You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by PDiefent <pd...@csc.com> on 2010/05/31 07:39:56 UTC

Basic authentication with tomcat

Hello, 
I would like to secure my Wicket application with basic container
authentication. For this reason I have declared following security context
in my WEB.XML file: 

        <security-constraint> 
                <web-resource-collection> 
                        <web-resource-name>PtsAarWeb</web-resource-name> 
                        <url-pattern>/app/*</url-pattern> 
                        <http-method>GET</http-method> 
                        <http-method>PUT</http-method> 
                        <http-method>POST</http-method> 
                        <http-method>HEAD</http-method> 
                        <http-method>TRACE</http-method> 
                        <http-method>DELETE</http-method> 
                        <http-method>OPTIONS</http-method> 
                </web-resource-collection> 
                <auth-constraint> 
                        <role-name>AarWeb</role-name> 
                </auth-constraint> 
        </security-constraint> 

        <login-config> 
          <auth-method>FORM</auth-method> 
          <form-login-config> 
          <form-login-page>/login</form-login-page> 
          <form-error-page>/loginerror</form-error-page> 
          </form-login-config> 
        </login-config> 

        <security-role> 
          <description> 
            The role that is required to log in to the Manager Application 
          </description> 
          <role-name>AarWeb</role-name> 
        </security-role> 


How can this security realm be mapped with SHIRO ? 

Best regards, Peter 
-- 
View this message in context: http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5120604.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Basic authentication with tomcat

Posted by Kalle Korhonen <ka...@gmail.com>.
But even then Peter, why would you insist on using container security
configuration with Shiro? By definition, Shiro is replacement for
container-managed security. It's far simpler to configure the same
with Shiro and if Shiro read container security configuration, it'd be
limited by that configuration and and it'd be unclear who's
responsible for the security.

