44.2. Setting up the example

In order to make this example convenient to run, all the deployment phase is hidden. Now we will have a closer look of what is needed to set up a secured EJB in JOnAS.

44.2.1. Setting up Tomcat

To run this example, the first thing to do is to configure Tomcat since JOnAS relies on it to identify and authenticate the user of a servlet.

This is done in two steps:

  1. The first one is to protect the access to the servlet so that the user has to identify and authenticate prior to access the servlet. In order to do that, we have to modify the web.xml http://www.objectweb.org/jonas/current/examples/earsample/etc/xml/web.xml file. This file contains information relative to the web application. Among it, there is the protected access to the servlets. What is interesting concerning security is the following one:

    ...
    <security-constraint>
       <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/secured/*</url-pattern>
    ...
       </web-resource-collection>
       <auth-constraint>
    <role-name>tomcat</role-name>
    ...
       </auth-constraint>
    </security-constraint>
    <login-config>
       <auth-method>BASIC</auth-method>
       <realm-name>Example Basic Authentication Area</realm-name>
    </login-config>
    ...

    This means that:

    • All URLs of the form http://<hostname>:<port>/earsample/secured/... are protected.

    • Only the tomcat role can access these URLs.

    • The login configuration is BASIC that is to say that a dialog box will be opened when you will access these URLs, asking you to enter a User ID and a password.

  2. We have to define who is in the role tomcat. This is specified in the tomcat-users.xml file located in your $CATALINA_HOME/conf/ directory for Tomcat 4.1.x. This file contains:

    <tomcat-users>
      <user name="tomcat" password="tomcat" roles="tomcat" />
      ...
    </tomcat-users>

    This means that the user with the name (or User ID) tomcat is in the role tomcat and is authentified thanks to the password tomcat.

  3. Then, we must indicate to tomcat to use a JOnAS AccessInterceptor in order to make the propagation of security context mechanism available.

    • For Tomcat 4.1.x, this is done by updating the $CATALINA_HOME/conf/server.xml file. Replace the line:

      <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           debug="0" resourceName="UserDatabase"/>

      by

      <Realm 
        className="org.objectweb.security.catalina41.realm.UserDatabaseRealm"
        debug="0" resourceName="UserDatabase"/>

      or

      <Realm 
        className="org.objectweb.security.catalina41.realm.MemoryRealm"
        debug="0"/>

      or another org.objectweb.security.catalina41.realm.* class

44.2.2. Setting up JOnAS

Now, let's take a look on how to configure the security in JOnAS (More details are provided in Chapter 16 Security Management. It is very similar to the setting up of Tomcat. It includes the following steps:

  1. Define which methods of the EJB are protected and who can access them, this is done in the standard deployment descriptor of the EJB (the ejb-jar.xml file).

    <ejb-jar>
       ...
       <session>
    <ejb-name>Op</ejb-name>
    ...
       </session>
       ...
        <assembly-descriptor>
        <security-role>
    <role-name>tomcat</role-name>
        </security-role>
        <method-permission>
    <role-name>tomcat</role-name>
    <method>
    <ejb-name>Op</ejb-name>
    <method-name>*</method-name>
    </method>
        </method-permission>
        ...
       </assembly-descriptor>
    </ejb-jar> 

    This means that:

    • a role tomcat is defined.

    • this role can access all the methods of the Op session bean (* is a shortcut to indicate all the methods of the EJB).

  2. Now, we have to indicate to JOnAS who can be in the tomcat role. This is done in the jonas-users.properties file:

    tomcat = tomcat

    This file is very similar to the tomcat-users.xml file (even if it is a properties file and not an XML file). It stipulates that the tomcat name (on the left side of =) is in the tomcat role (on the right side). More generally, a name may be in several roles which are all on the right side separated by commas. However, there is only one name on the left side. That is to say if two users are in the same role, they have to be on two lines and not on one only. Conversely to the tomcat-users.xml file, there is no password since JOnAS is not currently able to authenticate user.