You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by crichmond <cr...@referentia.com> on 2012/01/26 02:29:48 UTC
Securing Jersey resouces with Shiro
I have a resource class for Jersey rest endpoints in Jetty like so..
@Path("/reports")
public class ReportResource {
@GET
@Path("{dept: finance|marketing}")
public String getByDept(@PathParam("dept") String dept) {
ReportNameListPage page = new ReportNameListPage(dept);
return page.generatePage();
}
..
more get methods
This serves up dynamic pages at /reports/finance, /reports/marketing, etc in
a REST style with Jersey.
I tried to add @RequiresAuthentication to the @Get method like so:
@GET
@Path("{dept: finance|marketing}")
@RequiresAuthentication
public String getByDept(@PathParam("dept") String dept) {
ReportNameListPage page = new ReportNameListPage(dept);
return page.generatePage();
}
but this does not redirect to my login page or challenge in any way. Is
this the correct approach to secure a Jersey/REST resource with Shiro?
Thanks
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Securing-Jersey-resouces-with-Shiro-tp7225690p7225690.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Securing Jersey resouces with Shiro
Posted by Les Hazlewood <lh...@apache.org>.
Hi Chris,
It appears that Jersey is scanning a package path and doing its own
inspection of its own annotations. Naturally it is unaware of Shiro
annotations, so there are two options that I can think of:
1. Someone codes some integration mechanism to allow Jersey to
recognize and enforce Shiro annotations or
2. You enable an AOP framework like the AspectJ example to enforce
Shiro annotations.
#2 is definitely the path of least resistance as it is already working
and supported by Shiro. If you're using Spring, you can use the
Spring AOP support instead.
HTH,
--
Les Hazlewood
CTO, Katasoft | http://www.katasoft.com | 888.391.5282
twitter: @lhazlewood | http://twitter.com/lhazlewood
katasoft blog: http://www.katasoft.com/blogs/lhazlewood
personal blog: http://leshazlewood.com
On Wed, Jan 25, 2012 at 6:15 PM, crichmond <cr...@referentia.com> wrote:
> We are not using any type of AOP as far as I know. The resource class for
> the Jersey rest endpoints are simple written /configured with @Path info
> like the sample
>
> (That resource class/endpoint method i posted before is found in
> the my.web.packages)
>
> and set up on the embedded Jetty server like so:
>
> ResourceConfig rc = new PackagesResourceConfig(
> "my.web.packages");
>
> ServletHolder jerseyHolder = new ServletHolder(new
> ServletContainer(rc));
> jerseyHolder.setName("REST API");
> myContext.addServlet(jerseyHolder, "/");
>
> ServletMapping mapping = new ServletMapping();
> ServletHandler servletHandler = myContext.getServletHandler();
> mapping.setServletName("REST API");
> mapping.setPathSpec("/*");
> servletHandler.addServletMapping(mapping);
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Securing-Jersey-resouces-with-Shiro-tp7225690p7225798.html
> Sent from the Shiro User mailing list archive at Nabble.com.
Re: Securing Jersey resouces with Shiro
Posted by crichmond <cr...@referentia.com>.
We are not using any type of AOP as far as I know. The resource class for
the Jersey rest endpoints are simple written /configured with @Path info
like the sample
(That resource class/endpoint method i posted before is found in
the my.web.packages)
and set up on the embedded Jetty server like so:
ResourceConfig rc = new PackagesResourceConfig(
"my.web.packages");
ServletHolder jerseyHolder = new ServletHolder(new
ServletContainer(rc));
jerseyHolder.setName("REST API");
myContext.addServlet(jerseyHolder, "/");
ServletMapping mapping = new ServletMapping();
ServletHandler servletHandler = myContext.getServletHandler();
mapping.setServletName("REST API");
mapping.setPathSpec("/*");
servletHandler.addServletMapping(mapping);
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Securing-Jersey-resouces-with-Shiro-tp7225690p7225798.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Securing Jersey resouces with Shiro
Posted by Les Hazlewood <lh...@apache.org>.
You need to configure whatever AOP mechanism you wish to recognize
Shiro annotations and handle them accordingly.
For example, often people do this via Spring AOP or AspectJ. What
mechanism might be used in your project? Here is a sample
AspectJ-enabled app that does this:
http://svn.apache.org/repos/asf/shiro/trunk/samples/aspectj
Of particular interest is the aspectj aop.xml file that sets this up:
http://svn.apache.org/repos/asf/shiro/trunk/samples/aspectj/src/test/resources/META-INF/aop.xml
Does this help? How does your app know to inspect the Jersey
annotations? I don't know Jersey myself, but is there a way to also
support additional annotations like Shiro's? Do you use an AOP
mechanism today?
Regards,
Les
On Wed, Jan 25, 2012 at 5:29 PM, crichmond <cr...@referentia.com> wrote:
> I have a resource class for Jersey rest endpoints in Jetty like so..
>
> @Path("/reports")
> public class ReportResource {
>
>
> @GET
> @Path("{dept: finance|marketing}")
> public String getByDept(@PathParam("dept") String dept) {
> ReportNameListPage page = new ReportNameListPage(dept);
> return page.generatePage();
> }
>
> ..
>
> more get methods
>
> This serves up dynamic pages at /reports/finance, /reports/marketing, etc in
> a REST style with Jersey.
>
> I tried to add @RequiresAuthentication to the @Get method like so:
>
> @GET
> @Path("{dept: finance|marketing}")
> @RequiresAuthentication
> public String getByDept(@PathParam("dept") String dept) {
> ReportNameListPage page = new ReportNameListPage(dept);
> return page.generatePage();
> }
>
> but this does not redirect to my login page or challenge in any way. Is
> this the correct approach to secure a Jersey/REST resource with Shiro?
>
> Thanks
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Securing-Jersey-resouces-with-Shiro-tp7225690p7225690.html
> Sent from the Shiro User mailing list archive at Nabble.com.