Java TM LDAP Dynamic Group Realm Sample Application |
LDAP Dynamic Group Realm Sample Application
This document describes an LDAP Dynamic Group realm based security application in the Sun Java System Application Server 8.1 2005Q1.
This document contains the following sections:
- Overview
- Compiling and Assembling the Application
- Deploying the Sample Application
Overview
The LDAP Dynamic Group Realm Sample Application demonstrates:
- How J2EE components can be secured using an LDAP Dynamic Group Realm
- How to secure J2EE 1.4 platform compliant application components
The application described here defines an enterprise bean and an application client. The methods of the enterprise bean have been associated with either the Administrator or the SecretRole in the enterprise bean deployment descriptor. The idea is to associate the Administrator role with a dynamic LDAP group, called ldapdynamicgroup.Then the application client verifies that usernames belonging to the ldapdynamicgroup group have access to methods of the EJB that have been associated with the Administrator role, while access to methods not associated with that role will be denied.
To associate the Administrator role with the dynamic group ldapdynamicgroup of an LDAP server, we follow these basic steps:
- Create a username sjsasuser, with password password, on a given LDAP server. The first entry in the setup/sjsas8.samples.ldif can be imported into an LDAP server to accomplish this requirement.
- Create a dynamic group named ldapdynamicgroup in the LDAP server so that its dynamic query includes the username created in Step 1. The second entry in the setup/sjsas8.samples.ldif can be imported into an LDAP server to accomplish this requirement.
- In the src/conf/sun-application.xml deployment descriptor of the application, we associate the Administrator role with the ldapdynamicgroup group, and this application with the ldaprealmperapp Realm. In the next step we explain how to associate this Realm with an LDAP realm.
- Finally, associate ldaprealmperapp with an LDAP realm by adding an entry like the one below in the <install_dir>/domains/<domain-name>/domain.xml file of the application server:
<auth-realm classname="com.sun.enterprise.security.auth.realm.ldap.LDAPRealm" name="ldaprealmperapp">Make sure to configure the directory and base-dn properties according to the LDAP server to be used for testing.
<property name="directory" value="ldap://localhost:389"/>
<property name="base-dn" value="dc=top,dc=org,dc=company,dc=com"/>
<property name="jaas-context" value="ldapRealm"/> </auth-realm>The LDAP Dynamic Group Realm sample application contains an application client and an enterprise bean.
The directory structure of the Sample Application is as follows (all paths are relative to <install_dir>/samples/security/ldaprealm/apps/dynamicgroup):
dynamicgroup-client/src/conf - the application client deployment descriptors required for deployment on the Application Serverdynamicgroup-client/src/java/samples/security/ldaprealm/dynamicgroup/client - source code for the application clientdynamicgroup-ejb/src/java/samples/security/ldaprealm/dynamicgroup/ejb - source code for the enterprise bean
Compiling and Assembling the Application
This section contains instructions on how to build and assemble the application.
- Compile and assemble the application.
- Change directory to: <install_dir>/samples/security/ldaprealm/apps/dynamicgroup.
- Execute the command asant core. This command compiles all source files and assembles the following module:
- ldaprealm-dynamicgroup.ear
Main application, containing an application client and an enterprise bean that illustrate how to use LDAP Dynamic Group Realms- Deploy the application.
After compiling the sources and assembling the EAR file, you may proceed to Deploying the Sample Application. Steps 3 and 4 are optional.- Clean the application project area (optional).
Execute the command asant clean to remove all the files generated in Step 1.- Generate API documentation (optional).
Execute the command asant javadocs under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup. The API documentation will be located under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup/javadocs.
Deploying the Sample Application
This section contains instructions on how to deploy the application on the Application Server.
Execute the command asant deploy under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup.
This command deploys the EAR file of the LDAP Dynamic Group Realm sample application, ldaprealm-dynamicgroup.ear.
As an optional step, you can use the asadmin command to verify that the application has been registered. Otherwise, proceed directly to Running the Sample Application.
To verify the registration of the application, execute the command asadmin list-components to look at applications deployed with a server instance. For example:
<install_dir>/bin/asadmin list-components --user <username> --password <password>You will see the sample LDAP Dynamic Group Realm listed as a J2EE application:
ldaprealm-dynamicgroup <j2ee-application>
Running the Sample Application
Execute the command asant run under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup.
This command invokes the application client of the LDAP Dynamic Group Realm sample application. The application client looks up the enterprise bean and invokes some of its methods. Those methods associated with the Administrator role will be successfully executed. Access to the ones associated with the SecretRole will be denied. This is the expected output:
[echo] Running the ldaprealm-dynamicgroup program: [exec] **************************************************************** [exec] *LDAP LdapRealmAppClient with DynamicGroup * [exec] **************************************************************** [exec] Testing with user: sjsasuser; role:Administrator [exec] [1] Calling testIsCallerInRole()... [exec] [1] PASSED [exec] [2] Calling testIsCallerExpected()... [exec] [2] PASSED [exec] [3] Calling authorized method - methodIsAuthorized() [exec] [3] PASSED [exec] [4] Calling unauthorized method - methodIsNotAuthorized(): [exec] [4] PASSED: Got expected AccessException!
Troubleshooting
If you encounter problems when running the application, review the Application Server log file located at
<install_dir>/domains/<domain-name>/logs/server.logto learn what exactly went wrong.
Copyright © 2004 Sun Microsystems, Inc. All rights reserved.Last Updated August 3, 2004