You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-dev@jackrabbit.apache.org by "Bickerton, Alec Geoffrey" <Al...@unisys.com.INVALID> on 2024/07/18 13:15:50 UTC
Integrating Oak with SpringBoot 3.x
Hi,
I’m looking for some guidance on integrating Oak with a SpringBoot 3.x based application.
What I’m trying to achieve :
- Store XML data
- Store attachments as leaf nodes (Images, Video ...)
Could someone point me to some documentation explaining how to create a session using a PreAuthorized principal from Spring Security?
Is there a Spring Boot Starter available, the closest I've found so far is https://github.com/alapierre/spring-boot-jcr but that's based on Jackrabbit 2.x and not Oak.
Kind regards,
Alec
RE: Integrating Oak with SpringBoot 3.x
Posted by "Bickerton, Alec Geoffrey" <Al...@unisys.com.INVALID>.
Thanks, I'll look into it.
BR,
Alec
-----Original Message-----
From: Lasse Lindqvist <la...@gmail.com>
Sent: Friday, 19 July 2024 18:19
To: oak-dev@jackrabbit.apache.org
Subject: Re: Integrating Oak with SpringBoot 3.x
In your case then it sounds like you would need to pass it an implementation of Credentials but you cannot use SimpleCredentials since you have only a JWT, not the user password. So you would maybe add your own implementation. Of course you
In your case then it sounds like you would need to pass it an implementation of Credentials but you cannot use SimpleCredentials since you have only a JWT, not the user password. So you would maybe add your own implementation. Of course you could generate user credentials for the repository when the application user is created and the create SimpleCredentials based on those.
When tying a user to a repository session, I am not sure what actual higher security this provides compared to a simple case where you (audit)log every call to the RepositoryService and check the permissions on that level and have the user ID there as a field in the log. But of course if there is a strict requirement to use different Repository users, then you can do that.
pe 19. heinäk. 2024 klo 17.19 Bickerton, Alec Geoffrey
(Alec.Bickerton@unisys.com.invalid) kirjoitti:
> I'm working in a high security environment, it's important that there
> be no 'God mode' account.
> Each session needs to be tied to a given user, that user is
> authenticated via a signed JWT.
>
> Alec
> -----Original Message-----
> From: Lasse Lindqvist <la...@gmail.com>
> Sent: Friday, 19 July 2024 16:11
> To: Alec.Bickerton@unisys.com.invalid
> Cc: oak-dev@jackrabbit.apache.org
> Subject: Re: Integrating Oak with SpringBoot 3.x
>
> Why do you want to use Spring Security context when making a session?
> You could also just make a single user for the Oak repository and use
> that "technical" account. See * Session session = repo. login(* * new
> SimpleCredentials("admin", "admin". toCharArray()));* Why do you want
> to use Spring Security context when making a session? You could also
> just make a single user for the Oak repository and use that
> "technical" account.
> See
>
>
> * Session session = repo.login(*
> * new SimpleCredentials("admin", "admin".toCharArray()));*
>
> from
> https://urldefense.com/v3/__https://jackrabbit.apache.org/oak/docs/con
> struct.html__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_
> PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmInaTL9_Q$
> <https://urldefense.com/v3/__https://jackrabbit.apache.org/oak/docs/co
> nstruct.html__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd
> _PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmInaTL9_Q$ >> And then in your Spring Boot application handle authentication to any paths. That would mean that your main database would need to have a "file table" for checking who has access to which files.
> In this setup you would most likely create some sort of
> RepositoryService that when called creates a session and reads or writes the file.
>
>
> to 18. heinäk. 2024 klo 16.16 Bickerton, Alec Geoffrey
> (Alec.Bickerton@unisys.com.invalid) kirjoitti:
>
> > Hi,
> >
> > I’m looking for some guidance on integrating Oak with a SpringBoot
> > 3.x based application.
> >
> > What I’m trying to achieve :
> > - Store XML data
> > - Store attachments as leaf nodes (Images, Video ...)
> >
> > Could someone point me to some documentation explaining how to
> > create a session using a PreAuthorized principal from Spring Security?
> > Is there a Spring Boot Starter available, the closest I've found so
> > far is
> >
> https://urldefense.com/v3/__https://github.com/alapierre/spring-boot-j
> cr__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_PKT_TbYSf
> 8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmIE4EdC-g$
> <https://urldefense.com/v3/__https://github.com/alapierre/spring-boot-jcr__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmIE4EdC-g$ >> but that's based on Jackrabbit 2.x and not Oak.
> >
> > Kind regards,
> > Alec
> >
> >
> >
> >
> >
>
Re: Integrating Oak with SpringBoot 3.x
Posted by Lasse Lindqvist <la...@gmail.com>.
In your case then it sounds like you would need to pass it an
implementation of Credentials but you cannot use SimpleCredentials since
you have only a JWT, not the user password. So you would maybe add your own
implementation. Of course you could generate user credentials for the
repository when the application user is created and the create
SimpleCredentials based on those.
When tying a user to a repository session, I am not sure what actual higher
security this provides compared to a simple case where you (audit)log every
call to the RepositoryService and check the permissions on that level and
have the user ID there as a field in the log. But of course if there is a
strict requirement to use different Repository users, then you can do that.
pe 19. heinäk. 2024 klo 17.19 Bickerton, Alec Geoffrey
(Alec.Bickerton@unisys.com.invalid) kirjoitti:
> I'm working in a high security environment, it's important that there be
> no 'God mode' account.
> Each session needs to be tied to a given user, that user is authenticated
> via a signed JWT.