Kalle


On Wed, Jun 23, 2010 at 6:44 AM, Les Hazlewood <lh...@apache.org> wrote:
> Hi Peter,
> No worries - no strain ;)
> Shiro does not support reading security settings from web.xml at the moment
> - the INI configuration to which I referred is Shiro's alternative to do the
> same thing.  It supports form-based login as well using the 'authc' default
> filter.  If this isn't sufficient, please open a Jira issue and we'll see if
> we can get it in for 1.1.
> Cheers,
> Les
>
> On Wed, Jun 23, 2010 at 12:13 AM, PDiefent <pd...@csc.com> wrote:
>>
>> Hi Les,
>> I hope not to be a strain on your nerves but my problem deals with
>> container security. With standard wicket technology I couldn't solve my
>> problem so I thought Shiro would be an alternative.
>>
>> My standard security settings for the application are set in the web.xml:
>>
>> <security-constraint>
>>         <web-resource-collection>
>>                 <web-resource-name>PTSAARWEB</web-resource-name>
>>                 <url-pattern>/*</url-pattern>
>>         </web-resource-collection>
>>         <auth-constraint>
>>                 <role-name>JKNZL01</role-name>
>>         </auth-constraint>
>> </security-constraint>
>> <login-config>
>>   <auth-method>FORM</auth-method>
>>   <form-login-config>
>>   <form-login-page>/login.jsp</form-login-page>
>>   <form-error-page>/loginerror.jsp</form-error-page>
>>   </form-login-config>
>> </login-config>
>> <security-role>
>>         <role-name>JKNZL01</role-name>
>> </security-role>
>>
>>
>> In my understanding this will cause the application server to start
>> login.jsp to get username and password.
>>
>> <html>
>>   <head>
>>     <title>Login</title>
>>   </head>
>>   <body bgcolor="white">
>>     <div class="title">Please Login</div>
>>     <form action="j_security_check" method="post">
>>       <table>
>>         <tr>
>>           <td align="right">Username:</td>
>>           <td><input name="j_username"></td>
>>         </tr>
>>         <tr>
>>           <td align="right">Password:</td>
>>           <td>
>>             <input type="password" name="j_password">
>>           </td>
>>         </tr>
>>       </table>
>>       <input type="submit" value="Login">
>>     </form>
>>   </body>
>> </html>
>>
>> The j_security_check method  checks username and password against the user
>> realm (i.e. tomcat-users.xml) and allows or denies access to my
>> application.
>>
>> But in my testing environment with a tomcat application server everybody
>> with the right password can start the application even with the wrong
>> role.
>> In our customer environment with a BEA application server it's the same
>> problem.
>> A JSF based application works fine in both environments with the same
>> security settings.
>>
>> So my question: Is it possible to use container security settings with
>> shiro? Are custom realms the solution - but how to access the conatainer
>> security settings?
>>
>> Thanks for your patience.
>> Best regards, Peter
>>
>>
>>
>>
>>   From:       "Les Hazlewood-2 [via Shiro User]" <[hidden email]>
>>
>>   To:         Peter Diefenthaeler/DEU/CSC@CSC
>>
>>   Date:       21.06.2010 18:05
>>
>>   Subject:    Re: Basic authentication with tomcat
>>
>>
>>
>>
>>
>>
>> Hi Peter,
>>
>> Absolutely.  Please readÂ
>> http://incubator.apache.org/shiro/configuration.html Â  Sections 1.2.2 and
>> 1.2.3 are how you define static users, roles and permissions.
>>
>> Cheers,
>>
>> Les
>>
>> On Mon, Jun 21, 2010 at 1:06 AM, PDiefent <[hidden email]> wrote:
>>
>>       Hi Les,
>>       thanks for your detailed answer. The only thing I don't unsterstand
>>       is how
>>       to use permissions and passwords from the tomcat realm?
>>
>>       In my tomcat/conf folder I have a tomcat-users.xml with users and
>>       roles:
>>
>>       <tomcat-users>
>>              <user name="admin" password="admin"
>>       roles="admin,manager" />
>>        <user username="eoe1" password="eoe1" roles="AarWeb"/>
>>        <user username="eoe" password="zorro" roles="AarWeb"/>
>>        <user username="admin" password="admin" roles="admin,manager"/>
>>        <role rolename="AarWeb"/>
>>        <role rolename="manager"/>
>>        <role rolename="admin"/>
>>       </tomcat-users>
>>
>>       How can this be matched with shiro security?
>>
>>       Thanks, Peter
>>
>>       --
>>       View this message in context:
>>
>> http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5203301.html
>>       Sent from the Shiro User mailing list archive at Nabble.com.
>>
>>
>> View message @
>>
>> http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5204949.html
>>
>> To unsubscribe from Re: Basic authentication with tomcat, click here.
>>
>>
>>
>> ________________________________
>> View this message in context: Re: Basic authentication with tomcat
>> Sent from the Shiro User mailing list archive at Nabble.com.
>
>

Re: Basic authentication with tomcat

Posted by Les Hazlewood <lh...@apache.org>.
Hi Peter,

No worries - no strain ;)

Shiro does not support reading security settings from web.xml at the moment
- the INI configuration to which I referred is Shiro's alternative to do the
same thing.  It supports form-based login as well using the 'authc' default
filter.  If this isn't sufficient, please open a Jira issue and we'll see if
we can get it in for 1.1.

Cheers,

Les

On Wed, Jun 23, 2010 at 12:13 AM, PDiefent <pd...@csc.com> wrote:

