Few questions about security, JAAS, RBAC, ...

[Milen Dyankov <mi...@gmail.com>]

Hi guys,

Let me start by saying I'm only using Karaf for some private projects and
spend very limited time on it so chances are I may have misunderstood or
overlooked something.

I've reached the point where I need to apply some kind of RBAC to my app,
so I started looking in what Karaf provides. It seems it provides
authentication and authorization layer based on JAAS. This is totally fine,
except it seems to be too low level from the perspective of someone who
mostly cares about web application security (essentially controlling access
to resources). So the questions I have are:

1. is there any higher level abstraction? Something that allows to manage
users/roles in more end-user friendly manner (Simple API / web services /
UI /...)? I'm aware there are BackendEngineFactory implementations for some
login modules but that's not really what I consider high level and they
seem to be somewhat limited (according to the docs).

2. if I decide to go with custom JAAS module, do I have to use blueprint to
register it? If not can someone share some example using DS or
BundleActivator (to save me some time digging)?

3. is there any higher level security framework that fits nicely in Karaf
(or OSGi in general)? I followed some posts about installing Shiro's Karaf
features but those didn't work on 4.0.2. If someone has some experience
with Shiro or something similar in Karaf or OSGi can you please share?

Also while reading the security docs I noticed

4. The document says that by default Karaf provides some ACLs for commands
and JMX in the etc folder. While I see the files in the source code they
don't seem to be in Karaf 4.0.2 distribution! Is this doc outdated or for
some reason the files didn't make it in?

5. The ACL files naming convention is different for commands and JMX :
org.apache.karaf.*command.acl*.bundle.cfg
*jmx.acl*.org.apache.karaf.bundle.cfg
It would be nice to make it consistent if possible. It would be much easier
to introduce a tool or script to manage those if they follow consistent
naming scheme!


Best,
Milen



-- 
http://about.me/milen

Re: Few questions about security, JAAS, RBAC, ...

[Jean-Baptiste Onofré <jb...@nanthrax.net>]

Hi Milen,

1. Maybe you can relay on the SyncopeLoginModule. With CXF for instance, 
you can use the JAASInterceptor that delegate to the JAAS service.

2. JAAS login module is a pure OSGi service, so it can be exposed with 
whatever you want. For instance, take a look on the default provided 
login modules. They don't use blueprint, directly OSGi (activator):
https://git-wip-us.apache.org/repos/asf?p=karaf.git;a=tree;f=jaas/modules;hb=HEAD

3. Why not simply use JAAS service ? It's pretty easy to use.

4. It's bug in 4.0.2, fixed in 4.0.3.

5. Not easy: for JMX it's based on the OName, whereas for command it's 
based on scope/command name.

Regards
JB

On 11/24/2015 05:34 PM, Milen Dyankov wrote:
> Hi guys,
>
> Let me start by saying I'm only using Karaf for some private projects
> and spend very limited time on it so chances are I may have
> misunderstood or overlooked something.
>
> I've reached the point where I need to apply some kind of RBAC to my
> app, so I started looking in what Karaf provides. It seems it provides
> authentication and authorization layer based on JAAS. This is totally
> fine, except it seems to be too low level from the perspective of
> someone who mostly cares about web application security (essentially
> controlling access to resources). So the questions I have are:
> 1. is there any higher level abstraction? Something that allows to
> manage users/roles in more end-user friendly manner (Simple API / web
> services / UI /...)? I'm aware there are BackendEngineFactory
> implementations for some login modules but that's not really what I
> consider high level and they seem to be somewhat limited (according to
> the docs).
>
> 2. if I decide to go with custom JAAS module, do I have to use blueprint
> to register it? If not can someone share some example using DS or
> BundleActivator (to save me some time digging)?
>
> 3. is there any higher level security framework that fits nicely in
> Karaf (or OSGi in general)? I followed some posts about installing
> Shiro's Karaf features but those didn't work on 4.0.2. If someone has
> some experience with Shiro or something similar in Karaf or OSGi can you
> please share?
>
> Also while reading the security docs I noticed
>
> 4. The document says that by default Karaf provides some ACLs for
> commands and JMX in the etc folder. While I see the files in the source
> code they don't seem to be in Karaf 4.0.2 distribution! Is this doc
> outdated or for some reason the files didn't make it in?
>
> 5. The ACL files naming convention is different for commands and JMX :
> org.apache.karaf.*command.acl*.bundle.cfg
> *jmx.acl*.org.apache.karaf.bundle.cfg
> It would be nice to make it consistent if possible. It would be much
> easier to introduce a tool or script to manage those if they follow
> consistent naming scheme!
>
>
> Best,
> Milen
>
>
>
> --
> http://about.me/milen

-- 
Jean-Baptiste Onofré
jbonofre@apache.org
http://blog.nanthrax.net
Talend - http://www.talend.com