You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomee.apache.org by Geoff Callender <ab...@mac.com> on 2010/01/25 06:32:42 UTC

How to propagate security context from Jetty to OpenEJB?

I need advice on how to propagate the security context from (Jetty 6.1.6) to
OpenEJB (3.1.1). My web pages can retrieve the Principal correctly but my
EJB session bean methods only get "guest". Is this a known problem or am I
doing something wrong?

>From web.xml…

	<!-- Authentication -->
	
	<login-config>
		<auth-method>FORM</auth-method>
		<realm-name>MyRealm</realm-name>
		<form-login-config>
			<form-login-page>/jsp/login.html</form-login-page>
			<form-error-page>/jsp/error.html</form-error-page>
		</form-login-config>
	</login-config>

	<security-constraint>
		…
	</security-constraint>

>From jetty.xml...

	<Call name="addUserRealm">
		<Arg>
			<New class="org.mortbay.jetty.plus.jaas.JAASUserRealm">
				<Set name="name">MyRealm</Set>
				<Set name="LoginModuleName">JDBCLoginModule</Set>
			</New>
		</Arg>
	</Call>

>From login.conf...

	JDBCLoginModule {
		org.mortbay.jetty.plus.jaas.spi.JDBCLoginModule required
		debug="true"
		dbUrl="jdbc:mysql://localhost:3306/my_db"
		dbUserName="myuser"
		dbPassword="mypassword"
		dbDriver="com.mysql.jdbc.Driver"
		userTable="blah"
		userField="blah"
		credentialField="blah"
		userRoleTable="blah"
		userRoleUserField="blah"
		userRoleRoleField="blah";
	};

>From web page code…

		// The following name will be, correctly, whatever we logged in with.
		String name = httpServletRequest.getUserPrincipal().getName();
		...
		InitialContext ctx = new InitialContext();
		IMyServiceLocal myService = (IMyServiceLocal)
ctx.lookup("MyServiceLocal"); 
		result = myService.doSomething();

The EJB method doSomething() thinks the Principal is "guest"…

	@Resource
	SessionContext _context;

	public String doSomething() {
		...
		// This name will be, wrongly, "guest".
		String name = context.getCallerPrincipal().getName();
		...
	}

Any pointers appreciated.

Geoff

-- 
View this message in context: http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1289042.html
Sent from the OpenEJB User mailing list archive at Nabble.com.

Re: How to propagate security context from Jetty to OpenEJB?

Posted by David Blevins <da...@visi.com>.
On Jan 26, 2010, at 4:00 AM, David Blevins wrote:

>
> On Jan 25, 2010, at 6:32 AM, Geoff Callender wrote:
>
>>
>> I need advice on how to propagate the security context from (Jetty  
>> 6.1.6) to
>> OpenEJB (3.1.1). My web pages can retrieve the Principal correctly  
>> but my
>> EJB session bean methods only get "guest". Is this a known problem  
>> or am I
>> doing something wrong?
>
> It's not really a "problem" as much there is no OpenEJB/Jetty  
> integration yet, so the two simply don't know that each other exists.
>
> It might not be that hard to write the security part.  The Tomcat  
> related security code is actually pretty small.
>
> Bascially we just need a class like this one that wires the Jetty  
> security service into OpenEJB:
>
> http://svn.apache.org/repos/asf/openejb/trunk/openejb3/assembly/openejb-tomcat/openejb-tomcat-catalina/src/main/java/org/apache/openejb/tomcat/catalina/TomcatSecurityService.java

Just to add to this.  Stephen has done work with integrating Jetty's  
transaction manager with OpenEJB.  If we pool our code together we  
could wind up with a pretty good Jetty integration!

Thoughts?


-David

Re: How to propagate security context from Jetty to OpenEJB?

Posted by David Blevins <da...@visi.com>.
Moving this over to the Jetty Integration thread on dev.

On Jan 31, 2010, at 3:07 AM, Geoff Callender wrote:

>
> OK, I feel very lost now.  A quick summary: I'm trying to get  
> OpenEJB to
> receive the security context from Jetty so that the user is  
> authenticated
> once only, by the web container, at login. I've succeeded in  
> receiving the
> Principal but not the roles.
>
> Apparently this has been solved for Tomcat to OpenEJB, and it involves
> OpenEJBValve on the Tomcat side and TomcatSecurityService on the  
> OpenEJB
> side.
>
> What I've done is imitate OpenEJBValve by writing a Filter (I first  
> tried a
> SecurityHandler but had problems), and I've imitated  
> TomcatSecurityService
> by writing JettySecurityService. Their internals are almost  
> identical to the
> Tomcat counterparts.
>
> Good result - my EJBs can now correctly get the Principal!  
> Previously they
> always thought the principal was "guest".
>
> However, the roles are never passed, and I don't see a mechanism for  
> it.
> Neither is the login method JettySecurityService ever called.
>
> Can someone please, please enlighten me? Are there more bits to this  
> puzzle?
>
> BTW, this is only for development use, not production, so it can cut  
> corners
> if that keeps it simple.
>
> Cheers,
>
> Geoff
> -- 
> View this message in context: http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1457789.html
> Sent from the OpenEJB User mailing list archive at Nabble.com.
>

Re: How to propagate security context from Jetty to OpenEJB?

