You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@karaf.apache.org by Tom Barber <to...@meteorite.bi> on 2015/02/08 20:40:42 UTC
Webapp Security, and bean framework in OSGI & Karaf
Hi guys,
I'm hoping some one or some people can share some insight into the state
of OSGI and Karaf because I'm trying to port an existing application to
Karaf and I'm struggling with some bits.
Firstly, Spring vs Blueprint or something else.
My existing app is Spring MVC based, but i'm not particularly bothered
what it runs as long as it works. As this will take time I downloaded
Karaf 4.0 M1 with the aim of getting it running on the future stable
version. I noticed that Blueprint isn't shipped for internal stuff. When
designing applications is that because there is something better or just
reducing bloat? After a bit of googling it became apparent Spring
weren't really showing their modules and OSGI love these days, and the
other option was Spring DM but people say its basically retired.
Secondly, security, because we use Spring we also use Spring Security,
and this is widely used in webapps so ideally I'd like to stick with it
for securing my webapp. But when I looked into hooking up Spring
Security to Blueprint I hit a bunch of apparent incompatibilities with
Karaf 3.x and Blueprint.
So, what is the correct way of creating a bean based set of modules with
"Enterprise" security (LDAP/JDBC/CAS etc authentication).
Thanks
Tom
--
*Tom Barber* | Technical Director
meteorite bi
*T:* +44 20 8133 3730
*W:* www.meteorite.bi | *Skype:* meteorite.consulting
*A:* Surrey Technology Centre, Surrey Research Park, Guildford, GU2 7YG, UK
Re: Webapp Security, and bean framework in OSGI & Karaf
Posted by Nick Baker <nb...@pentaho.com>.
Hey Tom,
Nick Baker over at Pentaho. Long time! We've actually written a SpringSecurityLoginModule to bridge Karaf and it's usage of JAAS with the platform's use of Spring Security. Big push with OSGI and Karaf coming in our 6.0 release. We're synthetically adding a role for anyone with the AdministerSecurity grant which corresponds to the Karaf admin JAAS role (karaf.admin.role from system.properties). This allows any such user to access the WebConsole or SSH into Karaf.
https://github.com/pentaho/pentaho-platform/blob/future-develop/extensions/src/org/pentaho/platform/osgi/SpringSecurityLoginModule.java
-Nick Baker
From: Tom Barber <to...@meteorite.bi>>
Reply-To: "user@karaf.apache.org<ma...@karaf.apache.org>" <us...@karaf.apache.org>>
Date: Sunday, February 8, 2015 at 3:07 PM
To: "user@karaf.apache.org<ma...@karaf.apache.org>" <us...@karaf.apache.org>>
Subject: Re: Webapp Security, and bean framework in OSGI & Karaf
Yeah thanks Jean-Baptiste,
I did go over the docs, so I knew it was there, I was just after clarification from an up to date source rather than reading through old mailing list and blog posts to understand what the current state of things are :)
Tom
On 08/02/15 20:05, Jean-Baptiste Onofré wrote:
Hi Tom,
Karaf provides Jaas realm and login modules ready to use.
You can directly use RBAC in your webapp based on that.
You should find some details there:
http://karaf.apache.org/manual/latest/developers-guide/security-framework.html
Regards
JB
On 02/08/2015 08:40 PM, Tom Barber wrote:
Hi guys,
I'm hoping some one or some people can share some insight into the state
of OSGI and Karaf because I'm trying to port an existing application to
Karaf and I'm struggling with some bits.
Firstly, Spring vs Blueprint or something else.
My existing app is Spring MVC based, but i'm not particularly bothered
what it runs as long as it works. As this will take time I downloaded
Karaf 4.0 M1 with the aim of getting it running on the future stable
version. I noticed that Blueprint isn't shipped for internal stuff. When
designing applications is that because there is something better or just
reducing bloat? After a bit of googling it became apparent Spring
weren't really showing their modules and OSGI love these days, and the
other option was Spring DM but people say its basically retired.
Secondly, security, because we use Spring we also use Spring Security,
and this is widely used in webapps so ideally I'd like to stick with it
for securing my webapp. But when I looked into hooking up Spring
Security to Blueprint I hit a bunch of apparent incompatibilities with
Karaf 3.x and Blueprint.
So, what is the correct way of creating a bean based set of modules with
"Enterprise" security (LDAP/JDBC/CAS etc authentication).
Thanks
Tom
--
*Tom Barber* | Technical Director
meteorite bi
*T:* +44 20 8133 3730
*W:* www.meteorite.bi<http://www.meteorite.bi> | *Skype:* meteorite.consulting
*A:* Surrey Technology Centre, Surrey Research Park, Guildford, GU2 7YG, UK
--
Tom Barber | Technical Director
meteorite bi
T: +44 20 8133 3730
W: www.meteorite.bi<http://www.meteorite.bi> | Skype: meteorite.consulting
A: Surrey Technology Centre, Surrey Research Park, Guildford, GU2 7YG, UK
Re: Webapp Security, and bean framework in OSGI & Karaf
Posted by Tom Barber <to...@meteorite.bi>.