> Hi Les,
> I hope not to be a strain on your nerves but my problem deals with
> container security. With standard wicket technology I couldn't solve my
> problem so I thought Shiro would be an alternative.
>
> My standard security settings for the application are set in the web.xml:
>
> <security-constraint>
>         <web-resource-collection>
>                 <web-resource-name>PTSAARWEB</web-resource-name>
>                 <url-pattern>/*</url-pattern>
>         </web-resource-collection>
>         <auth-constraint>
>                 <role-name>JKNZL01</role-name>
>         </auth-constraint>
> </security-constraint>
> <login-config>
>   <auth-method>FORM</auth-method>
>   <form-login-config>
>   <form-login-page>/login.jsp</form-login-page>
>   <form-error-page>/loginerror.jsp</form-error-page>
>   </form-login-config>
> </login-config>
> <security-role>
>         <role-name>JKNZL01</role-name>
> </security-role>
>
>
> In my understanding this will cause the application server to start
> login.jsp to get username and password.
>
> <html>
>   <head>
>     <title>Login</title>
>   </head>
>   <body bgcolor="white">
>     <div class="title">Please Login</div>
>     <form action="j_security_check" method="post">
>       <table>
>         <tr>
>           <td align="right">Username:</td>
>           <td><input name="j_username"></td>
>         </tr>
>         <tr>
>           <td align="right">Password:</td>
>           <td>
>             <input type="password" name="j_password">
>           </td>
>         </tr>
>       </table>
>       <input type="submit" value="Login">
>     </form>
>   </body>
> </html>
>
> The j_security_check method  checks username and password against the user
> realm (i.e. tomcat-users.xml) and allows or denies access to my
> application.
>
> But in my testing environment with a tomcat application server everybody
> with the right password can start the application even with the wrong role.
>
> In our customer environment with a BEA application server it's the same
> problem.
> A JSF based application works fine in both environments with the same
> security settings.
>
> So my question: Is it possible to use container security settings with
> shiro? Are custom realms the solution - but how to access the conatainer
> security settings?
>
> Thanks for your patience.
> Best regards, Peter
>
>
>
>
>   From:       "Les Hazlewood-2 [via Shiro User]" <[hidden email]<http://user/SendEmail.jtp?type=node&node=5212036&i=0>>
>
>
>   To:         Peter Diefenthaeler/DEU/CSC@CSC
>
>   Date:       21.06.2010 18:05
>
>   Subject:    Re: Basic authentication with tomcat
>
>
>
>
>
>
> Hi Peter,
>
> Absolutely. Â Please readÂ
> http://incubator.apache.org/shiro/configuration.html   Sections 1.2.2 and
>
> 1.2.3 are how you define static users, roles and permissions.
>
> Cheers,
>
> Les
>
> On Mon, Jun 21, 2010 at 1:06 AM, PDiefent <[hidden email]> wrote:
>
>       Hi Les,
>       thanks for your detailed answer. The only thing I don't unsterstand
>       is how
>       to use permissions and passwords from the tomcat realm?
>
>       In my tomcat/conf folder I have a tomcat-users.xml with users and
>       roles:
>
>       <tomcat-users>
>       Â  Â  Â  Â <user name="admin" password="admin"
>       roles="admin,manager" />
>       Â <user username="eoe1" password="eoe1" roles="AarWeb"/>
>       Â <user username="eoe" password="zorro" roles="AarWeb"/>
>       Â <user username="admin" password="admin" roles="admin,manager"/>
>       Â <role rolename="AarWeb"/>
>       Â <role rolename="manager"/>
>       Â <role rolename="admin"/>
>       </tomcat-users>
>
>       How can this be matched with shiro security?
>
>       Thanks, Peter
>
>       --
>       View this message in context:
>
> http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5203301.html<http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5203301.html?by-user=t>
>       Sent from the Shiro User mailing list archive at Nabble.com.
>
>
> View message @
>
> http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5204949.html<http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5204949.html?by-user=t>
>
> To unsubscribe from Re: Basic authentication with tomcat, click here.
>
>
>
> ------------------------------
> View this message in context: Re: Basic authentication with tomcat<http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5212036.html>
>
> Sent from the Shiro User mailing list archive<http://shiro-user.582556.n2.nabble.com/>at Nabble.com.
>

Re: Basic authentication with tomcat

Posted by PDiefent <pd...@csc.com>.
Hi Les,
I hope not to be a strain on your nerves but my problem deals with
container security. With standard wicket technology I couldn't solve my
problem so I thought Shiro would be an alternative.