Posted by Geoff Callender <ab...@mac.com>.
OK, I feel very lost now.  A quick summary: I'm trying to get OpenEJB to
receive the security context from Jetty so that the user is authenticated
once only, by the web container, at login. I've succeeded in receiving the
Principal but not the roles.

Apparently this has been solved for Tomcat to OpenEJB, and it involves
OpenEJBValve on the Tomcat side and TomcatSecurityService on the OpenEJB
side.

What I've done is imitate OpenEJBValve by writing a Filter (I first tried a
SecurityHandler but had problems), and I've imitated TomcatSecurityService
by writing JettySecurityService. Their internals are almost identical to the
Tomcat counterparts.

Good result - my EJBs can now correctly get the Principal! Previously they
always thought the principal was "guest".

However, the roles are never passed, and I don't see a mechanism for it.
Neither is the login method JettySecurityService ever called.  

Can someone please, please enlighten me? Are there more bits to this puzzle? 

BTW, this is only for development use, not production, so it can cut corners
if that keeps it simple.

Cheers,

Geoff
-- 
View this message in context: http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1457789.html
Sent from the OpenEJB User mailing list archive at Nabble.com.

Re: How to propagate security context from Jetty to OpenEJB?

Posted by Geoff Callender <ab...@mac.com>.
Am I on the right track? Inspired by OpenEJBValve, I've extended Jetty's
SecurityHandler to do something similar...


import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.openejb.loader.SystemInstance;
import org.apache.openejb.spi.SecurityService;
import org.apache.openejb.util.OpenEjbVersion;
import org.mortbay.jetty.security.SecurityHandler;

import au.com.tenam.business.openejb.JettySecurityService;

public class OpenEJBSecurityHandler extends SecurityHandler {
	protected JettySecurityService securityService;

	@Override
	public void doStart() throws Exception {
		String info = getClass().getName() + "/" +
OpenEjbVersion.get().getVersion();
		System.out.println("Initing " + info);
		securityService = getSecurityService();
	}

	@Override
	public void handle(String target, HttpServletRequest request,
HttpServletResponse response, int dispatch)
			throws IOException, ServletException {
		Object oldState = null;
		if (securityService != null && request != null) {
			oldState = securityService.enterWebApp(getUserRealm(),
request.getUserPrincipal(), null);
		}

		try {
			super.handle(target, request, response, dispatch);
		}
		finally {
			if (securityService != null) {
				securityService.exitWebApp(oldState);
			}
		}
	}

	@SuppressWarnings("unchecked")
	private JettySecurityService getSecurityService() {
		SecurityService securityService =
SystemInstance.get().getComponent(SecurityService.class);
		if (securityService instanceof JettySecurityService) {
			return (JettySecurityService) securityService;
		}
		return null;
	}

}


It's not quite working - I'm getting NPE during super.handle(...) which is
probably a config issue (SessionIdManager shouldn't be null) that I'll take
to the Jetty lists - but is there anything more that the Jetty side should
do?
-- 
View this message in context: http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1457324.html
Sent from the OpenEJB User mailing list archive at Nabble.com.

Re: How to propagate security context from Jetty to OpenEJB?

Posted by Geoff Callender <ab...@mac.com>.
I've created a JettySecurityService and I guess my config (service-jar.xml
and openejb.xml) must be right because the class is being instantiated, and
it's successfully getting my Jetty server's UserRealm, and there are lots of
calls to 
    protected Subject getRunAsSubject(CoreDeploymentInfo
callingDeploymentInfo)
and
    public Set<String> getLogicalRoles(Principal[] principals, Set<String>
logicalRoles)

However, the argument callingDeploymentInfo is always null, and principals
is always the user "guest" and the group "guest".

These methods are never called:
    public UUID login(String realmName, String username, String password)
    private Subject createSubject(UserRealm realm, Principal principal)
    public Object enterWebApp(UserRealm realm, Principal principal, String
runAs)

Is there something more I have to do in Jetty?

- Geoff



David Blevins wrote:
> 
> 
> On Jan 26, 2010, at 8:22 AM, Geoff Callender wrote:
> 
>> This is pretty heartening.  Is there any doco or example of how to  
>> use TomcatSecurityService. Any config involved?
> 
> There's nothing required above and beyond typical Tomcat usage, so no  
> config required and hence no doc.  There is a doc however on just the  
> basic plug points of the OpenEJB security service, which combined with  
> the Tomcat-specific security code should give a little insight as to  
> what is needed for an equivalent integration with Jetty's security  
> service.
> 
> See the "PLUG POINTS" section:
> 
>   http://openejb.apache.org/3.0/security.html
> 
> -David
> 
-- 
View this message in context: http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1457279.html
Sent from the OpenEJB User mailing list archive at Nabble.com.

