9:23 a.m.
Integrate Servlet Security with DNA ExecutionContext
----------------------------------------------------
Key: DNA-440
URL: https://jira.jboss.org/jira/browse/DNA-440
Project: DNA
Issue Type: Sub-task
Affects Versions: 0.4
Reporter: Brian Carothers
Fix For: 0.6
The DNA JCR security approach is JAAS-based and relies on the ability to pass a
LoginContext, AccessControlContext, or SimpleCredentials (which are used internally to
create a LoginContext) to the ExecutionContext. The Servlet specification does not expose
any of these. The REST server is mandatorily limited to what the Servlet specification
provides. There needs to be some sort of integration between the Servlet-based REST code
and JAAS-based DNA implementation to allow authorization and access to JCR resources to
occur based on web credentials.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:33 p.m.
New subject: [JBoss JIRA] Updated: (DNA-440) Integrate Servlet Security with DNA ExecutionContext
[
https://jira.jboss.org/jira/browse/DNA-440?page=com.atlassian.jira.plugin...
]
Brian Carothers updated DNA-440:
--------------------------------
Attachment: DNA-440_refactor_existing.patch
Attached and applied patch that takes first step towards integrating the security by
refactoring the existing security from ExecutionContext proper into a new interface called
o.j.d.graph.SecurityContext. The existing JAAS code moves into an implementation of
SecurityContext called JaasSecurityContext and JcrSession can now accept a new type of
Credentials called o.j.d.jcr.SecurityContextCredentials that wraps an existing
SecurityContext.
Next step is to create a SecurityContext class that wraps HttpServletRequest to be able to
derive the user name and role information directly from the request and modify JcrResource
to accept the new SecurityContext class.
Integrate Servlet Security with DNA ExecutionContext
----------------------------------------------------
Key: DNA-440
URL: https://jira.jboss.org/jira/browse/DNA-440
Project: DNA
Issue Type: Sub-task
Affects Versions: 0.4
Reporter: Brian Carothers
Fix For: 0.6
Attachments: DNA-440_refactor_existing.patch
The DNA JCR security approach is JAAS-based and relies on the ability to pass a
LoginContext, AccessControlContext, or SimpleCredentials (which are used internally to
create a LoginContext) to the ExecutionContext. The Servlet specification does not expose
any of these. The REST server is mandatorily limited to what the Servlet specification
provides. There needs to be some sort of integration between the Servlet-based REST code
and JAAS-based DNA implementation to allow authorization and access to JCR resources to
occur based on web credentials.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 p.m.
New subject: [JBoss JIRA] Updated: (DNA-440) Integrate Servlet Security with DNA ExecutionContext
[
https://jira.jboss.org/jira/browse/DNA-440?page=com.atlassian.jira.plugin...
]
Brian Carothers updated DNA-440:
--------------------------------
Attachment: DNA-440_rest_changes.patch
Attached patch that:
- Adds class ServletSecurityContext to wrap HttpServletRequests in a SecurityContext for
authorization within DNA
- Makes JcrResource utilize a wrapped HttpServletRequest to login to the JCR Repository
instead of a hardcoded user/password
- Refactors the SPI to remove the ability to get a repository by name and add the ability
to get a session from a request, repository name, and workspace name
- Refactors surrounding classes in accord with change from prior line
- Modifies integration test WAR to require basic authentication for all URIs
- Modifies POM to add a valid user/password combination with the correct connect role;
stripped all JAAS configuration
- Makes existing test cases use
- Adds test cases for bad password and user without connect role
The REST integration test case throws out a bunch of spurious warnings about authorization
failure, but since the test cases test that 1) nothing gets returned if authorization
actually fails and 2) the right things do get returned when authorization works, I'm
going to write this off as a Jetty quirk until proven otherwise.
Integrate Servlet Security with DNA ExecutionContext
----------------------------------------------------
Key: DNA-440
URL: https://jira.jboss.org/jira/browse/DNA-440
Project: DNA
Issue Type: Sub-task
Affects Versions: 0.4
Reporter: Brian Carothers
Fix For: 0.6
Attachments: DNA-440_refactor_existing.patch, DNA-440_rest_changes.patch
The DNA JCR security approach is JAAS-based and relies on the ability to pass a
LoginContext, AccessControlContext, or SimpleCredentials (which are used internally to
create a LoginContext) to the ExecutionContext. The Servlet specification does not expose
any of these. The REST server is mandatorily limited to what the Servlet specification
provides. There needs to be some sort of integration between the Servlet-based REST code
and JAAS-based DNA implementation to allow authorization and access to JCR resources to
occur based on web credentials.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:52 p.m.
New subject: [JBoss JIRA] Resolved: (DNA-440) Integrate Servlet Security with DNA ExecutionContext
[
https://jira.jboss.org/jira/browse/DNA-440?page=com.atlassian.jira.plugin...
]
Brian Carothers resolved DNA-440.
---------------------------------
Fix Version/s: 0.5
(was: 0.6)
Resolution: Done
Assignee: Brian Carothers
Applied patch that resolves defect as per IRC discussion with Randall last week.
Integrate Servlet Security with DNA ExecutionContext
----------------------------------------------------
Key: DNA-440
URL: https://jira.jboss.org/jira/browse/DNA-440
Project: DNA
Issue Type: Sub-task
Affects Versions: 0.4
Reporter: Brian Carothers
Assignee: Brian Carothers
Fix For: 0.5
Attachments: DNA-440_refactor_existing.patch, DNA-440_rest_changes.patch
The DNA JCR security approach is JAAS-based and relies on the ability to pass a
LoginContext, AccessControlContext, or SimpleCredentials (which are used internally to
create a LoginContext) to the ExecutionContext. The Servlet specification does not expose
any of these. The REST server is mandatorily limited to what the Servlet specification
provides. There needs to be some sort of integration between the Servlet-based REST code
and JAAS-based DNA implementation to allow authorization and access to JCR resources to
occur based on web credentials.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5634
days inactive
5643
days old
3 comments
1 participants
participants (1)
-
Brian Carothers (JIRA)