
class="org.apache.cxf.fediz.cxf.web.ThreadLocalCallbackHandler" />
<jaxws:client id="HelloServiceClient" serviceName="svc:GreeterService"
@@ -190,7 +189,7 @@ public class Service {
</pre>
</div></div><p>The <code>ThreadLocalCallbackHandler</code> is part of the library <code>fediz-cxf</code>.</p><p>If you have set the property <code>ws-security.cache.issued.token.in.endpoint</code> to false, CXF will cache the issued token per security context dependent on the returned lifetime element of the STS. When the cached token for the target web services is expired, CXF will request a new token from the STS on-behalf-of the cached Fediz security context.</p><p>There is no special Java code required to get this functionality as illustrated in the following code snippet:</p><div class="code panel pdl" style="border-style: solid;border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;border-bottom-style: solid;"><b>FederationServlet.java</b></div><div class="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;"> Greeter service = (Greeter)ApplicationContextProvider.getContext().getBean("HelloServiceClient");
+<pre class="brush: java; gutter: false; theme: Default"> Greeter service = (Greeter)ApplicationContextProvider.getContext().getBean("HelloServiceClient");
String reply = service.greetMe();
</pre>
</div></div></div>
Modified: websites/production/cxf/content/fediz-websphere.html
==============================================================================
--- websites/production/cxf/content/fediz-websphere.html (original)
+++ websites/production/cxf/content/fediz-websphere.html Thu Aug 16 10:57:49 2018
@@ -109,75 +109,8 @@ Apache CXF -- Fediz Websphere
<td height="100%">
<!-- Content -->
<div class="wiki-content">
-<div id="ConfluenceContent"><h1 id="FedizWebsphere-IBMWebspherePlugin">IBM Websphere Plugin</h1>
-<p>This page describes how to enable Federation for a IBM Websphere Application Server (WAS) instance hosting Relying Party (RP) applications. This configuration is not for a Websphere instance hosting the Fediz IDP and IDP STS WARs but for applications that use SAML assertions for authentication. After this configuration is done, the Websphere-RP instance will validate the incoming SignInResponse created by the IDP server.</p>
-
-<p>Prior to doing this configuration, make sure you've first deployed the Fediz IDP and STS on the separate Servlet Container instance as discussed <a shape="rect" href="fediz-idp.html">here</a>, and can view the STS WSDL at the URL given on that page. That page also provides some tips for running multiple Tomcat instances on your machine.</p>
-
-<h3 id="FedizWebsphere-WebsphereSecurity">Websphere Security</h3>
-
-<p>A <strong>Trust Authentication Interceptor (TAI)</strong> is a pluggable security component that is installed and configured at the IBM WebSphere Application Cell level. As such, any managed server on the Cell will have this component installed in and activated once defined in the WAS Security configuration.<br clear="none">
-A TAI implements the WAS specific interface <code>com.ibm.wsspi.security.tai.TrustAssociationInterceptor</code>. The WAS specific API for security layer customization is explained in details at the following:</p>
-
-<p><a shape="rect" class="external-link" href="http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.base.doc%2Finfo%2Faes%2Fae%2Frsec_taisubcreate.html" rel="nofollow">http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.base.doc%2Finfo%2Faes%2Fae%2Frsec_taisubcreate.html</a></p>
-
-<p>The Fediz Plugin for Websphere provides a TAI implementation which leverages the <strong>Fediz Core</strong>.</p>
-
-<p>WAS security runtime supports a notion of a security session using a specific security token called <em>LTPA Token</em> which is implemented as a HTTP cookie. The cookie lifetime is specified at the WAS administrative <em>Cell</em> level, which implies that it is not possible to configure this value per request based on the requirements for an application.<br clear="none">