Re: How to propagate security context from Jetty to OpenEJB?

Posted by David Blevins <da...@visi.com>.
On Jan 26, 2010, at 8:22 AM, Geoff Callender wrote:

> This is pretty heartening.  Is there any doco or example of how to  
> use TomcatSecurityService. Any config involved?

There's nothing required above and beyond typical Tomcat usage, so no  
config required and hence no doc.  There is a doc however on just the  
basic plug points of the OpenEJB security service, which combined with  
the Tomcat-specific security code should give a little insight as to  
what is needed for an equivalent integration with Jetty's security  
service.

See the "PLUG POINTS" section:

  http://openejb.apache.org/3.0/security.html

-David

>
> On 26/01/2010, at 2:01 PM, David Blevins [via OpenEJB] wrote:
>
>>
>> On Jan 25, 2010, at 6:32 AM, Geoff Callender wrote:
>>
>>> I need advice on how to propagate the security context from (Jetty
>>> 6.1.6) to
>>> OpenEJB (3.1.1). My web pages can retrieve the Principal correctly
>>> but my
>>> EJB session bean methods only get "guest". Is this a known problem
>>> or am I
>>> doing something wrong?
>>
>> It's not really a "problem" as much there is no OpenEJB/Jetty
>> integration yet, so the two simply don't know that each other exists.
>>
>> It might not be that hard to write the security part.  The Tomcat
>> related security code is actually pretty small.
>>
>> Bascially we just need a class like this one that wires the Jetty
>> security service into OpenEJB:
>>
>>  http://svn.apache.org/repos/asf/openejb/trunk/openejb3/assembly/openejb-tomcat/openejb-tomcat-catalina/src/main/java/org/apache/openejb/tomcat/catalina/TomcatSecurityService.java
>>
>>
>> -David
>>
>> -- 
>> http://blog.dblevins.com/
>> http://twitter.com/dblevins
>> Support OpenEJB with Tweets!
>>
>>
>>
>> View message @ http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1290030.html
>> To unsubscribe from How to propagate security context from Jetty to  
>> OpenEJB?, click here.
>>
>

Re: How to propagate security context from Jetty to OpenEJB?

Posted by Geoff Callender <ab...@mac.com>.
David,

This is pretty heartening.  Is there any doco or example of how to use TomcatSecurityService. Any config involved?

Regards,

Geoff

On 26/01/2010, at 2:01 PM, David Blevins [via OpenEJB] wrote:

> 
> On Jan 25, 2010, at 6:32 AM, Geoff Callender wrote: 
> 
> > I need advice on how to propagate the security context from (Jetty   
> > 6.1.6) to 
> > OpenEJB (3.1.1). My web pages can retrieve the Principal correctly   
> > but my 
> > EJB session bean methods only get "guest". Is this a known problem   
> > or am I 
> > doing something wrong? 
> 
> It's not really a "problem" as much there is no OpenEJB/Jetty   
> integration yet, so the two simply don't know that each other exists. 
> 
> It might not be that hard to write the security part.  The Tomcat   
> related security code is actually pretty small. 
> 
> Bascially we just need a class like this one that wires the Jetty   
> security service into OpenEJB: 
> 
>   http://svn.apache.org/repos/asf/openejb/trunk/openejb3/assembly/openejb-tomcat/openejb-tomcat-catalina/src/main/java/org/apache/openejb/tomcat/catalina/TomcatSecurityService.java
> 
> 
> -David 
> 
> -- 
> http://blog.dblevins.com/
> http://twitter.com/dblevins
> Support OpenEJB with Tweets! 
> 
> 
> 
> View message @ http://n4.nabble.com/How-to-propagate-security-context-from-Jetty-to-OpenEJB-tp1289042p1290030.html 
> To unsubscribe from How to propagate security context from Jetty to OpenEJB?, click here.
>

Re: How to propagate security context from Jetty to OpenEJB?

Posted by David Blevins <da...@visi.com>.
On Jan 25, 2010, at 6:32 AM, Geoff Callender wrote:

>
> I need advice on how to propagate the security context from (Jetty  
> 6.1.6) to
> OpenEJB (3.1.1). My web pages can retrieve the Principal correctly  
> but my
> EJB session bean methods only get "guest". Is this a known problem  
> or am I
> doing something wrong?

It's not really a "problem" as much there is no OpenEJB/Jetty  
integration yet, so the two simply don't know that each other exists.

It might not be that hard to write the security part.  The Tomcat  
related security code is actually pretty small.

Bascially we just need a class like this one that wires the Jetty  
security service into OpenEJB:

  http://svn.apache.org/repos/asf/openejb/trunk/openejb3/assembly/openejb-tomcat/openejb-tomcat-catalina/src/main/java/org/apache/openejb/tomcat/catalina/TomcatSecurityService.java


-David

-- 
http://blog.dblevins.com/
http://twitter.com/dblevins
Support OpenEJB with Tweets!