Mais conteĂșdo relacionado Semelhante a Finally, EE Security API JSR 375 (20) Finally, EE Security API JSR 3753. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.3
Safe Harbor Statement
The following is intended to outline our general product direction. It is
intended for information purposes only, and may not be incorporated into
any contract. It is not a commitment to deliver any material, code, or
functionality, and should not be relied upon in making purchasing
decisions. The development, release, and timing of any features or
functionality described for Oracleâs products remains at the sole
discretion of Oracle.
4. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.4
Agenda
§ï§âŻ Motivations
§ï§âŻ A New JSR
§ï§âŻ Ideas
§ï§âŻ Get Involved
§ï§âŻ Q & A
5. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.5
Agenda
§ï§âŻ Motivations
§ï§âŻ A New JSR
§ï§âŻ Ideas
§ï§âŻ Get Involved
§ï§âŻ Q & A
6. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.6
Why a Java EE Security API JSR?
§ï§âŻ EE 8 survey results
§ï§âŻ 4500 total responses
§ï§âŻ Priorities Pie Chart
7. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.7
Whatâs wrong with Java EE Security?
"The ultimate goal is to have basic security working without the need of
any kind of vendor specific configuration, deployment descriptors, or
whatever. â â Arjan Tijms
â[The EE security] model is problematic in cloud/PaaS environments
where developers do not necessarily have easy access to non-standard
vendor runtime features and a self-contained application is much easier
to manage.â â Reza Rahman
The community saysâŠ
8. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.8
Whatâs wrong with Java EE Security?
§ï§âŻ Java EE Security viewed as not portable, abstract/confusing,
antiquated
§ï§âŻ Doesnât fit cloud app developer paradigm: requires app server
configuration
§ï§âŻ Losing value to non-standard 3rd Party FrameworksâŠless likely to
move back to Java EE when requirements increase
9. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.9
What to do?
§ï§âŻ Plug the portability holes
§ï§âŻ Modernize
â⯠Context Dependency Injection (CDI)
§ï§âŻ Intercept at Access Enforcement Points: POJO methods
â⯠Expression Language (EL)
§ï§âŻ Enable Access Enforcement Points with complex rules
§ï§âŻ App Developer Friendly
â⯠Common security configurations not requiring server changes
â⯠Annotation defaults not requiring XML
10. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.10
Agenda
§ï§âŻ Motivations
§ï§âŻ A New JSR
§ï§âŻ Ideas
§ï§âŻ Get Involved
§ï§âŻ Q & A
11. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.11
JSR 375 History
§ï§âŻ August 2014: First proposed to Oracle Java EE Architects
§ï§âŻ December 2014: Approved by JCP
§ï§âŻ Expert Group nominations:
â⯠EE API veterans: many JSRs, many years struggling with Security API
â⯠3rd party security framework creators/developers
â⯠EE platform security implementers
§ï§âŻ March 2015: Expert Group started discussions
12. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.12
JSR 375 â Expert Group
Name Representing
Adam Bien Individual
David Blevins Tomitribe
Rudy De Busscher Individual
Ivar Grimstad Individual
Les Hazlewood Stormpath, Inc.
Will Hopkins Oracle
Werner Keil Individual
13. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.13
JSR 375 â Expert Group
Name Representing
Matt Konda Jemurai
Alex Kosowski Oracle
Darran Lofthouse RedHat
Jean-Louis Monteiro Tomitribe
Ajay Reddy IBM
Pedro Igor Silva RedHat
Arjan Tijms ZEEF
14. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.14
JSR 375 History
§ï§âŻ In first month, expert group had an EXPLOSION of activity
â⯠Lot of Brainstorming!