-The TAI is no more involved after login once the LTPA Token is set which means a Web Application level component must intercept each request to check the security token (ex. SAML) lifetime and redirect the browser back to the IDP for re-authentication.<br clear="none">
-The Fediz Plugin Websphere ships a Java Servlet Filter which enforces the validity of the lifetime of the security token. This Servlet Filter must be configured in each Web Application module <code>web.xml</code> that is deployed on WAS.</p>
-
-<h3 id="FedizWebsphere-BuildFedizWebsphereLibrary">Build Fediz Websphere Library</h3>
-
-<p>You have to build the Fediz plugin on your own as it depends on IBM Websphere libraries.</p>
-
-<ul><li>Build the Websphere sources packaged within the downloadable <a shape="rect" href="fediz-downloads.html">distribution archive</a> or checkout the Fediz sources <a shape="rect" href="fediz.html">here</a></li></ul>
-
-
-<ul><li>Add the library <code>runtime.jar</code> of IBM Rational Application Developer to your Maven repository<br clear="none">
-<code>mvn install:install-file -Dfile=<path-to-file> -DgroupId=com.ibm.ws -DartifactId=runtime -Dversion=7 -Dpackaging=jar</code></li></ul>
-
-
-<ul><li>run the maven command<br clear="none">
-<code>mvn clean install -Pwebsphere</code><br clear="none">
-The Maven profile <code>websphere</code> enforces building the module <code>plugins/websphere</code>.</li></ul>
-
-
-<ul><li>You'll find the required libraries in <code>plugins/websphere/target/...zip-with-dependencies.zip</code></li></ul>
-
-
-<h3 id="FedizWebsphere-Installation">Installation</h3>
-
-<h5 id="FedizWebsphere-Pre-Requisites">Pre-Requisites</h5>
-
-<p>The Administrative and Application security must be activated for the WAS security layer to be able to intercept secured resources access requests. The local User Registry must be properly configured and at least one group of users must be declared in the registry prior any application installation.<br clear="none">
-At runtime, the WAS security layer will use the defined User/Group registry and the Fediz plugin maps the roles in the SAML token to WAS groups from this registry using the specified <em>Role to Group</em> mapper.<br clear="none">
-At deployment time, the declared J2EE security roles will need to be mapped to these groups, either using the Administrative Console or using the WAS binding files.</p>
-
-<h5 id="FedizWebsphere-PluginInstallation">Plugin Installation</h5>
-
-<p>The Fediz Websphere plugin and its dependencies must be copied in the <code>WAS_INSTALL_ROOT>/lib/ext</code> directory of WebSphere Application Server, on each configured Node of the Cell (including the Deployment Manager)</p>
-
-<p>The Fediz configuration file (ex. <code>fediz-config.xml</code>) and the configured truststore should be copied in a directory with read permission for the WAS runtime user, on each configured Node of the Cell (including the Deployment Manager).<br clear="none">
-<em>Note:</em> Using a shared filesystem is recommended.</p>
-
-<h5 id="FedizWebsphere-WebApplicationconfiguration">Web Application configuration</h5>
-
-<ol><li>Open the Administative Console with Administrator privileges and navigate to Security / Global security</li><li>Ensure Application security is enabled<br clear="none">
- <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/GlobalSec.png"></span></li><li>Navigate to <em>Security / Global security / Web and SIP security</em> and select <strong>Trust association</strong><br clear="none">
- <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/trust-association.png"></span></li><li>Check the <strong>Enable trust association</strong> check box</li><li>Select Interceptors<br clear="none">
- <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/enable-trust-assoc.png"></span></li><li>Click on New and specify the Interceptor class name as <code>org.apache.cxf.fediz.was.tai.FedizInterceptor</code><br clear="none">
- <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/create-interceptor.png"></span></li></ol>
-
-
-<div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Property </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>config.file.location </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the path to the fediz-config.xml file</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>role.group.mapper </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the class of the Role to Group Mapper<br clear="none">
