Red Hat SummitEste conteúdo não está disponível no idioma selecionado.
Chapter 6. Configuring a Security Domain to use a Filesystem
Security domains can also be configured to use a filesystem as an identity store for authentication and authorization by using a login module.
6.1. UsersRoles Login Module
UsersRoles login module is a simple login module that supports multiple users and user roles loaded from Java properties files. The primary purpose of this login module is to easily test the security settings of multiple users and roles using properties files deployed with the application. The default username-to-password mapping filename is users.properties and the default username-to-roles mapping filename is roles.properties.
This login module supports password stacking, password hashing, and unauthenticated identity.
The properties files are loaded during initialization using the initialize method thread context class loader. This means that these files can be placed on the classpath of the Java EE deployment (for example, into the WEB-INF/classes folder in the WAR archive), or into any directory on the server classpath.
| Option | Type | Default | Description |
|---|---|---|---|
| usersProperties | Path to a file or resource. | users.properties | The file or resource which contains the user-to-password mappings. The format of the file is username=password |
| rolesProperties | Path to a file or resource. | roles.properties | The file or resource which contains the user-to-role mappings. The format of the file is username=role1,role2,role3 |
| password-stacking | useFirstPass or false | false | A value of useFirstPass indicates that this login module should first look to the information stored in the LoginContext for the identity. This option can be used when stacking other login modules with this one. |
| hashAlgorithm | String representing a password hashing algorithm. | none | The name of the java.security.MessageDigest algorithm to use to hash the password. There is no default so this option must be explicitly set to enable hashing. When hashAlgorithm is specified, the clear text password obtained from the CallbackHandler is hashed before it is passed to UsernamePasswordLoginModule.validatePassword as the inputPassword argument. The password stored in the users.properties file must be comparably hashed. |
| hashEncoding | base64 or hex | base64 | The string format for the hashed password, if hashAlgorithm is also set. |
| hashCharset | string | The default encoding set in the container’s runtime environment | The encoding used to convert the clear-text password to a byte array. |
| unauthenticatedIdentity | principal name | none | Defines the principal name assigned to requests which contain no authentication information. This can allow unprotected servlets to invoke methods on EJBs that do not require a specific role. Such a principal has no associated roles and can only access unsecured EJBs or EJB methods that are associated with the unchecked permission constraint. |
6.1.1. Configuring a Security Domain to use the UsersRoles Login Module
The below example assumes the following files have been created and are available on the application’s classpath:
- sampleapp-users.properties
- sampleapp-roles.properties
CLI Commands for Adding the UserRoles Login Module
/subsystem=security/security-domain=sampleapp:add/subsystem=security/security-domain=sampleapp/authentication=classic:add/subsystem=security/security-domain=sampleapp/authentication=classic/login-module=UsersRoles:add( \
code=UsersRoles, \
flag=required, \
module-options=[ \
("usersProperties"=>"sampleapp-users.properties"), \
("rolesProperties"=>"sampleapp-roles.properties") \
])reloadResulting XML
<security-domain name="sampleapp">
<authentication>
<login-module code="UsersRoles" flag="required">
<module-option name="usersProperties" value="sampleapp-users.properties"/>
<module-option name="rolesProperties" value="sampleapp-roles.properties"/>
</login-module>
</authentication>
</security-domain>
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}