Chapter 8. Advanced Security Options

Procedure 8.1. Task

1. Open the log-in configuration file in a text editor: vi SOA_ROOT/jboss-as/server/PROFILE/conf/login-config.xml
2. Add the details of your custom log-in module.
3. Save the file and exit.
4. Since different log-in modules require different information, you must specify the CallbackHandler attribute to be used. Open the specific security configuration for that service.
5. Make sure that the CallbackHandler specifies a fully-qualified classname for the class which implements the EsbCallbackHandler interface. This code shows you how to do so:

   public interface EsbCallbackHandler extends CallbackHandler
   {
     void setAuthenticationRequest(final AuthenticationRequest authRequest);
     void setSecurityConfig(final SecurityConfig config);
   }
   

   Copy to Clipboard Toggle word wrap
6. Add both the "principle" and the credentials needed to authenticate a caller to the AuthenticationRequest class.

Procedure 8.2. Task

1. Open the log-in configuration file in a text editor: vi SOA_ROOT/jboss-as/server/PROFILE/conf/login-config.xml
2. Set the rolesPropertiesFile property. (This property can point to a file located on either the local file system or the class-path).
3. Map users to roles. This example code shows how to do so:

   # user=role1,role2,...
   guest=guest
   esbuser=esbrole
   # The current implementation will use the Common Name(CN) specified
   # for the certificate as the user name.
   # The unicode escape is needed only if your CN contains a space
   Andy\u0020Anderson=esbrole,worker
   

   Copy to Clipboard Toggle word wrap
4. Save the file and exit.

Procedure 8.3. Task

1. Implement the SecurityService interface:

   public interface SecurityService
   {
       void configure() throws ConfigurationException;
   
       void authenticate(
           final SecurityConfig securityConfig, 
           final SecurityContext securityContext, 
           final AuthenticationRequest authRequest) 
           throws SecurityServiceException;
   
       boolean checkRolesAllowed(
           final List<String> rolesAllowed, 
           final SecurityContext securityContext);
   
       boolean isCallerInRole(
           final Subject subject, 
           final Principle role);
   
       void logout(final SecurityConfig securityConfig);
   
       void refreshSecurityConfig();
   }
   

   Copy to Clipboard Toggle word wrap
2. Open the global configuration file in a text editor: vi SOA_ROOT/jboss-as/server/PROFILE/deployers/esb.deployer/jbossesb-properties.xml.
3. Configure the file to use the customized SecurityService
4. Save the file and exit.

Procedure 8.4. Task

1. Edit the Settings in the jboss-service.xml File

   Open the file in a text editor: vi SOA_ROOT/server/PROFILE/conf/jboss-service.xml

2. Configure the Settings in the File

   Here is an example:

   <attribute name="DownloadServerClasses">false</attribute>
   

   Copy to Clipboard Toggle word wrap
   Set this value to false to ensure that client applications can only download Enterprise Java Bean classes.

   Important

   By default, this value is set to false in the SOA Platform's 'production' profile. The value is set to true in all other cases, including the SOA Standalone version's default profile. Note that this is not a secure configuration and should only be used in development environments.