-<code>org.apache.cxf.fediz.was.mapper.FileBasedRoleToGroupMapper</code></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>groups.mapping.file </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the path to the Role - Group mapping file</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>groups.mapping.refresh.timeout </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the refresh time (in sec) to reload the Group mapping file</p></td></tr></tbody></table></div>
-
-
-<p>The file defined in <code>groups.mapping.file</code> must have the following structure:</p>
-
-<div class="code panel pdl" style="border-style: solid;border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;border-bottom-style: solid;"><b>roleGroupMapping.xml</b></div><div class="codeContent panelContent pdl">
-<pre class="brush: java; gutter: false; theme: Default" style="font-size:12px;">
+<div id="ConfluenceContent"><h1 id="FedizWebsphere-IBMWebspherePlugin">IBM Websphere Plugin</h1><p>Apache CXF Fediz ships a plugin to secure an IBM Websphere 7/8 Application Server using WS-Federation.</p><p>This page describes how to enable Federation for a IBM Websphere Application Server (WAS) instance hosting Relying Party (RP) applications. This configuration is not for a Websphere instance hosting the Fediz IDP and IDP STS WARs but for applications that use SAML assertions for authentication. After this configuration is done, the Websphere-RP instance will validate the incoming SignInResponse created by the IDP server.</p><p>Prior to doing this configuration, make sure you've first deployed the Fediz IDP and STS on the separate Servlet Container instance as discussed <a shape="rect" href="fediz-idp-10.html">here</a>, and can view the STS WSDL at the URL given on that page. That page also provides some tips for running multiple Tomcat instances on your machine.</p><h3 id="Fediz
Websphere-WebsphereSecurity">Websphere Security</h3><p>A <strong>Trust Authentication Interceptor (TAI)</strong> is a pluggable security component that is installed and configured at the IBM WebSphere Application Cell level. As such, any managed server on the Cell will have this component installed in and activated once defined in the WAS Security configuration.<br clear="none"> A TAI implements the WAS specific interface <code>com.ibm.wsspi.security.tai.TrustAssociationInterceptor</code>. The WAS specific API for security layer customization is explained in details at the following:</p><p><a shape="rect" class="external-link" href="http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.base.doc%2Finfo%2Faes%2Fae%2Frsec_taisubcreate.html" rel="nofollow">http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.base.doc%2Finfo%2Faes%2Fae%2Frsec_taisubcreate.html</a></p><p>The Fediz Plugin for Websphere provides a TAI implementati
on which leverages the <strong>Fediz Core</strong>.</p><p>WAS security runtime supports a notion of a security session using a specific security token called <em>LTPA Token</em> which is implemented as a HTTP cookie. The cookie lifetime is specified at the WAS administrative <em>Cell</em> level, which implies that it is not possible to configure this value per request based on the requirements for an application.<br clear="none"> The TAI is no more involved after login once the LTPA Token is set which means a Web Application level component must intercept each request to check the security token (ex. SAML) lifetime and redirect the browser back to the IDP for re-authentication.<br clear="none"> The Fediz Plugin Websphere ships a Java Servlet Filter which enforces the validity of the lifetime of the security token. This Servlet Filter must be configured in each Web Application module <code>web.xml</code> that is deployed on WAS.</p><h3 id="FedizWebsphere-BuildFedizWebsphereLibrary">B