â⯠237 messages on EG mailing list
â⯠81 commits in Github playgrounds for examples and proposals
â⯠24 JIRA issues
15. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.15
Agenda
§ï§âŻ Motivations
§ï§âŻ A New JSR
§ï§âŻ Ideas
§ï§âŻ Get Involved
§ï§âŻ Q & A
16. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.16
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
17. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.17
Ideas
To modernize, standardize, simplify
Identity Store
Authentication
Mechanism
Security Context
Authorization
Interceptors
Role/Permission
Assignment
Password Aliasing
18. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.18
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
19. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.19
Ideas - Terminology
§ï§âŻ EG discussions revealed inconsistency in security API terms
§ï§âŻ Different EE containers have different names for the same concepts
§ï§âŻ When âsomethingâ gets authenticated, is that something aâŠ
â⯠A User? (e.g. HttpServletRequest.getUserPrincipal)
â⯠A Caller? (e.g. EJBContext.getCallerPrincipal)
§ï§âŻ What is a group?
â⯠A group of users?
â⯠A permission
â⯠Vs Role?
20. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.20
Ideas - Terminology
§ï§âŻ What is that âsomethingâ where identities are stored?
â⯠security provider (WebLogic)
â⯠realm (Tomcat, some hints in Servlet spec)
â⯠(auth) repository
â⯠(auth) store
â⯠login module (JAAS)
â⯠identity manager (Undertow)
â⯠authenticator (Resin, OmniSecurity, Seam Security)
â⯠authentication provider (Spring Security)
â⯠identity provider
21. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.21
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
22. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.22
Use Case
§ï§âŻ Application manages its own users and groups
§ï§âŻ Application needs to authenticate users in order to assign Roles
§ï§âŻ Application authenticates based on application-domain models
§ï§âŻ Application needs to use an authentication method not supported on
the server, like OpenID Connect
§ï§âŻ Developer wants to use portable EE Authentication standard
API for Authentication Mechanism
23. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.23
Current Solutions
§ï§âŻ Proprietary server support
§ï§âŻ 3rd party security frameworks provide authentication
§ï§âŻ JASPIC: Java Authentication Service Provider Interface for Containers
API for Authentication Mechanism
24. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.24
JASPIC
§ï§âŻ Java Authentication Service Provider Interface for Containers
§ï§âŻ JSR 196, Maintenance Release 1.1, in 2013
§ï§âŻ Standardized, portable, thin, low-level authentication framework
§ï§âŻ Extensible from within an application
§ï§âŻ Integrates with the container to build an authenticated Subject
§ï§âŻ Implement any authentication method
25. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.25
JASPIC Server Auth Module
public interface ServerAuthModule {
public void initialize(MessagePolicy requestPolicy,
MessagePolicy responsePolicy, CallbackHandler handler,
Map options) throws AuthException;
public AuthStatus validateRequest(MessageInfo messageInfo,
Subject clientSubject, Subject serviceSubject);
public Class<?>[] getSupportedMessageTypes();
public AuthStatus secureResponse(MessageInfo messageInfo,
Subject serviceSubject);
public void cleanSubject(MessageInfo messageInfo, Subject subject);
}
26. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.26
JASPIC Per-Application Installation
ServletContextListener
AuthConfigFactory
AuthConfigProvider
ServerAuthConfig
ServerAuthContext
ServerAuthModule
27. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.27
Ideas â Simple ServerAuthModule Installation
ServletContextListener
AuthConfigFactory
AuthConfigProvider
ServerAuthConfig
ServerAuthContext
ServerAuthModule
ServletContextListener
28. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.28
Ideas â Simple ServerAuthModule Installation
@WebListener
public class SamRegistrationListener implements ServletContextListener {
@Override
public void contextInitialized(ServletContextEvent sce) {
Jaspic.registerServerAuthModule(new TokenAuthModule(),
sce.getServletContext());
}
@Override
public void contextDestroyed(ServletContextEvent sce) {
}
}
29. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.29
Ideas â Simple ServerAuthModule Installation
