Enterprise Java Development@TOPIC@

Chapter 116. JAX-RS Resource Security

116.1. Web Security Setup
116.1.1. Assign WAR security-domain: jboss-web.xml
116.1.2. Assign WAR auth-method: web.xml
116.2. JAX-RS Resource Class
116.2.1. JAX-RS Debug Methods
116.3. JAX-RS Client Authentication
116.3.1. Authorization Header
116.3.2. JAX-RS Client Authorization Filter
116.3.3. JAX-RS Client Authorization Filter Registration
116.3.4. Protect BASIC Credentials with HTTPS
116.4. Declarative Access Control
116.4.1. Two intermediate contexts defined to access Nested Pinger Resource
116.4.2. Same Nested Pinger Resource Exposed
116.4.3. Declarative Access Control Constraints
116.4.4. Nested Resource Called from Two URIs
116.5. Summary

116.1. Web Security Setup

$ jar tf target/securePingJaxRsWAR-5.0.0-SNAPSHOT.war
...
WEB-INF/beans.xml
WEB-INF/web.xml
WEB-INF/jboss-web.xml


# jboss-web.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE jboss-web>

<jboss-web xmlns="http://www.jboss.com/xml/ns/javaee"

           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

           xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-web_12_0.xsd"

           version="12.0">

    <security-domain>other</security-domain>      

</jboss-web>

  • BASIC - username and password passed in "Authentication" header Base64 encoded

  • FORM - credentials submitted as part of a form response

  • CLIENT-CERT - client public key authenticated as part of HTTPS connection

  • DIGEST - an encyrpted form of BASIC

  • EXTERNAL


# web.xml

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

  version="4.0">

    ...

</web-app>



# web.xml

<login-config>

  <auth-method>BASIC</auth-method>

  <realm-name>ApplicationRealm</realm-name>

</login-config>

  • May need separate WARs for mixed solutions using BASIC (API) and FORM

  • Wildfly legacy security offers the following option


# web.xml

  <!-- if mixing JAX-RS BASIC with HTML FORM

  http://undertow.io/undertow-docs/undertow-docs-1.3.0/index.html#servlet-security

   -->

  <auth-method>BASIC?silent=true,FORM</auth-method>

  • API will silently accept BASIC Authorization header if supplied

  • API will not provide any response codes or headers making browser believe it accepts BASIC

  • Web UI will act as if it only uses FORM

116.2. JAX-RS Resource Class

@ApplicationPath("api")

public class SecurePingJaxRsApplication extends Application {

@Path("ping")

public class SecurePingResource {

    //this injection requires CDI, which requires a WEB-INF/beans.xml file be in place to activate

    @EJB(beanName="SecurePingEJB", beanInterface=SecurePingLocal.class)

    private SecurePing secureService;

    

    @Context

    private SecurityContext ctx;

@Path("whoAmI")

@GET

@Produces(MediaType.TEXT_PLAIN)

public Response whoAmI() {

    ResponseBuilder rb = null;

    try {

        rb = Response.ok(secureService.whoAmI());

    } catch (Exception ex) {

        rb=makeExceptionResponse(ex);

    }

    return rb.build();

}

@Path("roles/{role}")

@GET

@Produces(MediaType.TEXT_PLAIN)

public Response isCallerInRole(@PathParam("role") String role) {

    ResponseBuilder rb = null;

    try {

        rb = Response.ok(secureService.isCallerInRole(role));

    } catch (Exception ex) {

        rb=makeExceptionResponse(ex);

    }

    return rb.build();        

}

116.3. JAX-RS Client Authentication

import java.io.IOException;

import java.util.Base64;


import javax.ws.rs.client.ClientRequestContext;

import javax.ws.rs.client.ClientRequestFilter;

import javax.ws.rs.core.MultivaluedMap;

public class BasicAuthnFilter implements ClientRequestFilter {

    private final String authn;

    

    public BasicAuthnFilter(String username, String password) {

        String credentials = username + ":" + password;

        authn = "Basic " + Base64.getEncoder().encodeToString(credentials.getBytes());

    }


    @Override

    public void filter(ClientRequestContext requestContext) throws IOException {

        MultivaluedMap<String, Object> headers = requestContext.getHeaders();

        headers.add("Authorization", authn);

    }

}

# client

URI whoAmIUri = UriBuilder.fromUri(baseHttpUrl).path("whoAmI").build();

WebTarget target = jaxRsClient.target(whoAmIUri);

logger.debug("GET {}", target.getUri());

Response response = target.request(MediaType.TEXT_PLAIN).get();

Cache JAX-RS Client and Filter Chains

If switching identities, you will need multiple JAX-RS Client instances. Best performance to cache Client instances rather than re-construct each and their filter chain each time. 

private Map<String, Client> jaxRsClients = new HashMap<>();


# web.xml

<security-constraint>

    <web-resource-collection>

        <web-resource-name>methods</web-resource-name>

        <url-pattern>/api/ping/whoAmI</url-pattern>

        <url-pattern>/api/ping/canAccess</url-pattern>

    </web-resource-collection>

    <user-data-constraint>

        <transport-guarantee>CONFIDENTIAL</transport-guarantee>

    </user-data-constraint>

</security-constraint>

116.4. Declarative Access Control



@Path("secured")

public Pinger authenticated() {

    return new Pinger();

}



@Path("unsecured")

public Pinger anonymous() {

    return new Pinger();

}

public class Pinger {

    @Path("pingUser")

    @GET

    @Produces({MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML})

    public Response pingUser() {

        ResponseBuilder rb = null;

        try {

            PingResult result = makeResourcePayload(secureService!=null ?

                    secureService.pingUser() : "no ejb injected!!!");

            rb = secureService!=null ? 

                    Response.ok(result) :

                    Response.serverError().entity(result);

        } catch (EJBAccessException ex) {

            PingResult entity = makeResourcePayload(ex.toString());

            rb = Response.status(Status.FORBIDDEN).entity(entity);                

        } catch (Exception ex) {

            rb=makeExceptionResponse(ex);

        }

        

        return rb.build();

    }


# web.xml

<security-constraint>

    <web-resource-collection>

        <web-resource-name>secured</web-resource-name>

        <url-pattern>/api/ping/secured/pingUser</url-pattern>

    </web-resource-collection>

    <auth-constraint>

        <role-name>user</role-name>

    </auth-constraint>

</security-constraint>

116.5. Summary