I have a Java Backend (with Jersey) and an Angular Client (on a different Host), which accesses the api provides by Jersey.
Without authentication everything works great (I have a CORS filter included).
Now when I add basic auth to web.xml on Java Backend, the problems start.
Sample:
<security-constraint>
<web-resource-collection>
<web-resource-name>Sample</web-resource-name>
<url-pattern>/manager-api/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
<!--<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint> -->
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
I tried to set the Basis Authentication header on every AngularJS $http call. But the problem is, that this header isnt attached to the OPTIONS call, which is made first.
HTTP Sample:
App.config(['$httpProvider', function($httpProvider) {
$httpProvider.defaults.headers.common['Authorization'] = 'Basic ' + authdata;
}]);
Do you have any idea how I can get arround this? Is there a way to add the header to the options call? Or is it possible to allow OPTIONS calls without allowing GET and POST calls?
Any help is highly appreciated.
Greets
Marc
I don't see authdata defined anywhere there. Therefore, you're sending the header: Authorization: Basic unless you haven't included all of the relevant code.
Related
I am attempting to implement JDBC Realm Authentication with Wildfly.
I have used this article as reference:
http://blog.eisele.net/2015/01/jdbc-realm-wildfly820-primefaces51.html
As well as the accompanying source code on GitHub at https://github.com/myfear/SimpleJDBCRealmWildFly/
I am presented with the login form if I try to access one of the protected areas of the application but after filling in my username and password it never seems to successfully authenticate(loginError.xhtml).
The only difference between my application and the above example is that my form specifies
action="j_security_check"
whereas the GitHib example uses
onsubmit="document.loginForm.action = 'j_security_check';"
In my web.xml I specify
<security-role>
<role-name>ADMIN</role-name>
</security-role>
Which matches what I specified for my user in my role table..What am I still missing?
My JSF form login was working with Constraint 1 however when I added Constraint 2 to my web.xml doing a submit on the form now takes me to a jsf javascript page. Can someone tell me what I am doing wrong? I'm hoping this is a quick configuration mistake.
I would like only administrators to be able to access the /admin/* pages and only registered users to access the entire site included admin files. BTW after I see the java script page I can still navigate to the intended page in the browser, I just don't want the user to see the intermediate js page or need to know the target page URL.
Constraint 1
<security-constraint>
<display-name>Admin</display-name>
<web-resource-collection>
<url-pattern>/admin/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>ADMIN</role-name>
</auth-constraint>
</security-constraint>
Constraint 2
<security-constraint>
<display-name>Users</display-name>
<web-resource-collection>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>USER</role-name>
</auth-constraint>
</security-constraint>
Here is the undesired url I am being redirected to:
javax.faces.resource/jsf.js.xhtml?ln=javax.faces&stage=Development
Here is the start of the jsf.js.xhtml... which is displayed on Firefox
/**
#project JSF JavaScript Library
#version 2.0
#description This is the standard implementation of the JSF JavaScript Library.
*/
/**
* Register with OpenAjax
*/
if (typeof OpenAjax !== "undefined" &&
typeof OpenAjax.hub.registerLibrary !== "undefined") {
OpenAjax.hub.registerLibrary("jsf", "www.sun.com", "2.0", null);
}
// Detect if this is already loaded, and if loaded, if it's a higher version
if (!((jsf && jsf.specversion && jsf.specversion >= 20000 ) &&
(jsf.implversion && jsf.implversion >= 3))) {
...
On Internet Explorer 8.0.7 I get this popup
Notes
I'm using Firefox 10.0.4, IE 8.03, Glassfish 3.1 w JSF2.0 lib, j_security_check, and my login realm setup is similar to this
Try to add
<intercept-url pattern="/javax.faces.resource/**" access="hasRole('ROLE_ANONYMOUS')"/>
to your security.xml.
See comments below accepted answer JSF with Spring security - Redirect to specified page after login
Running Tomcat 7, I am trying to configure the /conf/web.xml on the Tomcat server to secure some URLs with basic authentication and to provide some other URLs for public access.
The tomcat-users.xml contains following role and user:
<role rolename="test-ui"/>
<user username="paul" password="password" roles="test-ui"/>
I have added the following section to Tomcats /conf/web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>Public access</web-resource-name>
<url-pattern>/docs/*</url-pattern>
</web-resource-collection>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected access</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>test-ui</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<description>Protected access</description>
<role-name>test-ui</role-name>
</security-role>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
So there are two 'security-constraint' elements, the public one does not contain the 'auth-constraint', which actually should mean, there is no authentication necessary.
When I open the URL
http://localhost:8080
Tomcat asks for authentication.
This is fine, however when I open the URL
http://localhost:8080/docs/
Tomcat also asks for authentication and for my understanding this is configured as a "non secure" URL - so public acccess, but it does not behave like this.
What did I wrong in the configuration or is this scenario not supposed to work like this?
Thanks.