@Authenticator("org.acme.TokenAuthModule")
@WebServlet("/SimpleServlet")
@ServletSecurity(@HttpConstraint(rolesAllowed = {"manager"}))
public class SimpleServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException {
response.getWriter().print("my GET");
}
}
30. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.30
Ideas â Profile Specific Helper Classes
public class BasicServerAuthModule implements ServerAuthModule {
public void initialize(âŠ) throws AuthException { ⊠}
public Class<?>[] getSupportedMessageTypes() { ⊠}
public AuthStatus secureResponse(MessageInfo messageInfo,
Subject serviceSubject) throws AuthException { ⊠}
public void cleanSubject(MessageInfo messageInfo, Subject subject)
throws AuthException { ⊠}
public AuthStatus validateRequest(MessageInfo messageInfo,
Subject clientSubject, Subject serviceSubject) throws AuthException {
final HttpServletRequest request =
(HttpServletRequest) messageInfo.getRequestMessage();
⊠}
31. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.31
Ideas â Profile Specific Helper Classes
public class BasicServerAuthModule extends HttpServerAuthModule {
public AuthStatus validateHttpRequest(HttpServletRequest request,
HttpServletResponse response, HttpMessageContext httpMessageContext)
throws AuthException {
âŠ
}
}
32. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.32
Ideas â Profile Specific Helper Classes
public class BasicServerAuthModule extends HttpServerAuthModule {
public AuthStatus validateHttpRequest(HttpServletRequest request,
HttpServletResponse response, HttpMessageContext httpMessageContext)
throws AuthException {
final String header = request.getHeader("Authorization");
final String[] credentials = parseCredentials(header);
final String username = credentials[0];
final String password = credentials[1];
if (!"snoopy".equals(username) || !"woodst0ck".equals(password)) {
return FAILURE;
} // No callbacks required!!!
return httpMessageContext.notifyContainerAboutLogin(
"snoopy",
// the groups/roles of the authenticated user
Arrays.asList("RedBaron", "JoeCool", "MansBestFriend"));
}
33. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.33
Ideas â Standardized Authenticators
@Authenticator("javax.security.authenticator.OpenIDConnect")
@WebServlet("/SimpleServlet")
@ServletSecurity(@HttpConstraint(rolesAllowed = {"manager"}))
public class SimpleServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException {
response.getWriter().print("my GET");
}
}
§ï§âŻ OpenID Connect ServerAuthModule
34. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.34
Ideas â Authentication Events
§ï§âŻ Throw standardized CDI events at important moments
â⯠PreAuthenticate Event
â⯠PostAuthenticate Event
â⯠PreLogout Event
â⯠PostLogout Event
§ï§âŻ Possible uses:
â⯠Tracking number of logged-in users
â⯠Tracking failed login attempts per account
â⯠Side effects, like creating a new local user after initial successful
authentication via a remote authentication provider
â⯠Loading application-specific user preferences
35. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.35
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
36. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.36
Use Case
§ï§âŻ Application manages its own users and groups
§ï§âŻ Need to access a repository of identities, like users
§ï§âŻ Users may be stored in app-specified repository (e.g. LDAP)
§ï§âŻ Users are managed without access to server configuration
API for Identity Store
37. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.37
Survey Results
API for Identity Store
'
Should we simplify authorization by introducing an EL-enabled authorization
annotation?
'
Should we standardize on requirements for simple security providers and their
configuration?
'
'
Approximately'58%'thought'we'should'add'support'for'password'aliases,'including'the'
ability'to'provision'credentials'along'with'the'application.'
'
70%'thought'that'we'should'standardize'group`to`role'mapping.'
'
53%'thought'we'should'simplify'JASPIC'authentication.'
'
67%'thought'that'we'should'simplify'authorization'and'make'it'more'flexible'by'
introducing'EL`based'authorization'annotations,'introducing'a'capability'more'general'
than'use'of'@RolesAllowed'and'simpler'than'use'of'interceptors'to'do'programmatic'
authorization.'
'
65%'thought'we'should'standardize'on'requirements'for'simple'security'providers'and'
their'configuration.'
38. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.38
Current Solutions
§ï§âŻ No Java EE support
§ï§âŻ Only proprietary server support
§ï§âŻ 3rd party security frameworks provide user/group APIs
API for Identity Store
39. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.39
Ideas â Identity Store
public interface Identity {
String getUsername();
char[] getPassword();
boolean isAccountExpired();
boolean isAccountLocked();
boolean isPasswordExpired();
boolean isEnabled();
IdentityAttributeValue getAttribute(String name);
}
public interface IdentityAttributeValue {
String getValue();
String getMetaInfo(String name);
}
40. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.40
Ideas â Identity Store
public interface IdentityStore{
Identity loadIdentityByName(String name);
void changePassword(char[] oldPassword, char[] newPassword);
void createIdentity(Identity user);
void deleteIdentity(String name);
void updateIdentity(Identity identity);
boolean identityExists(String name);
void createGroup(String group);
void deleteGroup(String group);
void addIdentityToGroup(String name, String group);
void removeIdentityFromGroup(String name, String group);
boolean isIdentityInGroup(String name, String group);
List<String> getIdentityGroups(String name);
}
41. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.41
Ideas â Identity Store
IdentityStore
LDAP Server
Identity
DBFile
42. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.42
Ideas â Identity Store
@LdapIdentityStore(name=âjava:app/prodIdentityStoreâ,
ldapUrl=âldap://blahâ, ldapUser=âElDapâ,ldapPassword=âwelcomeâ)
public class MyAuthenticator {
@Resource(lookup=âjava:app/prodIdentityStoreâ)
private IdentityStore identityStore;
private boolean isAccountEnabled(String username) {
return identityStore.loadUserByUsername(username).isEnabled();
} âŠ
}
43. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.43
Ideas â Identity Store
@EmbeddedIdentityStore(name=âjava:app/devIdentityStoreâ,
{@Identity(username="ray", password="secret", groups="admin"),
@Identity(username="jo", password="secret", groups="user"),
@Identity(username="sam", password="secret", groups="user")})
@DatabaseIdentityStore(name=âjava:app/testIdentityStoreâ,
lookup="somedatabase",
userQuery="SELECT password FROM principals WHERE username=?",
groupQuery="SELECT group FROM groups where username=?", ...)
44. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.44
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
45. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.45
Use Case
§ï§âŻ Application uses passwords to access resources like LDAP and DB
§ï§âŻ Passwords stored in annotations, deployment descriptors
§ï§âŻ Best practices dictate that passwords are never stored in clear text
§ï§âŻ Need a portable way to protect stored passwords
API for Password Aliasing
46. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.46
Survey Results
§ï§âŻ Deferred from Java EE 7
API for Password Aliasing
Of'the'small'fraction'of'participants'who'added'comments,'most'of'these'strongly'urged'
for'improvements'in'logging'â'either'by'the'revision'of'java.util.logging,'or'replacement'
of'its'use'by'either'slf4j,''slf4j'with'LogBack,'or'log4j.'
'
'
'
Security'
'
Most'of'the'suggested'improvements'in'the'security'area'received'strong'support.'
'
Should we add support for password aliases (including the ability to provision
credentials along with the application)?
'
Should we standardize group-to-role mapping?
47. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.47
Current Solutions
§ï§âŻ No Java EE support
§ï§âŻ Proprietary server support, e.g. GlassFish
§ï§âŻ 3rd party security framework support for embedded password
encryption, not aliasing
API for Password Aliasing
48. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.48
Ideas â Password Aliasing
§ï§âŻ For annotations
@DataSourceDefinition(
name="java:app/jdbc/test",
user="root",
password="${ALIAS=password}",âŠ)
§ï§âŻ For deployment descriptors
<data-source>
<name>java:app/env/testDS</name>
<user>APP</user>
<password>${ALIAS=password}</password>
âŠ
</data-source>
49. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.49
Ideas â Password Aliasing
${ALIAS=token} "mysecret"
Resolved
when used
Cleared
when done
50. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.50
Ideas â Password Aliasing
Password Alias
Archive
51. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.51
Ideas â Password Aliasing
§ï§âŻ For configuration: Annotations, Deployment Descriptors
§ï§âŻ Secure credentials archive for bundling the alias and actual password
values with applications
§ï§âŻ Platform consumes the credentials archive upon deployment
§ï§âŻ Standard tooling for CRUD operations on the credential archive, e.g.
keytool
52. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.52
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
53. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.53
Use Case
§ï§âŻ Application manages its own users and groups
§ï§âŻ Application needs to assign roles (i.e., authorities, permissions) to
users and groups, based on application-specific model
§ï§âŻ Users may be stored in app-specified repository (e.g. LDAP)
§ï§âŻ Users are managed without access to server configuration
API for Role/Permission Assignment
54. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.54
Survey Results
API for Role/Permission Assignment
Security'
'
Most'of'the'suggested'improvements'in'the'security'area'received'strong'support.'
