Abhi On Java: May 2007

Java is now completely open source. The JDK source code is now available through the OpenJDK project. According to the marketing manager of the OpenJDK project Rich Sands, Developers can,

... learn how the JDK is put together, fix that bug that's been 
driving you nuts, join the conversations in the mailing lists, 
start or participate in projects to improve the implementation.

It's good to see that the governing body consists of not just Sun employees.

On a related note, Sun has announced the new JavaFX product family. Following Adobe's Flex, and Microsoft's Silverlight, JavaFX script is another product for building rich internet applicaitons. JavaFX Mobile is a complete mobile operating and application environment built around Java and Linux. JavaFX Mobile includes support for Java ME applications and other standard Java APIs.

The Java EE 5 Security services are provided by the container and can be implemented using declarative or programmatic techniques. In addition to declarative and programmatic ways to implement security (in J2EE), Java EE 5 supports the use of metadata annotations for security. This post will describe how to secure EJB 3.0 beans. The post consists of a simple EJB, with a web client. In order to run the example, follow these steps.
Create Users in Glassfish

Go to Configuration->Security->Realms->file in the Glassfish admin console.
In the file realm, click on manage users.
Add new users by clicking on add there.

The EJB Component

Start with a Simple Java project in Eclipse.

Remote Interface

package ejb;

import javax.ejb.Remote;

@Remote
public interface DABean {
public String create();

public String read();

public String update();

public String delete();
}

ejb/DABean.java

The Bean:

package ejb;

import javax.annotation.security.DeclareRoles;
import javax.annotation.security.RolesAllowed;
import javax.ejb.Stateless;

@Stateless (mappedName = "ejb/secureEJB")
@DeclareRoles({"emp","guest"})

public class SecureEJB implements DABean {

@RolesAllowed({"emp","guest"})
public String create() {
  return "create";
}

@RolesAllowed({"emp","guest"})
public String read() {
  return "read";
}

@RolesAllowed("emp")
public String update() {
  return "update";
}

@RolesAllowed("emp")
public String delete() {
  return "delete";
}

}

ejb/SecureEJB.java

The declaredRoles and RolesAllowed annotations take a string array as a parameter.

Deployment descriptor:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-ejb-jar PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 EJB 3.0//EN" "http://www.sun.com/software/appserver/dtds/sun-ejb-jar_3_0-0.dtd">
<sun-ejb-jar>
<security-role-mapping>
  <role-name>guest</role-name>
  <group-name>guest</group-name>
</security-role-mapping>

<security-role-mapping>
  <role-name>emp</role-name>
  <group-name>employee</group-name>
</security-role-mapping>

<enterprise-beans>
  <unique-id>0</unique-id>
  <ejb>
    <ejb-name>SecureEJB</ejb-name>
    <jndi-name>ejb/secureEJB</jndi-name>
    <gen-classes />
  </ejb>
</enterprise-beans>
</sun-ejb-jar>

META-INF/sun-ejb-jar.xml

The Web Client
For a little bit more detail explanation on the Web Application, see the previous post Securing Java EE 5 Web Applications

The EJB Client Jar file: When you deploy the EJB application in Glassfish, it creates a corresponding EJB Client jar file for the EJB component, which can be used in the clients. The file will created in the following directory.
```
GLASSFISH_HOME\domains\DOMAIN_NAME/generated\xml/j2ee-modules/APPLICATION_NAME
```

Selection page

<html>
<body>
<h1>Home Page</h1>
Anyone can view this page.

<form action="securityServlet"><select name="method">
<option value="create">create</option>
<option value="read">read</option>
<option value="update">update</option>
<option value="delete">delete</option>
</select> <input type="submit" name="submit" /></form>
</body>
</html>

index.jsp

Servlet

package servlets;

import java.io.IOException;
import java.io.PrintWriter;

import javax.annotation.security.DeclareRoles;
import javax.ejb.EJB;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import ejb.DABean;

@DeclareRoles("emp")
public class SecurityServlet extends javax.servlet.http.HttpServlet implements javax.servlet.Servlet {

@EJB(name = "timerBean", mappedName = "corbaname:iiop:localhost:3700#ejb/secureEJB")
private DABean daBean;

public SecurityServlet() {
  super();
}

protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
  PrintWriter out = response.getWriter();
  String method = request.getParameter("method");
  try {
    String result = "";
    if (method.equals("create")) {
      result = daBean.create();
    }
    if (method.equals("read")) {
      result = daBean.read();
    }

    if (method.equals("update")) {
      result = daBean.update();
    }

    if (method.equals("delete")) {
      result = daBean.delete();
    }

    out.println(request.getUserPrincipal() + " is an Authorized User");
  } catch (Exception e) {
    e.printStackTrace();
    out.println(request.getUserPrincipal() + " is not an Authorized to see this page.");
  }
}
}

SecurityServlet.java

Deployment descriptor

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" version="2.5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<display-name>Java5Security</display-name>

<servlet>
  <description></description>
  <display-name>SecurityServlet</display-name>
  <servlet-name>SecurityServlet</servlet-name>
  <servlet-class>servlets.SecurityServlet</servlet-class>
  <security-role-ref>
    <role-name>emp</role-name>
    <role-link>emp</role-link>
  </security-role-ref>
</servlet>
<servlet-mapping>
  <servlet-name>SecurityServlet</servlet-name>
  <url-pattern>/securityServlet</url-pattern>
</servlet-mapping>


<login-config>
  <auth-method>FORM</auth-method>
  <realm-name>file</realm-name>
  <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/error.jsp</form-error-page>
  </form-login-config>
</login-config>

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/*</url-pattern>
    <http-method>PUT</http-method>
    <http-method>DELETE</http-method>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>
    <role-name>guest</role-name>
    <role-name>emp</role-name>
  </auth-constraint>
</security-constraint>

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/secure/*</url-pattern>
    <http-method>PUT</http-method>
    <http-method>DELETE</http-method>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>
    <role-name>emp</role-name>
  </auth-constraint>
</security-constraint>
<!-- Security roles referenced by this web application -->
<security-role>
  <role-name>guest</role-name>
</security-role>
<security-role>
  <role-name>emp</role-name>
</security-role>

<welcome-file-list>
  <welcome-file>index.html</welcome-file>
</welcome-file-list>
</web-app>

web.xml

Glassfish Deployment descriptor

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 8.1 Servlet 2.4//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_4-1.dtd">
<sun-web-app>
<context-root>/Java5Security</context-root>
<security-role-mapping>
  <role-name>guest</role-name>
  <group-name>guest</group-name>
</security-role-mapping>
<security-role-mapping>
  <role-name>emp</role-name>
  <group-name>employee</group-name>

</security-role-mapping>
</sun-web-app>

sun-web.xml

Environment: This example was run on Glassfish V2 Build 41 (Glassfish V2 Beta 2).

Abhi On Java

Pages

Wednesday, May 09, 2007

OpenJDK and JavaFX

Monday, May 07, 2007

Securing EJB 3.0 Beans

Tuesday, May 01, 2007

Java EE 5 on WebSphere

Popular Posts