Chapter 7. Security

The following topics explain how to secure JAX-RS endpoints.

The following topics explain how to secure JAX-WS endpoints.

The following topics explain how to secure JMS endpoints.

Additionally, you can use Camel’s notion of Route Policies to integrate with the JBoss EAP security system.

Camel supports the notion of RoutePolicies, which can be used to integrate with the JBoss EAP security system. There are currently two supported scenarios for security integration.

CamelContext camelctx = new DefaultCamelContext();
camelctx.addRoutes(new RouteBuilder() {
    @Override
    public void configure() throws Exception {
        from("direct:start")
        .policy(new ClientAuthorizationPolicy())
        .to("ejb:java:module/AnnotatedSLSB?method=doSelected");
    }
});

ProducerTemplate producer = camelctx.createProducerTemplate();
Subject subject = new Subject();
subject.getPrincipals().add(new DomainPrincipal(domain));
subject.getPrincipals().add(new EncodedUsernamePasswordPrincipal(username, password));
producer.requestBodyAndHeader("direct:start", "Kermit", Exchange.AUTHENTICATION, subject, String.class);

CamelContext camelctx = new DefaultCamelContext();
camelctx.addRoutes(new RouteBuilder() {
    @Override
    public void configure() throws Exception {
        from("direct:start")
        .policy(new DomainAuthorizationPolicy().roles("Role2"))
        .transform(body().prepend("Hello "));
    }
});
camelctx.start();

ProducerTemplate producer = camelctx.createProducerTemplate();
Subject subject = new Subject();
subject.getPrincipals().add(new DomainPrincipal(domain));
subject.getPrincipals().add(new EncodedUsernamePasswordPrincipal(username, password));
producer.requestBodyAndHeader("direct:start", "Kermit", Exchange.AUTHENTICATION, subject, String.class);

You can secure a Camel on EAP application by using the Elytron security framework.

The following example demonstrates how to secure CXF endpoints with an Elytron security domain.

In this example, a Camel route takes a message payload from a direct endpoint and passes it to a CXF producer endpoint. The producer uses the payload to pass arguments to a CXF JAX-WS web service that is secured by TLS mutual authentication (two-way SSL and client certificate authentication).

Camel on EAP secures camel-cxf consumer endpoints with the Elytron security framework.

To accomplish this, refer to an application security domain the WEB-INF/jboss-web.xml file of your WAR deployment, for example:

<jboss-web>
  <security-domain>my-application-security-domain</security-domain>
</jboss-web>

The <security-domain> configuration references the name of <application-security-domain> that is defined by the Undertow subsystem. For example, you can configure the Undertow subsystem <application-security-domain> within the JBoss EAP server standalone.xml configuration file as follows:

<subsystem xmlns="urn:jboss:domain:undertow:6.0">
    ...
    <application-security-domains>
        <application-security-domain name="my-application-security-domain" http-authentication-factory="application-http-authentication"/>
    </application-security-domains>
</subsystem>

The Elytron subsystem defines the HTTP authentication factory, application-http-authentication. The application-http-authentication factory is available by default in both the standalone.xml and standalone-full.xml server configuration. For example:

<subsystem xmlns="urn:wildfly:elytron:1.2">
    ...
    <http>
        ...
        <http-authentication-factory name="application-http-authentication" http-server-mechanism-factory="global" security-domain="ApplicationDomain">
            <mechanism-configuration>
                <mechanism mechanism-name="BASIC">
                    <mechanism-realm realm-name="Application Realm" />
                </mechanism>
                <mechanism mechanism-name="FORM" />
            </mechanism-configuration>
        </http-authentication-factory>
        <provider-http-server-mechanism-factory name="global" />
    </http>
    ...
</subsystem>

The <http-authentication-factory> named application-http-authentication holds a reference to an Elytron security domain called ApplicationDomain.

For more information on configuring the Elytron subsystem, see the Elytron documentation.

You can configure security constraints, authentication methods and security roles for camel-cxf consumer endpoints within your WAR deployment WEB-INF/web.xml file. For example, to configure the basic authentication:

<web-app>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>secure</web-resource-name>
      <url-pattern>/webservices/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>my-role</role-name>
    </auth-constraint>
  </security-constraint>
  <security-role>
    <description>The role that is required to log in to /webservices/*</description>
    <role-name>my-role</role-name>
  </security-role>
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>my-realm</realm-name>
  </login-config>
</web-app>

The <url-pattern> defined by the Servlet Specification is relative to the context path of the web application. If your application is packaged as my-app.war, JBoss EAP makes it accessible under the context path /my-app. Also, you can apply the <url-pattern> /webservices/* to paths relative to /my-app.

For example, requests against http://my-server/my-app/webservices/my-endpoint will match the /webservices/* pattern. However, http://my-server/webservices/my-endpoint does not match.

To define the security constraints for camel-cxf consumer endpoints whose base path is outside of the host web application context path, Camel on EAP supports a custom, non-standard <url-pattern> convention. For example, to secure http://my-server/webservices/my-endpoint inside the my-app.war file, you can add the following configuration to the `web.xml`file:

<web-app>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>secure</web-resource-name>
      <url-pattern>///webservices/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>my-role</role-name>
    </auth-constraint>
  </security-constraint>
  <security-role>
    <description>The role that is required to log in to /webservices/*</description>
    <role-name>my-role</role-name>
  </security-role>
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>my-realm</realm-name>
  </login-config>
</web-app>