My standard security settings for the application are set in the web.xml:

<security-constraint>
	<web-resource-collection>
		<web-resource-name>PTSAARWEB</web-resource-name>
		<url-pattern>/*</url-pattern>
	</web-resource-collection>
	<auth-constraint>
		<role-name>JKNZL01</role-name>
	</auth-constraint>
</security-constraint>
<login-config>
 	<auth-method>FORM</auth-method>
 	<form-login-config>
  	 <form-login-page>/login.jsp</form-login-page>
  	 <form-error-page>/loginerror.jsp</form-error-page>
 	</form-login-config>
</login-config>
<security-role>
	<role-name>JKNZL01</role-name>
</security-role>


In my understanding this will cause the application server to start
login.jsp to get username and password.

<html>
  <head>
    <title>Login</title>
  </head>
  <body bgcolor="white">
    <div class="title">Please Login</div>
    <form action="j_security_check" method="post">
      <table>
        <tr>
          <td align="right">Username:</td>
          <td><input name="j_username"></td>
        </tr>
        <tr>
          <td align="right">Password:</td>
          <td>
            <input type="password" name="j_password">
          </td>
        </tr>
      </table>
      <input type="submit" value="Login">
    </form>
  </body>
</html>

The j_security_check method  checks username and password against the user
realm (i.e. tomcat-users.xml) and allows or denies access to my
application.

But in my testing environment with a tomcat application server everybody
with the right password can start the application even with the wrong role.
In our customer environment with a BEA application server it's the same
problem.
A JSF based application works fine in both environments with the same
security settings.

So my question: Is it possible to use container security settings with
shiro? Are custom realms the solution - but how to access the conatainer
security settings?

Thanks for your patience.
Best regards, Peter



                                                                       
  From:       "Les Hazlewood-2 [via Shiro User]" <ml...@n2.nabble.com>
                                                                       
  To:         Peter Diefenthaeler/DEU/CSC@CSC                          
                                                                       
  Date:       21.06.2010 18:05                                         
                                                                       
  Subject:    Re: Basic authentication with tomcat                     
                                                                       





Hi Peter,

Absolutely.  Please readÂ
http://incubator.apache.org/shiro/configuration.html   Sections 1.2.2 and
1.2.3 are how you define static users, roles and permissions.

Cheers,

Les

On Mon, Jun 21, 2010 at 1:06 AM, PDiefent <[hidden email]> wrote:

      Hi Les,
      thanks for your detailed answer. The only thing I don't unsterstand
      is how
      to use permissions and passwords from the tomcat realm?

      In my tomcat/conf folder I have a tomcat-users.xml with users and
      roles:

      <tomcat-users>
             <user name="admin" password="admin"
      roles="admin,manager" />
       <user username="eoe1" password="eoe1" roles="AarWeb"/>
       <user username="eoe" password="zorro" roles="AarWeb"/>
       <user username="admin" password="admin" roles="admin,manager"/>
       <role rolename="AarWeb"/>
       <role rolename="manager"/>
       <role rolename="admin"/>
      </tomcat-users>

      How can this be matched with shiro security?

      Thanks, Peter

      --
      View this message in context:
      http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5203301.html
      Sent from the Shiro User mailing list archive at Nabble.com.


View message @
http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5204949.html

To unsubscribe from Re: Basic authentication with tomcat, click here.



-- 
View this message in context: http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5212036.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Basic authentication with tomcat

Posted by Les Hazlewood <lh...@apache.org>.
Hi Peter,

Absolutely.  Please read
http://incubator.apache.org/shiro/configuration.html   Sections 1.2.2 and
1.2.3 are how you define static users, roles and permissions.

Cheers,

Les

On Mon, Jun 21, 2010 at 1:06 AM, PDiefent <pd...@csc.com> wrote:

>
> Hi Les,
> thanks for your detailed answer. The only thing I don't unsterstand is how
> to use permissions and passwords from the tomcat realm?
>
> In my tomcat/conf folder I have a tomcat-users.xml with users and roles:
>
> <tomcat-users>
>        <user name="admin" password="admin" roles="admin,manager" />
>  <user username="eoe1" password="eoe1" roles="AarWeb"/>
>  <user username="eoe" password="zorro" roles="AarWeb"/>
>  <user username="admin" password="admin" roles="admin,manager"/>
>  <role rolename="AarWeb"/>
>  <role rolename="manager"/>
>  <role rolename="admin"/>
> </tomcat-users>
>
> How can this be matched with shiro security?
>
> Thanks, Peter
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5203301.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: Basic authentication with tomcat

Posted by PDiefent <pd...@csc.com>.
Hi Les,
thanks for your detailed answer. The only thing I don't unsterstand is how
to use permissions and passwords from the tomcat realm?