Yeah thanks Jean-Baptiste,
I did go over the docs, so I knew it was there, I was just after
clarification from an up to date source rather than reading through old
mailing list and blog posts to understand what the current state of
things are :)
Tom
On 08/02/15 20:05, Jean-Baptiste Onofré wrote:
> Hi Tom,
>
> Karaf provides Jaas realm and login modules ready to use.
>
> You can directly use RBAC in your webapp based on that.
>
> You should find some details there:
>
> http://karaf.apache.org/manual/latest/developers-guide/security-framework.html
>
>
> Regards
> JB
>
> On 02/08/2015 08:40 PM, Tom Barber wrote:
>> Hi guys,
>>
>> I'm hoping some one or some people can share some insight into the state
>> of OSGI and Karaf because I'm trying to port an existing application to
>> Karaf and I'm struggling with some bits.
>>
>> Firstly, Spring vs Blueprint or something else.
>>
>> My existing app is Spring MVC based, but i'm not particularly bothered
>> what it runs as long as it works. As this will take time I downloaded
>> Karaf 4.0 M1 with the aim of getting it running on the future stable
>> version. I noticed that Blueprint isn't shipped for internal stuff. When
>> designing applications is that because there is something better or just
>> reducing bloat? After a bit of googling it became apparent Spring
>> weren't really showing their modules and OSGI love these days, and the
>> other option was Spring DM but people say its basically retired.
>>
>> Secondly, security, because we use Spring we also use Spring Security,
>> and this is widely used in webapps so ideally I'd like to stick with it
>> for securing my webapp. But when I looked into hooking up Spring
>> Security to Blueprint I hit a bunch of apparent incompatibilities with
>> Karaf 3.x and Blueprint.
>>
>> So, what is the correct way of creating a bean based set of modules with
>> "Enterprise" security (LDAP/JDBC/CAS etc authentication).
>>
>> Thanks
>>
>> Tom
>>
>>
>> --
>> *Tom Barber* | Technical Director
>>
>> meteorite bi
>> *T:* +44 20 8133 3730
>> *W:* www.meteorite.bi | *Skype:* meteorite.consulting
>> *A:* Surrey Technology Centre, Surrey Research Park, Guildford, GU2
>> 7YG, UK
>
--
*Tom Barber* | Technical Director
meteorite bi
*T:* +44 20 8133 3730
*W:* www.meteorite.bi | *Skype:* meteorite.consulting
*A:* Surrey Technology Centre, Surrey Research Park, Guildford, GU2 7YG, UK
Re: Webapp Security, and bean framework in OSGI & Karaf
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
Hi Tom,
Karaf provides Jaas realm and login modules ready to use.
You can directly use RBAC in your webapp based on that.
You should find some details there:
http://karaf.apache.org/manual/latest/developers-guide/security-framework.html
Regards
JB
On 02/08/2015 08:40 PM, Tom Barber wrote:
> Hi guys,
>
> I'm hoping some one or some people can share some insight into the state
> of OSGI and Karaf because I'm trying to port an existing application to
> Karaf and I'm struggling with some bits.
>
> Firstly, Spring vs Blueprint or something else.
>
> My existing app is Spring MVC based, but i'm not particularly bothered
> what it runs as long as it works. As this will take time I downloaded
> Karaf 4.0 M1 with the aim of getting it running on the future stable
> version. I noticed that Blueprint isn't shipped for internal stuff. When
> designing applications is that because there is something better or just
> reducing bloat? After a bit of googling it became apparent Spring
> weren't really showing their modules and OSGI love these days, and the
> other option was Spring DM but people say its basically retired.
>
> Secondly, security, because we use Spring we also use Spring Security,
> and this is widely used in webapps so ideally I'd like to stick with it
> for securing my webapp. But when I looked into hooking up Spring
> Security to Blueprint I hit a bunch of apparent incompatibilities with
> Karaf 3.x and Blueprint.
>
> So, what is the correct way of creating a bean based set of modules with
> "Enterprise" security (LDAP/JDBC/CAS etc authentication).
>
> Thanks
>
> Tom
>
>
> --
> *Tom Barber* | Technical Director
>
> meteorite bi
> *T:* +44 20 8133 3730
> *W:* www.meteorite.bi | *Skype:* meteorite.consulting
> *A:* Surrey Technology Centre, Surrey Research Park, Guildford, GU2 7YG, UK
--
Jean-Baptiste Onofré
jbonofre@apache.org
http://blog.nanthrax.net
Talend - http://www.talend.com
Re: Webapp Security, and bean framework in OSGI & Karaf
Posted by Tom Barber <to...@meteorite.bi>.
Thanks Achim,
I'll give Blueprint and JAAS a go then.
Tom
On 08/02/15 19:50, Achim Nierbeck wrote:
> Hi Tom,
>
> let me answer a couple of your questions.