'
Should we add support for password aliases (including the ability to provision
credentials along with the application)?
'
Should we standardize group-to-role mapping?
55. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.55
Current Solutions
§ï§âŻ No Java EE support
§ï§âŻ Only proprietary server support
§ï§âŻ 3rd party security frameworks provide role/authority/permission APIs
API for Role/Permission Assignment
56. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.56
Ideas â Standardized Role Mapping
§ï§âŻ Support in Deployment Descriptors, e.g. web.xml
<security-role-map>
<!-- Role name as set/returned by Authentication Module -->
<group>MANAGER</group>
<!-- Role name for mapping -->
<role-name>EDIT_ACCOUNTS</role-name>
</security-role-map>
<!â One-to-one group to role mapping -->
<security-role-map groupToRoleMapping="false" />
57. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.57
Ideas â Role Mapping Annotation
@EmbeddedRoleMapper(
users={
@RoleMap(user=âfooâ,roles=âadminâ),
@RoleMap(group=âadminâ,roles={âadminâ,âmanagerâ})
}
)
public class MyServlet {
}
58. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.58
Ideas â Dynamic Role Mapping
public interface RoleMapper {
void grantRoleToUser(String username, String role);
void revokeRoleFromUser(String username, String role);
boolean hasRoleForUser(
String username, String role, boolean includeGroups);
List<String> getRolesForUser(
String username, boolean includeGroups);
List<String> getUsersWithRole(
String role, boolean includeGroups);
void grantRoleToGroup(String group, String role);
void revokeRoleFromGroup(String group, String role);
boolean hasRoleForGroup(String group, String role);
List<String> getRolesForGroup(String group);
List<String> getGroupsWithRole(String role);
}
59. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.59
Ideas â Dynamic Role Mapping
@Inject
RoleMapper roleMapper;
roleMapper.grantRoleToGroup("Manager", "EDIT_ACCOUNTS");
boolean has = roleMapper.hasRoleForGroup("Manager", "CLOSE_ACCT");
List<String> roles = roleMapper.getRolesForGroup("Manager");
List<String> groups = roleMapper.getGroupsWithRole("VIEW_ACCOUNTS");
60. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.60
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
61. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.61
Use Case
§ï§âŻ Application needs to access the security API
â⯠To get the authenticated user
â⯠To check roles
â⯠To invoke runAs.
§ï§âŻ Application needs the same API to access security context, regardless
of container
API for Security Context
62. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.62
Current Solutions
§ï§âŻ No Java EE support
§ï§âŻ 3rd party security frameworks provide a security context
API for Security Context
63. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.63
Current Solutions
@Singleton
public class MyEjb {
@Resource
private SessionContext sessionContext;
public String sayHello() {
if (sessionContext.isCallerInRole("admin")) {
return "Hello World!";
}
throw new SecurityException("User is unauthorized.");
}
}
64. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.64
Current Solutions
public class MyServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest request,
HttpServletResponse resp) throws ServletException, IOException {
if (request.isUserInRole("admin")) {
// do something
}
throw new ServletException("User is unauthorized.");
}
}
65. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.65
Current Solutions
@RequestScoped
public class MyCdiBean {
// Oh snap! No SecurityContext class for CDI
}
66. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.66
Current Solutions
public class MyJaxRsService {
@GET
@Produces("text/plain;charset=UTF-8")
@Path("/hello")
public String sayHello(@Context SecurityContext sc) {
if (sc.isUserInRole("admin")) {
return "Hello World!";
}
throw new SecurityException("User is unauthorized.");
}
}
67. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.67
Ideas â Security Context
public interface SecurityContext {
String getUserPrincipal();