In my tomcat/conf folder I have a tomcat-users.xml with users and roles:

<tomcat-users>
	<user name="admin" password="admin" roles="admin,manager" />
  <user username="eoe1" password="eoe1" roles="AarWeb"/>
  <user username="eoe" password="zorro" roles="AarWeb"/>
  <user username="admin" password="admin" roles="admin,manager"/>
  <role rolename="AarWeb"/>
  <role rolename="manager"/>
  <role rolename="admin"/>
</tomcat-users>

How can this be matched with shiro security?

Thanks, Peter

-- 
View this message in context: http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5203301.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Basic authentication with tomcat

Posted by Les Hazlewood <lh...@apache.org>.
Hi Peter,

You don't need the JndiRealmFactory unless you need to look up your
Realm implementation from JNDI.  This really exists for EJB
environments and shouldn't be necessary in most cases.

The easiest way to configure Shiro is to use the simplified INI
configuration.  For web apps, you can define the Shiro INI Filter in
web.xml as described here:

http://incubator.apache.org/shiro/web.html

INI is broken up into sections.  The [main] section is where you
define all of your object graphs and Shiro-specific beans.  That is
covered in detail here:

http://incubator.apache.org/shiro/configuration.html

So, if you wanted to create a custom realm, you could start off with this:

[main]
myRealm = com.company.security.shiro.CustomRealmImplementation
# config properties as necessary
...
securityManager.realm = $myRealm


As for supporting REST-base security policies, you can do that by
defining the HttpMethodPermissionFilter:

http://incubator.apache.org/shiro/static/current/apidocs/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.html

For example:

[main]
myRealm = ...
...
securityManager.realm = $myRealm
...

# Create the HttpMethodPermissionFilter and give it the name 'rest'.
It will then be available for filter chain definitions in the [urls]
section.
rest = org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter

[urls]
/app/** = authc, rest

This filter chain definition means that the request has to both be
authenticated (authc) as well as have the permission to make a REST
call.

See the HttpMethodPermissionFilter JavaDoc for more about REST-based
permission checks.

Also notice in the [urls] section, we referenced the 'authc' filter.
The 'authc' filter and a number of other default filters are enabled
automatically in the [main] section for web apps.  You can configure
them like any other bean (e.g. authc.loginUrl = /login  etc).   The
default filters (and the name by which you can reference/configure
them in INI) are defined here:

http://incubator.apache.org/shiro/static/current/apidocs/org/apache/shiro/web/filter/mgt/DefaultFilter.html

Anyway, I hope that helps clear up a lot of this.  I'm going to add
most of this stuff to the Shiro documentation today.  Sorry about the
confusion!!!

Best,

Les

On Tue, Jun 1, 2010 at 1:23 AM, PDiefent <pd...@csc.com> wrote:
>
> I'm a little bit stuck with the Shiro documentaion.
> I really miss a little example to set up a realm coming from the web
> container ...
>
> I think I have to start with the Shiro JndiRealmFactory ?
>
> I'm a bit clueless.
> Peter
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5124977.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: Basic authentication with tomcat

Posted by PDiefent <pd...@csc.com>.
I'm a little bit stuck with the Shiro documentaion. 
I really miss a little example to set up a realm coming from the web
container ...

I think I have to start with the Shiro JndiRealmFactory ?

I'm a bit clueless.
Peter
-- 
View this message in context: http://shiro-user.582556.n2.nabble.com/Basic-authentication-with-tomcat-tp5120604p5124977.html
Sent from the Shiro User mailing list archive at Nabble.com.