> See Inline:
>
>
> 2015-02-08 20:40 GMT+01:00 Tom Barber <tom.barber@meteorite.bi
> <ma...@meteorite.bi>>:
>
> Hi guys,
>
> I'm hoping some one or some people can share some insight into the
> state of OSGI and Karaf because I'm trying to port an existing
> application to Karaf and I'm struggling with some bits.
>
> Firstly, Spring vs Blueprint or something else.
>
>
> This solely depends on your use-case and the environment you're aiming
> for.
> As Spring doesn't play so nicely with OSGi, I'd go for blueprint. On
> the other hand maybe Declarative Services will match you better. Again
> depending on your usecases. How much "bean" work do you need and how
> much Dynamic Services do you need.
>
>
> My existing app is Spring MVC based, but i'm not particularly
> bothered what it runs as long as it works. As this will take time
> I downloaded Karaf 4.0 M1 with the aim of getting it running on
> the future stable version. I noticed that Blueprint isn't shipped
> for internal stuff. When designing applications is that because
> there is something better or just reducing bloat? After a bit of
> googling it became apparent Spring weren't really showing their
> modules and OSGI love these days, and the other option was Spring
> DM but people say its basically retired.
>
>
> Spring-dm is retired, yes.
> Blueprint isn't used internally because of "reducing bloat" ;)
>
> Secondly, security, because we use Spring we also use Spring
> Security, and this is widely used in webapps so ideally I'd like
> to stick with it for securing my webapp. But when I looked into
> hooking up Spring Security to Blueprint I hit a bunch of apparent
> incompatibilities with Karaf 3.x and Blueprint.
>
>
> As long as you do jaas, nothing will stop you from having everything
> secured.
> Though I've heard already of people mixing blueprint with spring,
> afaik that should work. It's just about namespaces.
> So it might be possible to use Spring-Security (but don't nail me on this)
>
> So, what is the correct way of creating a bean based set of
> modules with "Enterprise" security (LDAP/JDBC/CAS etc authentication).
>
>
> Make sure it's a JAAS based security, that'll do.
>
> regards, Achim
>
>
> --
>
> Apache Member
> Apache Karaf <http://karaf.apache.org/> Committer & PMC
> OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/>
> Committer & Project Lead
> blog <http://notizblog.nierbeck.de/>
> Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS>
>
> Software Architect / Project Manager / Scrum Master
>
--
*Tom Barber* | Technical Director
meteorite bi
*T:* +44 20 8133 3730
*W:* www.meteorite.bi | *Skype:* meteorite.consulting
*A:* Surrey Technology Centre, Surrey Research Park, Guildford, GU2 7YG, UK
Re: Webapp Security, and bean framework in OSGI & Karaf
Posted by Achim Nierbeck <bc...@googlemail.com>.
Hi Tom,
let me answer a couple of your questions.
See Inline:
2015-02-08 20:40 GMT+01:00 Tom Barber <to...@meteorite.bi>:
> Hi guys,
>
> I'm hoping some one or some people can share some insight into the state
> of OSGI and Karaf because I'm trying to port an existing application to
> Karaf and I'm struggling with some bits.
>
> Firstly, Spring vs Blueprint or something else.
>
This solely depends on your use-case and the environment you're aiming for.
As Spring doesn't play so nicely with OSGi, I'd go for blueprint. On the
other hand maybe Declarative Services will match you better. Again
depending on your usecases. How much "bean" work do you need and how much
Dynamic Services do you need.
>
> My existing app is Spring MVC based, but i'm not particularly bothered
> what it runs as long as it works. As this will take time I downloaded Karaf
> 4.0 M1 with the aim of getting it running on the future stable version. I
> noticed that Blueprint isn't shipped for internal stuff. When designing
> applications is that because there is something better or just reducing
> bloat? After a bit of googling it became apparent Spring weren't really
> showing their modules and OSGI love these days, and the other option was
> Spring DM but people say its basically retired.
>
>
Spring-dm is retired, yes.
Blueprint isn't used internally because of "reducing bloat" ;)
> Secondly, security, because we use Spring we also use Spring Security, and
> this is widely used in webapps so ideally I'd like to stick with it for
> securing my webapp. But when I looked into hooking up Spring Security to
> Blueprint I hit a bunch of apparent incompatibilities with Karaf 3.x and
> Blueprint.
>
>
As long as you do jaas, nothing will stop you from having everything
secured.
Though I've heard already of people mixing blueprint with spring, afaik
that should work. It's just about namespaces.
So it might be possible to use Spring-Security (but don't nail me on this)
> So, what is the correct way of creating a bean based set of modules with
> "Enterprise" security (LDAP/JDBC/CAS etc authentication).
>
>
Make sure it's a JAAS based security, that'll do.
regards, Achim
--
Apache Member
Apache Karaf <http://karaf.apache.org/> Committer & PMC
OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/> Committer &
Project Lead
blog <http://notizblog.nierbeck.de/>
Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS>
Software Architect / Project Manager / Scrum Master