Chapter 2. Securing management interfaces and applications

Procedure

1. Configure an application-security-domain in the undertow subsystem:

   Syntax

   /subsystem=undertow/application-security-domain=<application_security_domain_name>:add(security-domain=<security_domain_name>)

   Example

   /subsystem=undertow/application-security-domain=exampleApplicationSecurityDomain:add(security-domain=exampleSecurityDomain)
   {"outcome" => "success"}

2. Configure the application’s web.xml to protect the application resources.

   Syntax

   <!DOCTYPE web-app PUBLIC
    "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd" >
   
   <web-app>
   
    <!-- Define the security constraints for the application resources.
         Specify the URL pattern for which a challenge is -->
   
    <security-constraint>
           <web-resource-collection>
               <web-resource-name><!-- Name of the resources to protect --></web-resource-name>
               <url-pattern> <!-- The URL to protect  --></url-pattern>
           </web-resource-collection>
   
           <!-- Define the role that can access the protected resource -->
           <auth-constraint>
               <role-name> <!-- Role name as defined in the security domain --></role-name>
               <!-- To disable authentication you can use the wildcard *
               	 To authenticate but allow any role, use the wildcard **. -->
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method>
           	<!-- The authentication method to use. Can be:
           		BASIC
           		CLIENT-CERT
           		DIGEST
           		FORM
           		SPNEGO
           	 -->
           </auth-method>
   
           <realm-name><!-- The name of realm to send in the challenge  --></realm-name>
       </login-config>
    </web-app>

   Example

   <!DOCTYPE web-app PUBLIC
    "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd" >
   
   <web-app>
   
    <!-- Define the security constraints for the application resources.
         Specify the URL pattern for which a challenge is -->
   
    <security-constraint>
           <web-resource-collection>
               <web-resource-name>all</web-resource-name>
               <url-pattern>/*</url-pattern>
           </web-resource-collection>
   
           <!-- Define the role that can access the protected resource -->
           <auth-constraint>
               <role-name>Admin</role-name>
               <!-- To disable authentication you can use the wildcard *
               	 To authenticate but allow any role, use the wildcard **. -->
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method>BASIC</auth-method>
   
           <realm-name>exampleSecurityRealm</realm-name>
       </login-config>
    </web-app>

   Note

   You can use a different auth-method.

3. Configure your application to use a security domain by either creating a jboss-web.xml file in your application or setting the default security domain in the undertow subsystem.

   • Create jboss-web.xml file in the your application’s WEB-INF directory referencing the application-security-domain.

     Syntax

     <jboss-web>
       <security-domain> <!-- The security domain to associate with the application --></security-domain>
     </jboss-web>

     Example

     <jboss-web>
       <security-domain>exampleApplicationSecurityDomain</security-domain>
     </jboss-web>

   • Set the default security domain in the undertow subsystem for applications.

     Syntax

     /subsystem=undertow:write-attribute(name=default-security-domain,value=<application_security_domain_to_use>)

     Example

     /subsystem=undertow:write-attribute(name=default-security-domain,value=exampleApplicationSecurityDomain)
     {
         "outcome" => "success",
         "response-headers" => {
             "operation-requires-reload" => true,
             "process-state" => "reload-required"
         }
     }

4. Reload the server.

   reload

Verification

1. In the application root directory, compile your application with the following command:

   $ mvn package
   ...
   [INFO] ------------------------------------------------------------------------
   [INFO] BUILD SUCCESS
   [INFO] ------------------------------------------------------------------------
   [INFO] Total time: 1.015 s
   [INFO] Finished at: 2022-04-28T17:48:53+05:30
   [INFO] ------------------------------------------------------------------------

2. Deploy the application.

   $ mvn wildfly:deploy

3. In a browser, navigate to http://localhost:8080/simple-webapp-example/secured. You get a login prompt confirming that authentication is now required to access the application.