<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
AS7: Web Security - JBossWebRealm
</h3>
<span style="margin-bottom: 10px;">
created by <a href="http://community.jboss.org/people/anil.saldhana%40jboss.com">Anil Saldhana</a> in <i>PicketBox Development</i> - <a href="http://community.jboss.org/message/579656#579656">View the full discussion</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>I want to dedicate this thread to the web layer security in AS7.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>For Web applications to utilize JACC or XACML authorization, we need the web authorization checks to go through the JBoss Security authorization stack. This is not needed for majority of applications (which just rely on what is provided by spec/RealmBase authorization checks).</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>I think we should make the access checks to go through our authorization stack only when desired.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><pre class="jive-pre"><code class="jive-code jive-java">JBossWebRealm:-
 
<font color="navy"><b>protected</b></font> <font color="navy"><b>boolean</b></font> useAuthorizationStack = <font color="navy"><b>false</b></font>; <font color="darkgreen">//Default behavior</font>
</code></pre><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>This property needs to be used based on the domain model settings.  Additionally, the realm should be customizable based on individual web apps (via domain model).</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Additionally, we just need one security valve to incorprate what the JaccContextValve, SecurityAssociationValve etc did in AS5/6 in a very <em>minimalistic</em> way.  Certainly JSR-196 is something to keep in mind here.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><strong>Things to note:</strong></p><ol><li>Minimize the access control checks.</li><li>Realm settings can be available at per web app level.</li><li>Ability to incorporate behavior at web app level (such as SSO) based on domain model settings. It should be possible to enable SAMLv2 SSO at the web app level using the default IDP that <strong>can</strong> be shipped with AS7.</li></ol></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Reply to this message by <a href="http://community.jboss.org/message/579656#579656">going to Community</a></p>
<p style="margin: 0;">Start a new discussion in PicketBox Development at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2088">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>