Securing a JBoss Web Application

this articles describes how to secure a java web application in jboss using basic authentication.

step1: edit web.xml in your application

edit the web.xml file in your webapp at the following location:

web-inf/web.xml  

edit your web.xml and put the following contents (generally towards the bottom of the file)

<web-app>
....

 <security-constraint>
  <web-resource-collection>
   <web-resource-name>all resources</web-resource-name>
   <description>protects all resources</description>
   <url-pattern>/*</url-pattern>
  </web-resource-collection>

  <auth-constraint>
   <role-name>myrole</role-name>
  </auth-constraint>
 </security-constraint>

 <security-role>
  <role-name>myrole</role-name>
 </security-role>

 <login-config>
  <auth-method>basic</auth-method>
  <realm-name>authorized access only.</realm-name>
 </login-config>
</web-app> 

this is a way of telling the container to restrict all urls to any user with the role ‘ myrole ‘.

step 2: create jboss-web.xml in your application

edit or create the jboss-web.xml file in your webapp at the following location:

 web-inf/jboss-web.xml  

put the following contents:

<jboss-web>
 <security-domain>java:/jaas/myappname</security-domain>
</jboss-web> 

this tells jboss to use application policy ‘ myappname’ for this application.

step 3: create application policy on jboss server

we now need to define the application policy ‘ myappname ‘ on jboss server.

edit the login-config.xml file in the jboss server directory at the following location:

jboss/server/default/conf/login-config.xml   

edit the contents of login-config.xml and add an application policy as follows:

<policy>
...

<!-- application policy for myappname -->
<application-policy name="myappname">
 <authentication>
  <login-module code="org.jboss.security.auth.spi.usersrolesloginmodule" flag="required">
   <module-option name="usersproperties">props/users.properties</module-option>
   <module-option name="rolesproperties">props/roles.properties</module-option>
  </login-module>
 </authentication>
</application-policy>
</policy> 

this tells jboss to user ‘usersrolesloginmodule’ which uses property files to store users and roles.

step 4: create users on jboss server

now we create a new user with the role ‘myrole’.

create a new user

edit the users.properties file used by your application policy in step 3.

jboss/server/default/conf/props/users.properties  

add a line to create a new user as follows.

myuser=mypassword  

jboss/server/default/conf/props/roles.properties

myuser=myrole