Geek asks and answers

Authentication and Auronization of Vaadin

I am new to Vaadin. Before that, I made a JSF web application. I had a ManagedBean performing a user login. I used the security realm to delegate the actual credential verification.

How do I do this in Vaadin? Is there any best practice? I am at the point where I am just putting something together, but there must be some kind of standard procedure, right ?? I found some tutorials on this, but mostly used Spring (I want to use EJB). In addition, each textbook seemed unnecessarily complicated.

There must be some simple + convincing textbook for something so common.

+5
source share
3 answers

Vaadin , Vaadin JAAS. . , Spring, Shiro, ESB JAAS. , , , . :

1. Vaadin CDI:

<!-- Vaadin Official DI support. -->
<dependency>
  <groupId>com.vaadin</groupId>
  <artifactId>vaadin-cdi</artifactId>
  <version>1.0.0.alpha2</version>
</dependency>

2. JAAS

, JAAS vaadin, , JAAS (TomEE, Jboss, Wildfly, Glasfish), . Tomee.

3. .

, :

public class MyLoginModule implements LoginModule {
private CallbackHandler handler;
private Subject subject;
private UserPrincipal userPrincipal;
private RolePrincipal rolePrincipal;
private String login;
private List<String> userGroups;
@Override
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
Map<String, ?> options) {
handler = callbackHandler;
this.subject = subject;
}
@Override
public boolean login() throws LoginException {
Callback[] callbacks = new Callback[2];
callbacks[0] = new NameCallback("login");
callbacks[1] = new PasswordCallback("password", true);
try {
handler.handle(callbacks);
String name = ((NameCallback) callbacks[0]).getName();
String password = String.valueOf(((PasswordCallback) callbacks[1]).getPassword());
// Here we validate the credentials against some
// authentication/authorization provider.
// It can be a Database, an external LDAP, a Web Service, etc.
// For this tutorial we are just checking if user is "user123" and
// password is "pass123"
if (name != null && name.equals("admin") && password != null && password.equals("admin")) {
login = name;
userGroups = new ArrayList<String>();
userGroups.add("admin");
return true;
}
// If credentials are NOT OK we throw a LoginException
throw new LoginException("Authentication failed");
} catch (IOException e) {
throw new LoginException(e.getMessage());
} catch (UnsupportedCallbackException e) {
throw new LoginException(e.getMessage());
}
}
@Override
public boolean commit() throws LoginException {
userPrincipal = new UserPrincipal(login);
subject.getPrincipals().add(userPrincipal);
if (userGroups != null && userGroups.size() > 0) {
for (String groupName : userGroups) {
rolePrincipal = new RolePrincipal(groupName);
subject.getPrincipals().add(rolePrincipal);
}
}
return true;
}
@Override
public boolean abort() throws LoginException {
return false;
}
@Override
public boolean logout() throws LoginException {
subject.getPrincipals().remove(userPrincipal);
subject.getPrincipals().remove(rolePrincipal);
return true;
}
}

META-INF/context.xml . TomEE, glashfish .

<?xml version="1.0" encoding="UTF-8"?>
<Context>
  <Realm className="org.apache.catalina.realm.JAASRealm" appName="myrealm" userClassNames="net.sf.jaas.auth.UserPrincipal"
    roleClassNames="net.sf.jaas.auth.RolePrincipal" />
</Context>

, userClassNames roleClassNames - Java Pojo, java.security.Principal;

3. JAAS Vaadin

, Vaadin TextField , doLoginEvent() JAAS. JaasAccessControl.login, LoginModule.

  import com.vaadin.cdi.access.JaasAccessControl;
  try {
            JaasAccessControl.login(loginEvent.getUsername(), loginEvent.getPassword());
            logger.info("User {} authenticated", getPrincipalName());
            navigator.navigateTo(Main.NAME);
        } catch (Exception e) {
            Notification.show("Error logging in", Type.ERROR_MESSAGE);
            logger.error(e.getMessage(), e);
        }

4. .

, JAAS. , . Principal (, LoginModule).

public boolean isUserInRole(String role) {
        return JaasAccessControl.getCurrentRequest().isUserInRole(role);
    }

    public String getPrincipalName() {
        Principal principal = JaasAccessControl.getCurrentRequest().getUserPrincipal();
        if (principal != null) {
            return principal.getName();
        }

        return null;
    }

    public boolean isUserSignedIn() {
        Principal principal = JaasAccessControl.getCurrentRequest().getUserPrincipal();
        return principal != null;
    }

5. LoginModule

, , Java EE, Tomee . . Tomee JAAS, :

6. JAAS TomEE jaas.config, LoginModule, :

filename: jaas.config 
myrealm{
    net.sf.jaas.MyLoginModule required;
};

:

-Djava.security.auth.login.config=E:/apache-tomee-jaxrs-1.6.0.2/conf/jaas.config

. , Tomee, Vaadin 7, JAAS,

+3

. , , adddon spring, Vaadin spring security

+1

JAAS, Vaadin 8, Vaadin CDI LoginForm , :

  • Vaadin CDI pom.xml
  • CDI Vaadin @CDIUI Navigator
  • Allow authorization in the CDI view by adding an annotation @RolesAllowed(or any other annotation javax.annotation.security)
  • Enter the type of login that comes from the built-in LoginFormand uses JaasAccessControlto authenticate the user.

This is actually a pretty pleasant, quick experience when you figure out how shapes fit together.

There's a longer article in the Vaadin wiki that explains how to use database-enabled authentication using JAAS.

+1
source

More articles:


All Articles