Paul
You need the <auth-constraint> node in the <security-constraint>, even it is empty e.g. <auth-constraint/>
If an security-constraint does not exists, the Container MUST allow unauthenticated access for these URL. security-constraint is optional.
Like this fellow here, I'm trying to port a Tomcat application to WebLogic.
I have a few resources protected by security rules in web.xml. Instead of BASIC, I'm using FORM authentication, but that should be irrelevant.
In Tomcat, it's very easy to set up a simple security realm, by editing conf/tomcat-users.xml.
How do I set up a simple security realm in Weblogic ? All I want is to have the user to input his username and password and have it authenticated by the container.
<security-constraint>
<web-resource-collection>
<web-resource-name>basic-auth security</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>HELLO_USER</role-name>
</auth-constraint>
<user-data-constraint>NONE</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>somerealm</realm-name>
<form-login-config>
<form-login-page>login.jsp</form-login-page>
<form-error-page>error.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>HELLO_USER</role-name>
</security-role>
there is a default weblogic realm called "myrealm". Create the user(s) there using the weblogic web console. Also create a group (i.e. HELLO_GROUP) and assign your user(s) to that group.
Create a weblogic.xml file and map the HELLO_USER role onto the HELLO_GROUP with a structure like:
<weblogic-web-app>
...
<security-role-assignment>
<role-name>HELLO_USER</role-name>
<principal-name>HELLO_GROUP</principal-name>
</security-role-assignment>
...
</weblogic-web-app>
I have already created a user database file using Apache's htpasswd command. This file is now used by several other application like apache and subversion.
Users in are created like this:
htpasswd /path/to/users.htpasswd peter
This user file is global, not per directory.
How I can make Tomcat 6 use this same file as a security realm?
Most similar to the htpasswd may be the MemoryRealm.
I had problems myself to find a simple example how to use it, so I'll post an easy example code here:
Set up a role, username and password in tomcat-users.xml
Your web.xml should contain something like:
<security-constraint>
<web-resource-collection>
<web-resource-name>
My Protected WebSite
</web-resource-name>
<url-pattern> /* </url-pattern>
<http-method> GET </http-method>
<http-method> POST </http-method>
</web-resource-collection>
<auth-constraint>
<!-- the same like in your tomcat-users.conf file -->
<role-name> test </role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method> BASIC </auth-method>
<realm-name> Basic Authentication </realm-name>
</login-config>
<security-role>
<description> Test role </description>
<role-name> test </role-name>
</security-role>
Add this to your server.xml file:
<Realm className="org.apache.catalina.realm.MemoryRealm"></Realm>
To secure access to your Tomcat webapp, you can implement your simple security constraint (e.g. in /var/lib/tomcat7/webapps/*/WEB-INF/web.xml) as below (just add it before </web-app> ending):
<!-- This security constraint protects your webapp interface. -->
<login-config>
<!-- Define the Login Configuration -->
<auth-method>BASIC</auth-method>
<realm-name>Webapp</realm-name>
</login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>Admin</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
<!-- Specifying a Secure Connection -->
<user-data-constraint>
<!-- transport-guarantee can be CONFIDENTIAL (forced SSL), INTEGRAL, or NONE -->
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- Authorization, see: tomcat-users.xml -->
<security-role>
<role-name>*</role-name>
</security-role>
The login-config element contains the auth-method element, which specifies the authentication method that we use, which is BASIC. The security-constraint element contains 3 elements: web-resource-collection, auth-constraint, and user-data-constraint. The web-resource-collection specifies the parts of our application that require authentication. The /* indicates that the whole application requires authentication. The auth-constraint specifies the role that a user needs to have in order to access the protected resources. The user-data-constraint's transport-guarantee can be NONE, CONFIDENTIAL or INTEGRAL. We set it to NONE, which means that redirecting to SSL is not required when you try to hit the protected resource.
Also make sure that you've line:
<Realm className="org.apache.catalina.realm.MemoryRealm" />
inside your conf/server.xml (Engine section).
If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation (locate tomcat-users.xml). That file must contain the credentials to let you use Tomcat webapp.
For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above:
<role rolename="manager-gui"/>
<user username="tomcat" password="s3cret" roles="manager-gui"/>
Then you can access your webapps manager from /manager/html (e.g. reloading after config changes).
Read more: Manager App HOW-TO.
Then restart your Tomcat and when accessing your webapp, it should ask you for the right credentials.
See also:
HTTP Basic Authentication in Java at Oracle site
Specifying an Authentication Mechanism in Java at Oracle site
Realm Configuration HOW-TO at Apache Tomcat site
Setting up role based security in tomcat
How do I use Basic authentication with Tomcat?
There are two options:
Use Apache as a front end to the tomcat (using either mod_jk or mod_proxy_ajp) and the Apache do the authentication. You can find details on how to do so here
If you want the tomcat to do the authentication, then you need ot use something else than the htpasswd file. There are 4 ways to save the users' credentials - using database, JNDI/LDAP, an XML file or a JAAS provider. You can read about all the options in the Realm Configuration HOW-TO.