Archive for April, 2015

Hitachi Cosminexus v10 silently certified for Java EE 7

28 April 2015

Every time after a Java EE spec is released it’s somewhat of a battle of who is the first to certify for that new specification.

GlassFish is always the first (by definition, as required by the JCP rules for a RI implementation), with tech previews/community editions of JEUS and JBoss following suit. These are however not (directly) supported for production by their own vendors.

During the Java EE 6 cycle, IBM was the first to come out with a supported and certified server, namely WebSphere 8.0. For the Java EE 7 cycle, the battle seemed to be between IBM and Oracle. Both of them are expected to release a Java EE 7 server soon. People are eagerly awaiting this, as Java EE 7 brings many improvements.

Surprisingly it’s the relatively unknown HITACHI Cosminexus Application Server that was completely silently (in Western outlets, that is) added to Oracle’s certification page. HITACHI themselves do mention this fact on their homepage, but otherwise there hasn’t been much news about this.

It appears that HITACHI is focusing exclusively on the Japanese market, but still this may be an interesting server to check out.

Arjan Tijms

A basic implementation of basic access authentication using JASPIC

20 April 2015

Basic access authentication is a crude mechanism to authenticate that’s part of the HTTP standard. It allows both an agent to send username/password credentials and a server to request the agent to authenticate itself. This happens in a simple but standardized way.

The mechanism can be easily implemented using Java EE’s JASPIC and a sprinkle of utility code from the experimental OmniSecurity project (which is currently being discussed as one of the possible options to simplify security in Java EE 8).

A basic implementation looks as follows:

public class BasicAuthModule extends HttpServerAuthModule {
 
    @Override
    public AuthStatus validateHttpRequest(HttpServletRequest request, HttpServletResponse response, HttpMsgContext httpMsgContext) throws AuthException {
 
        String[] credentials = getCredentials(request);
        if (!isEmpty(credentials)) {
 
            UsernamePasswordIdentityStore identityStore = getReferenceOrNull(UsernamePasswordIdentityStore.class);
            if (identityStore != null) {
                if (identityStore.authenticate(credentials[0], credentials[1])) {
                    return httpMsgContext.notifyContainerAboutLogin(
                        identityStore.getUserName(), 
                        identityStore.getApplicationRoles()
                    );
                }                
            }            
        }
 
        if (httpMsgContext.isProtected()) {
            response.setHeader("WWW-Authenticate", "Basic realm=\"test realm:\"");
            return httpMsgContext.responseUnAuthorized();
        }
 
        return httpMsgContext.doNothing();
    }
 
    private String[] getCredentials(HttpServletRequest request) {
 
        String authorizationHeader = request.getHeader("Authorization");
        if (!isEmpty(authorizationHeader) && authorizationHeader.startsWith("Basic ") ) {
            return new String(parseBase64Binary(authorizationHeader.substring(6))).split(":");
        }
 
        return null;
    }
}

Full code in the OmniSecurity repo

Using injection, the example can be simplified a little and will then look as follows:

public class BasicAuthModule extends HttpServerAuthModule {
 
    @Inject
    private UsernamePasswordIdentityStore identityStore;
 
    @Override
    public AuthStatus validateHttpRequest(HttpServletRequest request, HttpServletResponse response, HttpMsgContext httpMsgContext) throws AuthException {
 
        String[] credentials = getCredentials(request);
        if (!isEmpty(credentials) && identityStore.authenticate(credentials[0], credentials[1])) {
            return httpMsgContext.notifyContainerAboutLogin(
                identityStore.getUserName(),
                identityStore.getApplicationRoles()
            );
        }
 
        if (httpMsgContext.isProtected()) {
            response.setHeader("WWW-Authenticate", "Basic realm=\"test realm:\"");
            return httpMsgContext.responseUnAuthorized();
        }
 
        return httpMsgContext.doNothing();
    }
 
    private String[] getCredentials(HttpServletRequest request) {
 
        String authorizationHeader = request.getHeader("Authorization");
        if (!isEmpty(authorizationHeader) && authorizationHeader.startsWith("Basic ") ) {
            return new String(parseBase64Binary(authorizationHeader.substring(6))).split(":");
        }
 
        return null;
    }
}

Note that the JASPIC auth module as shown here is responsible for implementing the client/server interaction details. Validating the credentials (username/password here) and obtaining the username and roles is delegated to an identity store (which can e.g. be database or LDAP based).

Arjan Tijms

css.php best counter