uild Fediz Websphere Library</h3><p>You have to build the Fediz plugin on your own as it depends on IBM Websphere libraries.</p><ul><li>Build the Websphere sources packaged within the downloadable <a shape="rect" href="fediz-downloads.html">distribution archive</a> or checkout the Fediz sources <a shape="rect" href="fediz.html">here</a></li></ul><ul><li>Add the library <code>runtime.jar</code> of IBM Rational Application Developer to your Maven repository<br clear="none"> <code>mvn install:install-file -Dfile=<path-to-file> -DgroupId=com.ibm.ws -DartifactId=runtime -Dversion=7 -Dpackaging=jar</code></li></ul><ul><li>run the maven command<br clear="none"> <code>mvn clean install -Pwebsphere</code><br clear="none"> The Maven profile <code>websphere</code> enforces building the module <code>plugins/websphere</code>.</li></ul><ul><li>You'll find the required libraries in <code>plugins/websphere/target/...zip-with-dependencies.zip</code></li></ul><h3 id="FedizWebsphere-Installation
">Installation</h3><h5 id="FedizWebsphere-Pre-Requisites">Pre-Requisites</h5><p>The Administrative and Application security must be activated for the WAS security layer to be able to intercept secured resources access requests. The local User Registry must be properly configured and at least one group of users must be declared in the registry prior any application installation.<br clear="none"> At runtime, the WAS security layer will use the defined User/Group registry and the Fediz plugin maps the roles in the SAML token to WAS groups from this registry using the specified <em>Role to Group</em> mapper.<br clear="none"> At deployment time, the declared J2EE security roles will need to be mapped to these groups, either using the Administrative Console or using the WAS binding files.</p><h5 id="FedizWebsphere-PluginInstallation">Plugin Installation</h5><p>The Fediz Websphere plugin and its dependencies must be copied in the <code>WAS_INSTALL_ROOT>/lib/ext</code> directory of WebSp
here Application Server, on each configured Node of the Cell (including the Deployment Manager)</p><p>The Fediz configuration file (ex. <code>fediz-config.xml</code>) and the configured truststore should be copied in a directory with read permission for the WAS runtime user, on each configured Node of the Cell (including the Deployment Manager).<br clear="none"> <em>Note:</em> Using a shared filesystem is recommended.</p><h5 id="FedizWebsphere-WebApplicationconfiguration">Web Application configuration</h5><ol><li>Open the Administative Console with Administrator privileges and navigate to Security / Global security</li><li>Ensure Application security is enabled<br clear="none"> <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/GlobalSec.png"></span></li><li>Navigate to <em>Security / Global security / Web and SIP security</em> and select <strong>T
rust association</strong><br clear="none"> <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/trust-association.png"></span></li><li>Check the <strong>Enable trust association</strong> check box</li><li>Select Interceptors<br clear="none"> <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/enable-trust-assoc.png"></span></li><li>Click on New and specify the Interceptor class name as <code>org.apache.cxf.fediz.was.tai.FedizInterceptor</code><br clear="none"> <span class="confluence-embedded-file-wrapper confluence-embedded-manual-size"><img class="confluence-embedded-image confluence-content-image-border" width="800" src="fediz-websphere.data/create-interceptor.png"></span></li></ol><div class="table-wrap"><table c
lass="wrapped confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Property</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>config.file.location</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the path to the fediz-config.xml file</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>role.group.mapper</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the class of the Role to Group Mapper<br clear="none"> <code>org.apache.cxf.fediz.was.mapper.FileBasedRoleToGroupMapper</code></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>groups.mapping.file</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Specify the path to the Role - Group mapping file</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>groups.mapping.refresh.timeout</p></td><td colspan="1" rowspan="1" class="confluen
