Chapter 5. Securing a web application using OpenID Connect

Procedure

1. Configure the application’s web.xml to protect the application resources.

   Syntax

   <!DOCTYPE web-app PUBLIC
    "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd" >
   
   <web-app>
   
    <!-- Define the security constraints for the application resources.
         Specify the URL pattern for which a challenge is -->
   
    <security-constraint>
           <web-resource-collection>
               <web-resource-name><!-- Name of the resources to protect --></web-resource-name>
               <url-pattern> <!-- The URL to protect  --></url-pattern>
           </web-resource-collection>
   
           <!-- Define the role that can access the protected resource -->
           <auth-constraint>
               <role-name> <!-- Role name as defined in the security domain --></role-name>
               <!-- To disable authentication you can use the wildcard *
               	 To authenticate but allow any role, use the wildcard **. -->
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method>
           	<!-- The authentication method to use. Can be:
           		BASIC
           		CLIENT-CERT
           		DIGEST
           		FORM
           		SPNEGO
           	 -->
           </auth-method>
   
           <realm-name><!-- The name of realm to send in the challenge  --></realm-name>
       </login-config>
    </web-app>

   Copy to Clipboard Toggle word wrap

   Example

   <?xml version="1.0" encoding="UTF-8"?>
   
   <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
       metadata-complete="false">
   
       <security-constraint>
           <web-resource-collection>
               <web-resource-name>secured</web-resource-name>
               <url-pattern>/secured</url-pattern>
           </web-resource-collection>
   
           <auth-constraint>
               <role-name>Admin</role-name>
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method></auth-method>
       </login-config>
   
       <security-role>
           <role-name>*</role-name>
       </security-role>
   </web-app>

   Copy to Clipboard Toggle word wrap

   In this example, only the users with the role Admin can access the application.

2. To secure the application with OpenID Connect, either update the deployment configuration or configure the elytron-oidc-client subsystem.

   Note

   If you configure OpenID Connect in both the deployment configuration and the elytron-oidc-client subsystem, the configuration in the elytron-oidc-client subsystem secure-deployment attribute takes precedence over the configuration in the application deployment descriptor.

   • Updating the deployment configuration:

     1. Create a file oidc.json in the WEB-INF directory, like this:

        {
          "provider-url" : "http://localhost:8180/auth/realms/example_realm",
          "ssl-required": "external",
          "client-id": "my_jbeap",
          "public-client": true,
          "confidential-port": 0
        }

        Copy to Clipboard Toggle word wrap

     2. Update the deployment descriptor web.xml file with the following text to declare that this application uses OIDC:

        <login-config>
            <auth-method>OIDC</auth-method>
        </login-config>

        Copy to Clipboard Toggle word wrap

   • Configuring the elytron-oidc-client subsystem:

     • To secure your application, use the following management CLI command:

       /subsystem=elytron-oidc-client/secure-deployment=simple-oidc-example.war/:add(client-id=my_jbeap,provider-url=http://localhost:8180/auth/realms/example_realm,public-client=true,ssl-required=external)

       Copy to Clipboard Toggle word wrap

3. In the application root directory, compile your application with the following command:

   $ mvn package

   Copy to Clipboard Toggle word wrap

4. Deploy the application.

   $ mvn wildfly:deploy

   Copy to Clipboard Toggle word wrap

Verification

1. In a browser, navigate to http://localhost:8080/simple-webapp-example/secured.

   You are redirected to Red Hat Single Sign-On login page.

2. Log in with your credentials. For example:

   username: user1
   password: passwordUser1

   Copy to Clipboard Toggle word wrap

   You get the following output:

   Forbidden

   Copy to Clipboard Toggle word wrap