boolean isUserInRole(String role);
List<String> getAllUsersRoles();
boolean isAuthenticated();
boolean isUserInAnyRole(List<String> roles);
boolean isUserInAllRoles(List<String> roles);
void login(Object request, Object response);
void login(Map map);
void logout();
void runAs(String role);
boolean hasAccessToResource();
boolean hasAccessToBeanMethod();
}
68. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.68
Ideas â Security Context
§ï§âŻ For all managed beans: CDI, Servlet, EJB, JAX-RS, etc
public class MyFutureCdiBean {
@Inject
private SecurityContext securityContext;
public String sayHello() {
if (securityContext.isUserInRole("admin")) {
return "Hello World!";
}
throw new SecurityException("User is unauthorized.");
}
}
69. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.69
Ideas
§ï§âŻ Terminology
§ï§âŻ API for Authentication Mechanism
§ï§âŻ API for Identity Store
§ï§âŻ API for Password Aliasing
§ï§âŻ API for Role/Permission Assignment
§ï§âŻ API for Security Context
§ï§âŻ API for Authorization Interceptors
To modernize, standardize, simplify
70. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.70
Use Case
§ï§âŻ Application needs to restrict specific methods to authorized users
§ï§âŻ Application-model rules are used to make access decisions
§ï§âŻ Role is insufficient
API for Authorization Interceptors
71. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.71
Survey Results
API for Authorization Interceptors
this'last'question.''Thymeleaf,'Freemarker,'and'Velocity'were'the'most'frequently'
mentioned'here.'
'
'
'
'
CDI'
'
The'next'four'questions'focused'on'continued'CDI'alignment.''This'was'one'of'the'focus'
areas'of'Java'EE'7.'
'
Should we consider adding Security Interceptors in Java EE 8?
Should we simplify JASPIC?
'
Should we simplify authorization by introducing an EL-enabled authorization
annotation?
'
Should we standardize on requirements for simple security providers and their
configuration?
72. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.72
Current Solutions
§ï§âŻ EE authorization has no rule based authorization, only role based
§ï§âŻ 3rd party security frameworks provide rule, role and permission based
APIs
API for Authorization Interceptors
73. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.73
Ideas â EL Authorization Rules
§ï§âŻ Expression Language rule would have access to managed beans for
SecurityContext and InvocationContext
@ EvaluateSecured("security.hasRoles('MANAGER') &&
schedule.nowIsOfficeHrs")
void transferFunds() {..};
74. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.74
Ideas â EL Authorization Rules
§ï§âŻ EL Authorization rules centrally managed in a repository
@LdapAuthorizationRules (
name="java:app/accountAuthRules",
ldapUrl="ldap://blah",
ldapUser="ElDap",
ldapPassword=âmysecretâ
)
public class MyBean {
@ EvaluateSecured(
ruleSourceName="java:app/accountAuthRules", rule="transferFunds")
void transferFunds() {..};
âŠ
}
75. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.75
Ideas â AccessDecisionVoter
§ï§âŻ A user-defined class for making access decisions
@Secured(AccountAccessDecisionVoter.class)
void transferFunds() {..};
76. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.76
Ideas â AccessDecisionVoter
public class AccountAccessDecisionVoter implements AccessDecisionVoter {
@Override
public void checkPermission(AccessDecisionVoterContext ctx,
Set<SecurityViolation> violations) {
// Check for violations
Method method = ctx.<InvocationContext>getSource().getMethod();
âŠ
violations.add(new SecurityViolation("Sorry, not allowed"));
}
}
77. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.77
Agenda
§ï§âŻ Motivations
§ï§âŻ A New JSR
§ï§âŻ Ideas
§ï§âŻ Get Involved
§ï§âŻ Q & A
78. Copyright © 2015, Oracle and/or its affiliates. All rights reserved.78
Get Involved
§ï§âŻ Project Page: The starting point to all resources
https://java.net/projects/javaee-security-spec
§ï§âŻ Users List: Subscribe and contribute
users@javaee-security-spec.java.net
§ï§âŻ Github Playground: Fork and Play!
https://github.com/javaee-security-spec/javaee-security-proposals