ceTd"><p>Specify the refresh time (in sec) to reload the Group mapping file</p></td></tr></tbody></table></div><p>The file defined in <code>groups.mapping.file</code> must have the following structure:</p><div class="code panel pdl" style="border-style: solid;border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;border-bottom-style: solid;"><b>roleGroupMapping.xml</b></div><div class="codeContent panelContent pdl">
+<pre class="brush: java; gutter: false; theme: Default">
<?xml version="1.0" encoding="UTF-8"?>
<mapping>
<samlToJ2EE>
@@ -203,19 +136,7 @@ At deployment time, the declared J2EE se
</samlToJ2EE>
</mapping>
</pre>
-</div></div>
-
-<p>A role value defined in element <code>claim</code> is mapped to a list of the Websphere JEE groups defined in <code>j2eeGroup</code>. Finally, these Websphere groups must be mapped to JEE roles. This indirection is required within Websphere.</p>
-
-
-<h5 id="FedizWebsphere-Fedizconfiguration">Fediz configuration</h5>
-<p>The Fediz related configuration is done in a Servlet Container independent configuration file which is described <a shape="rect" href="fediz-configuration.html">here</a>.</p>
-
-<h3 id="FedizWebsphere-FederationMetadatadocument">Federation Metadata document</h3>
-
-<p>The Webpshere Fediz plugin supports publishing the WS-Federation Metadata document which is described <a shape="rect" href="fediz-metadata.html">here</a>.</p>
-
-</div>
+</div></div><p>A role value defined in element <code>claim</code> is mapped to a list of the Websphere JEE groups defined in <code>j2eeGroup</code>. Finally, these Websphere groups must be mapped to JEE roles. This indirection is required within Websphere.</p><h5 id="FedizWebsphere-Fedizconfiguration">Fediz configuration</h5><p>The Fediz related configuration is done in a Servlet Container independent configuration file which is described <a shape="rect" href="fediz-configuration.html">here</a>.</p><h3 id="FedizWebsphere-FederationMetadatadocument">Federation Metadata document</h3><p>The Webpshere Fediz plugin supports publishing the WS-Federation Metadata document which is described <a shape="rect" href="fediz-metadata.html">here</a>.</p></div>
</div>
<!-- Content -->
</td>
Modified: websites/production/cxf/content/fediz.html
==============================================================================
--- websites/production/cxf/content/fediz.html (original)
+++ websites/production/cxf/content/fediz.html Thu Aug 16 10:57:49 2018
@@ -99,7 +99,7 @@ Apache CXF -- Fediz
<td height="100%">
<!-- Content -->
<div class="wiki-content">
-<div id="ConfluenceContent"><h1 id="Fediz-ApacheCXFFediz:AnOpen-SourceWebSecurityFramework">Apache CXF Fediz: An Open-Source Web Security Framework</h1><h2 id="Fediz-Overview">Overview</h2><p>Apache CXF Fediz is a subproject of CXF. Fediz helps you to secure your web applications and delegates security enforcement to the underlying application server. With Fediz, authentication is externalized from your web application to an identity provider installed as a dedicated server component. Apache CXF Fediz supports both <a shape="rect" class="external-link" href="http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html#_Toc223175002" rel="nofollow">WS-Federation Passive Requestor Profile</a> and the <a shape="rect" class="external-link" href="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf" rel="nofollow">SAML Web Browser SSO Profile</a>. Fediz supports <a shape="rect" class="external-link" href="http://en.wikipedia.org/wiki/Claims-based_
identity" rel="nofollow">Claims Based Access Control</a> beyond Role Based Access Control (RBAC).</p><h2 id="Fediz-News">News</h2><p><strong><strong><strong><strong>June 29, 2018 - <strong><strong>Apache CXF Fediz 1.4.4</strong></strong> released</strong></strong></strong></strong></p><p>Apache CXF Fediz 1.4.4 has been released. A new security advisory has been released for an issue that was fixed in this release:</p><ul><li><a shape="rect" href="http://cxf.apache.org/security-advisories.data/CVE-2018-8038.txt.asc">CVE-2018-8038</a>: Apache CXF Fediz is vulnerable to DTD based XML attacks.</li></ul><p><strong><strong><strong><strong>November 30, 2017 - <strong><strong>Apache CXF Fediz 1.4.</strong></strong>3 and 1.3.3 released</strong></strong></strong></strong></p><p>Apache CXF Fediz 1.4.3 and 1.3.3 have been released. A new security advisory has been released for an issue that was fixed in these releases:</p><ul><li><a shape="rect" href="http://cxf.apache.org/security-advisories.d
