Access control 2/18/2009

TOMCAT Security Model Declarative Security:  the expression of application security external to the application, and it allows runtime configuration  Configure in web.xml Programmatic Security:  implement fine-grained access control, enabling components to become security aware  Involves using HttpServletRequest API method

Declarative Security the expression of application security external to the application, and it allows runtime configuration Configure in web.xml

Role-based Authorization Use role-based authorization to manage access Define role in /conf/tomcat-user.xml *Need to restart TOMCAT after reconfiguration.

Role-based Authorization Define security role in web.xml The role that is required to log in to the Manager Application user /protected/* user

Authentication Method – 1: Basic Usage:  Pop up a dialog box  Browser-based auth  User & Password are sent in every http request  Must exit the browser to logout  Not secure at all (no encryption) Configuration in web.xml BASIC Tomcat Manager Application

Authentication Method – 2: Digest Usage:  Same as BASIC  Username and password are encrypted into a message digest value Configuration in web.xml DIGEST Tomcat Manager Application Has to use a secure connection, such as SSL, etc

Authentication Method – 3: Form Usage:  Define your own login and error page  Authentication is defined in servlet session  Logout by session.invalidate() Configuration in web.xml FORM /protected/login.jsp /protected/error.jsp

Authentication Method – 3: Form Must follow the rules  Use j_username field for the username  Use j_password field for the password  Submit to j_security_check Login.jsp Name: Password: Error.jsp The username and password you supplied are not valid. Click '>here to retry login

Authentication Method – 4: Client Usage  implemented with SSL and requires the client to possess a public key certificate  Most secure, but costly

Programmatic Security implement fine-grained access control, enabling components to become security aware Involves using HttpServletRequest API method

Access authentication info. getRemoteUser() getAuthType() isUserInRole() getUserPrincipal()  Principal is an alternated object to identify user show_security.jsp User principal:. User name:. Request Authenticated with:. You are in user role

Use Role in Web App. Under Structs Restricted access to Actions  In JSP  ……

Reference Good security tutorial: Http servlet request APIs: javadoc/javax/servlet/http/HttpServletRequest.htmlhttp:// javadoc/javax/servlet/http/HttpServletRequest.html __Authentication.htm __Authentication.htm