>
> Alec
> -----Original Message-----
> From: Lasse Lindqvist <la...@gmail.com>
> Sent: Friday, 19 July 2024 16:11
> To: Alec.Bickerton@unisys.com.invalid
> Cc: oak-dev@jackrabbit.apache.org
> Subject: Re: Integrating Oak with SpringBoot 3.x
>
> Why do you want to use Spring Security context when making a session? You
> could also just make a single user for the Oak repository and use that
> "technical" account. See * Session session = repo. login(* * new
> SimpleCredentials("admin", "admin". toCharArray()));*
> Why do you want to use Spring Security context when making a session? You
> could also just make a single user for the Oak repository and use that
> "technical" account.
> See
>
>
> * Session session = repo.login(*
> * new SimpleCredentials("admin", "admin".toCharArray()));*
>
> from
> https://urldefense.com/v3/__https://jackrabbit.apache.org/oak/docs/construct.html__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmInaTL9_Q$
> And then in your Spring Boot application handle authentication to any
> paths. That would mean that your main database would need to have a "file
> table" for checking who has access to which files.
> In this setup you would most likely create some sort of RepositoryService
> that when called creates a session and reads or writes the file.
>
>
> to 18. heinäk. 2024 klo 16.16 Bickerton, Alec Geoffrey
> (Alec.Bickerton@unisys.com.invalid) kirjoitti:
>
> > Hi,
> >
> > I’m looking for some guidance on integrating Oak with a SpringBoot 3.x
> > based application.
> >
> > What I’m trying to achieve :
> > - Store XML data
> > - Store attachments as leaf nodes (Images, Video ...)
> >
> > Could someone point me to some documentation explaining how to create
> > a session using a PreAuthorized principal from Spring Security?
> > Is there a Spring Boot Starter available, the closest I've found so
> > far is
> >
> https://urldefense.com/v3/__https://github.com/alapierre/spring-boot-jcr__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmIE4EdC-g$
> but that's based on Jackrabbit 2.x and not Oak.
> >
> > Kind regards,
> > Alec
> >
> >
> >
> >
> >
>
RE: Integrating Oak with SpringBoot 3.x
Posted by "Bickerton, Alec Geoffrey" <Al...@unisys.com.INVALID>.
I'm working in a high security environment, it's important that there be no 'God mode' account.
Each session needs to be tied to a given user, that user is authenticated via a signed JWT.
Alec
-----Original Message-----
From: Lasse Lindqvist <la...@gmail.com>
Sent: Friday, 19 July 2024 16:11
To: Alec.Bickerton@unisys.com.invalid
Cc: oak-dev@jackrabbit.apache.org
Subject: Re: Integrating Oak with SpringBoot 3.x
Why do you want to use Spring Security context when making a session? You could also just make a single user for the Oak repository and use that "technical" account. See * Session session = repo. login(* * new SimpleCredentials("admin", "admin". toCharArray()));*
Why do you want to use Spring Security context when making a session? You could also just make a single user for the Oak repository and use that "technical" account.
See
* Session session = repo.login(*
* new SimpleCredentials("admin", "admin".toCharArray()));*
from https://urldefense.com/v3/__https://jackrabbit.apache.org/oak/docs/construct.html__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmInaTL9_Q$
And then in your Spring Boot application handle authentication to any paths. That would mean that your main database would need to have a "file table" for checking who has access to which files.
In this setup you would most likely create some sort of RepositoryService that when called creates a session and reads or writes the file.
to 18. heinäk. 2024 klo 16.16 Bickerton, Alec Geoffrey
(Alec.Bickerton@unisys.com.invalid) kirjoitti:
> Hi,
>
> I’m looking for some guidance on integrating Oak with a SpringBoot 3.x
> based application.
>
> What I’m trying to achieve :
> - Store XML data
> - Store attachments as leaf nodes (Images, Video ...)
>
> Could someone point me to some documentation explaining how to create
> a session using a PreAuthorized principal from Spring Security?
> Is there a Spring Boot Starter available, the closest I've found so
> far is
> https://urldefense.com/v3/__https://github.com/alapierre/spring-boot-jcr__;!!JZxO7R1e!vxwn_bJj3tUq0cTDT5YOTfy8dI1x1Zh65_AfnVg_yvvd_PKT_TbYSf8hl4DyZWcSQ62Bz6x13l4k3gdM3G1G0FmIE4EdC-g$ but that's based on Jackrabbit 2.x and not Oak.
>
> Kind regards,
> Alec
>
>
>
>
>
Re: Integrating Oak with SpringBoot 3.x
Posted by Lasse Lindqvist <la...@gmail.com>.
Why do you want to use Spring Security context when making a session? You
could also just make a single user for the Oak repository and use that
"technical" account.
See
* Session session = repo.login(*
* new SimpleCredentials("admin", "admin".toCharArray()));*
from https://jackrabbit.apache.org/oak/docs/construct.html
And then in your Spring Boot application handle authentication to any
paths. That would mean that your main database would need to have a "file
table" for checking who has access to which files.
In this setup you would most likely create some sort of RepositoryService
that when called creates a session and reads or writes the file.
to 18. heinäk. 2024 klo 16.16 Bickerton, Alec Geoffrey
(Alec.Bickerton@unisys.com.invalid) kirjoitti:
> Hi,
>
> I’m looking for some guidance on integrating Oak with a SpringBoot 3.x
> based application.
>
> What I’m trying to achieve :
> - Store XML data
> - Store attachments as leaf nodes (Images, Video ...)
>
> Could someone point me to some documentation explaining how to create a
> session using a PreAuthorized principal from Spring Security?
> Is there a Spring Boot Starter available, the closest I've found so far is
> https://github.com/alapierre/spring-boot-jcr but that's based on
> Jackrabbit 2.x and not Oak.
>
> Kind regards,
> Alec
>
>
>
>
>