ata/CVE-2017-12631.txt.asc">CVE-2017-12631</a>: CSRF vulnerabilities in the Apache CXF Fediz Spring plugins.</li></ul><h2 id="Fediz-Download">Download</h2><p>See <a shape="rect" href="fediz-downloads.html">here</a>.</p><h2 id="Fediz-ProjectSource">Project Source</h2><p>The Apache CXF Fediz sources are hosted at <a shape="rect" class="external-link" href="https://gitbox.apache.org/">Apache gitbox</a>. This includes a full two way sync with github. As github provides the nicer user interface we now recommend to directly work on the github cxf repo.</p><ul><li>Web Browsing: <a shape="rect" class="external-link" href="https://github.com/apache/cxf-fediz" rel="nofollow">https://github.com/apache/cxf-fediz</a></li><li>Checking out from GIT: git clone git@github.com:apache/cxf-fediz.git</li></ul><p>CXF committers can directly commit to github after doing the <a shape="rect" class="external-link" href="https://gitbox.apache.org/setup/">Apache gitbox setup</a>. Be aware t
hat the sync might take half an hour before you are added to the CXF github group.</p><ul><li>Forking and Pull Requests: See <a shape="rect" href="getting-involved.html">Getting Involved</a></li><li>Building the Source: Follow the <a shape="rect" class="external-link" href="https://github.com/apache/cxf-fediz/blob/master/BUILDING.txt" rel="nofollow">BUILDING.txt</a> file in the Fediz download for full build instructions.</li><li>Eclipse: See <a shape="rect" href="http://cxf.apache.org/setting-up-eclipse.html">this page</a> for information on using the Eclipse IDE with the Fediz source code. This page is created for CXF but the same commands are applicable for Fediz too.</li></ul><h2 id="Fediz-ApacheCXFFedizuserguide">Apache CXF Fediz user guide</h2><ul><li><a shape="rect" href="fediz-introduction.html">Introduction</a></li><li><a shape="rect" href="fediz-architecture.html">Fediz Architecture</a></li><li>Relying Party Containers<br clear="none"><ul><li><a shape="rect" href="fedi
z-configuration.html">Fediz Configuration</a></li><li><a shape="rect" href="fediz-extensions.html">Fediz Extensions</a></li><li><a shape="rect" href="fediz-tomcat.html">Apache Tomcat</a></li><li><a shape="rect" href="fediz-jetty.html">Jetty<br clear="none"></a></li><li><a shape="rect" href="fediz-spring.html">Spring Security<br clear="none"></a></li><li><a shape="rect" href="fediz-websphere.html">Websphere 7/8<br clear="none"></a></li><li><a shape="rect" href="fediz-cxf.html">CXF<br clear="none"></a></li></ul></li><li><a shape="rect" href="fediz-idp-11.html">Fediz IdP</a></li><li><a shape="rect" href="fediz-idp-10.html">Fediz IdP 1.0</a> (deprecated)</li><li><a shape="rect" href="fediz-metadata.html">Fediz Metadata</a></li><li><a shape="rect" href="fediz-samples.html">Fediz Samples</a></li><li><a shape="rect" href="fediz-articles.html">Fediz Articles</a></li><li><a shape="rect" href="fediz-history.html">Fediz History</a></li></ul><p><br clear="none"></p></div>
+<div id="ConfluenceContent"><h1 id="Fediz-ApacheCXFFediz:AnOpen-SourceWebSecurityFramework">Apache CXF Fediz: An Open-Source Web Security Framework</h1><h2 id="Fediz-Overview">Overview</h2><p>Apache CXF Fediz is a subproject of CXF. Fediz helps you to secure your web applications and delegates security enforcement to the underlying application server. With Fediz, authentication is externalized from your web application to an identity provider installed as a dedicated server component. Apache CXF Fediz supports both <a shape="rect" class="external-link" href="http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html#_Toc223175002" rel="nofollow">WS-Federation Passive Requestor Profile</a> and the <a shape="rect" class="external-link" href="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf" rel="nofollow">SAML Web Browser SSO Profile</a>. Fediz supports <a shape="rect" class="external-link" href="http://en.wikipedia.org/wiki/Claims-based_
