This document outlines a presentation about security in Java EE applications. It discusses the history of security in Java EE, from the pre-modern era with basic authentication to the modern era with standards like JASPIC and the new Security API in EE8. The presentation covers how JASPIC allowed developers to customize authentication by implementing ServerAuthModules. It also explains how the Security API simplifies security with concepts like IdentityStores and built-in authentication mechanisms that can be customized through extension points.

1. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
From JASPIC to Security API
Modern Application Security
Michael Remijan
System Architect,
Federal Reserve Bank St. Louis
JavaOne 2017 CON5954 Modern Application and Microservices Security from EE6 JASPIC to the EE8 Security API Moscone West Room 2024 Tues 03 Oct 2017
@mjremijan

2. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
About Me

3. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Where I work?
@since 2014
• Federal Reserve Bank St. Louis

4. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
What I do?
@since 1999
• Java EE
• Architect
• Scrum Master
• Tech Lead
• Developer

5. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
What I write?
@since 2014
• EJB in Action Second Edition
• EJB 3.2 – EE7 & EE8
@since 2010
• http://mjremijan.blogspot.com

6. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
What I teach?
@since 2009
• Adjunct Instructor
• Java I
• Java II

7. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
What’s the goal of this presentation?
• Get you to think: Java EE Security
• EE 7 or 8

8. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
What are we going to talk about?
• I just need to put my code somewhere to build “User”

9. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
History of EE Security
Servlet JASPIC (JSR 196) Security API (JSR 375)
https://readlearncode.com/java-ee/java-ee-past-present-and-future/
Pre-Modern Era Modern Era Post-Modern Era

10. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era architecture
• Desktop ->Web
• 1 Application
• How do you
implement
Security?
http://www.softwaretestingclass.com/what-is-difference-between-two-tier-and-three-tier-architecture/

11. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security

12. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security

13. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security

14. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security

15. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security
https://ivanursul.com/spring-security-avoiding-basic-authentication-window-in-your-browser

16. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security
http://www.security-expert.be/

17. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Pre-Modern era…A tale of EE Security
• Sound familiar?
• Most common introduction to EE Security
• Quickly abandoned
• Inflexible
• A lot of server configuration
• There is no where to put my code!

18. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Modern era architecture
• Multiple applications
• Add another tier
• Identity-management
• SSO
• Federation…
• How do you
implement
Security?
https://blogs.vmware.com/vfabric/2013/03/putting-the-single-back-in-single-sign-on-sso.html

19. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Modern era…A tale of EE Security
• Create account
• Email
• OpenId
• OAuth2…
• Account activation
• Login (multi-factor)
• Validate location
• Account locking
• Password reset (reCaptica)
• Account disabling
• Password expiration

20. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Modern era…A tale of EE Security
What is this?

21. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Modern era…A tale of EE Security

22. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Consuming authorization HEADER

23. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Consuming authorization HEADER
• Does @WebFilter Work?
• Nope!
• EE Server enforces security before @WebFilter
• Other options to consume the HEADER?
• Where else can I put my code?

24. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Consuming authorization HEADER
This is where JASPIC comes in
• Move your code out of @WebFilter
• Put it into the JASPIC API
• Probably something you haven’t heard of

25. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Java EE6+ JASPIC
• @since 2009
• JSR-196 Java Authentication Service Provider Interface for
Containers (JASPIC)
• ServerAuthModule (interface)
• Executed by EE Server before enforcing any security

26. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api

27. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Java EE6+ JASPIC
• How do you register JASPIC ServerAuthModule?
• It’s a 5 step process
Tijms, A. (2012, November 7). Implementing container authentication in Java EE with JASPIC.
Retrieved from http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html

28. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Register JASPIC ServerAuthModule?
Step #1
• Create:
@WebListener
MyContextListener implements ServletContextListener
• Get factory-factory-factory AuthConfigFactory
• Register factory-factory AuthConfigProvider
Tijms, A. (2012, November 7). Implementing container authentication in Java EE with JASPIC.
Retrieved from http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html

29. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Register JASPIC ServerAuthModule?
Step #2
• Create
MyAuthConfigProvider implements AuthConfigProvider
• Register factory ServerAuthConfig
Tijms, A. (2012, November 7). Implementing container authentication in Java EE with JASPIC.
Retrieved from http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html

30. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Register JASPIC ServerAuthModule?
Step #3
• Create
MyServerAuthConfig implements ServerAuthConfig
• Creates delegator ServerAuthContext
Tijms, A. (2012, November 7). Implementing container authentication in Java EE with JASPIC.
Retrieved from http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html

31. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Register JASPIC ServerAuthModule?
Step #4
• Create
MyServerAuthContext implements ServerAuthContext
• Creates authentication module ServerAuthModule
Tijms, A. (2012, November 7). Implementing container authentication in Java EE with JASPIC.
Retrieved from http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html

32. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Register JASPIC ServerAuthModule?
Step #5
• Create
MyServerAuthModule implements ServerAuthModule
• This is where you finally put your code
• Building a Principal
• Getting roles/groups
• EE6 goal was flexibility
Tijms, A. (2012, November 7). Implementing container authentication in Java EE with JASPIC.
Retrieved from http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html

33. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
How do you secure EE Components?
• Use standard EE security to secure components:
• Servlet
• JSP
• JSF/AJAX
• JAX-RS
• EJB

34. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing Servlet
web.xml
EMPTY
glassfish-web.xml

35. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JSP
glassfish-web.xml
web.xml
EMPTY

36. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JSF Page & AJAX call
glassfish-web.xml
web.xml

37. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JSF @Named bean
glassfish-web.xml

38. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JAX-RS #1
web.xml
glassfish-web.xml

39. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JAX-RS #2
glassfish-web.xml
web.xml
EMPTY
Bien, A. (2015, December 07). What Is Faster--EJBs Or CDI? A JMH Benchmark. Retrieved from
http://adambien.blog/roller/abien/entry/what_is_faster_ejbs_or

40. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JAX-RS #3
web.xml
EMPTY
glassfish-web.xml

41. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing JAX-RS #4
• What about JWT?
• JAX-RS has its own @PreMatching filters DecodeToken
In
ServerAuthModule

42. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Securing EJB
glassfish-web.xml
web.xml
EMPTY

43. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
So what’s the catch?
• JASPIC ignored when EE6 came out
• Overshadowed
• Web-Profile
• CDI
• JAX-RS
• Pre-EE8
• Full-profile only
• Vender support of open standard is tricky
• Tijms, A (2016, December 04). The state of portable authentication in Java
EE, end 2016 update. Retrieved from http://arjan-
tijms.omnifaces.org/2016/12/the-state-of-portable-authentication-in.html

44. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Are we still living in the modern era?
• Kinda, sorta
• Still have multiple
applications, but…

45. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Post-Modern era…
• Security is
needed
everywhere!

46. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Post-Modern era security with EE8
• JSR 375 Java EE Security 1.0
• Soteria RI
• Goals
• Modernization
• Simplification

47. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
What’s new in SecurityAPI?
Establishes some common definitions
• IdentityStore
• Caller data
• Credentials
• Groups
• Authentication mechanism
• How the caller interacts with the server
• Typically UI Rendering
http://arjan-tijms.omnifaces.org/p/whats-new-in-java-ee-security-api-10.html

48. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
IdentityStore
Built-in Identity Stores
• @EmbeddedIdentityStoreDefinition
• @DataBaseIdentityStoreDefinition
• @LdapIdentityStoreDefinition
Build your own
• Implement IdentityStore
• Embed into your application
• Auto-registration
• Multiple implementations with different responsibilities

49. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
IdentityStore –Validate caller

50. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
IdentityStore – Groups A,B,C...

51. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Authentication Mechanism
Built-in authentication mechanisms
1. @BasicAuthenticationMechanismDefinition
2. Digest
3. Client-cert
4. @FormAuthenticationMechanismDefinition
@CustomFormAuthenticationMechanismDefinition
Build your own
• Implement HttpAuthenticationMechanism
• Embed into your application
• Auto-registration
• Replaces JASPIC ServerAuthModule
http://arjan-tijms.omnifaces.org/p/whats-new-in-java-ee-security-api-10.html

52. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Authentication Mechanism

53. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Conclusions
• EE6 JASPIC brought flexibility to EE security
• Gave you a place to put your code
• ServerAuthModule
• EE8 Security API brought simplification to EE security
• HttpAuthenticationMechanism
• Both give full control over creating a Principal and roles/groups
• SoThink EE Security!

54. slideshare.net/mjremijan github.com/mjremijan/thoth-jaspic github.com/mjremijan/thoth-security-api
Thank you
mjremijan@yahoo.com
@mjremijan
http://mjremijan.blogspot.com
https://github.com/mjremijan
http://www.slideshare.net/mjremijan