identity" rel="nofollow">Claims Based Access Control</a> beyond Role Based Access Control (RBAC).</p><h2 id="Fediz-News">News</h2><p><strong><strong><strong><strong>June 29, 2018 - <strong><strong>Apache CXF Fediz 1.4.4</strong></strong> released</strong></strong></strong></strong></p><p>Apache CXF Fediz 1.4.4 has been released. A new security advisory has been released for an issue that was fixed in this release:</p><ul><li><a shape="rect" href="http://cxf.apache.org/security-advisories.data/CVE-2018-8038.txt.asc">CVE-2018-8038</a>: Apache CXF Fediz is vulnerable to DTD based XML attacks.</li></ul><p><strong><strong><strong><strong>November 30, 2017 - <strong><strong>Apache CXF Fediz 1.4.</strong></strong>3 and 1.3.3 released</strong></strong></strong></strong></p><p>Apache CXF Fediz 1.4.3 and 1.3.3 have been released. A new security advisory has been released for an issue that was fixed in these releases:</p><ul><li><a shape="rect" href="http://cxf.apache.org/security-advisories.d
ata/CVE-2017-12631.txt.asc">CVE-2017-12631</a>: CSRF vulnerabilities in the Apache CXF Fediz Spring plugins.</li></ul><h2 id="Fediz-Download">Download</h2><p>See <a shape="rect" href="fediz-downloads.html">here</a>.</p><h2 id="Fediz-ProjectSource">Project Source</h2><p>The Apache CXF Fediz sources are hosted at <a shape="rect" class="external-link" href="https://gitbox.apache.org/">Apache gitbox</a>. This includes a full two way sync with github. As github provides the nicer user interface we now recommend to directly work on the github cxf repo.</p><ul><li>Web Browsing: <a shape="rect" class="external-link" href="https://github.com/apache/cxf-fediz" rel="nofollow">https://github.com/apache/cxf-fediz</a></li><li>Checking out from GIT: git clone git@github.com:apache/cxf-fediz.git</li></ul><p>CXF committers can directly commit to github after doing the <a shape="rect" class="external-link" href="https://gitbox.apache.org/setup/">Apache gitbox setup</a>. Be aware t
hat the sync might take half an hour before you are added to the CXF github group.</p><ul><li>Forking and Pull Requests: See <a shape="rect" href="getting-involved.html">Getting Involved</a></li><li>Building the Source: Follow the <a shape="rect" class="external-link" href="https://github.com/apache/cxf-fediz/blob/master/BUILDING.txt" rel="nofollow">BUILDING.txt</a> file in the Fediz download for full build instructions.</li><li>Eclipse: See <a shape="rect" href="http://cxf.apache.org/setting-up-eclipse.html">this page</a> for information on using the Eclipse IDE with the Fediz source code. This page is created for CXF but the same commands are applicable for Fediz too.</li></ul><h2 id="Fediz-ApacheCXFFedizuserguide">Apache CXF Fediz user guide</h2><ul><li><a shape="rect" href="fediz-introduction.html">Introduction</a></li><li><a shape="rect" href="fediz-architecture.html">Fediz Architecture</a></li><li>Relying Party Containers<br clear="none"><ul><li><a shape="rect" href="fedi
z-configuration.html">Fediz Configuration</a></li><li><a shape="rect" href="fediz-extensions.html">Fediz Extensions</a></li><li><a shape="rect" href="fediz-tomcat.html">Apache Tomcat</a></li><li><a shape="rect" href="fediz-jetty.html">Jetty<br clear="none"></a></li><li><a shape="rect" href="fediz-spring.html">Spring Security<br clear="none"></a></li><li><a shape="rect" href="fediz-websphere.html">Websphere<br clear="none"></a></li><li><a shape="rect" href="fediz-cxf.html">Apache CXF<br clear="none"></a></li></ul></li><li><a shape="rect" href="fediz-idp-11.html">Fediz IdP</a></li><li><a shape="rect" href="fediz-idp-10.html">Fediz IdP 1.0</a> (deprecated)</li><li><a shape="rect" href="fediz-metadata.html">Fediz Metadata</a></li><li><a shape="rect" href="fediz-samples.html">Fediz Samples</a></li><li><a shape="rect" href="fediz-articles.html">Fediz Articles</a></li><li><a shape="rect" href="fediz-history.html">Fediz History</a></li></ul><p><br clear="none"></p></div>
</div>
<!-- Content -->
</td>