Secure the J2EE Middleware Stack

dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: example
o: example

dn: dc=osm,dc=example,dc=com
objectClass: dcObject
objectClass: organizationalUnit
dc: osm
ou: osm

dn: uid=tomy,dc=osm,dc=example,dc=com
objectClass: inetOrgPerson
uid: tomy
sn: tom
cn: tom yan
mail: tom.yan@example.com
carLicense: sea4321
userPassword: tom

dn: uid=benw,dc=osm,dc=example,dc=com
objectClass: inetOrgPerson
uid: benw
sn: ben
cn: ben won
mail: ben.won@example.com
userPassword: ben

dn: cn=jmxRole,dc=osm,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: jmxRole
uniqueMember: uid=tomy,dc=osm,dc=example,dc=com

dn: cn=ejbRole,dc=osm,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: ejbRole
uniqueMember: uid=benw,dc=osm,dc=example,dc=com

<application-policy name="LdapRealm">
<authentication>
<login-module code="org.jboss.security.auth.spi.LdapLoginModule" flag="required">
<module-option name="java.naming.factory.initial">
com.sun.jndi.ldap.LdapCtxFactory
</module-option>
<module-option name="java.naming.provider.url">
ldap://[IP or Name of CDS Server]:389/
</module-option>
<module-option name="java.naming.security.authentication">
simple
</module-option>
<module-option name="principalDNPrefix">
uid=
</module-option>
<module-option name="principalDNSuffix">
,dc=osm,dc=example,dc=com
</module-option>
<module-option name="rolesCtxDN">dc=osm,dc=example,dc=com
</module-option>
<module-option name="roleAttributeID">cn
</module-option>
<module-option name="uidAttributeID">uniqueMember
</module-option>
<module-option name="matchOnUserDN">true
</module-option>
</login-module>
</authentication>
</application-policy>

<auth-constraint>
	<role-name>
	JBossAdmin
	</role-name>
</auth-constraint>

<auth-constraint>
	<role-name>
	jmxRole
	</role-name>
</auth-constraint><security-role>

<security-role>
	<role-name>
	JBossAdmin
	</role-name>
</security-role>

</security-role> <security-role>
	<role-name>
	jmxRole
	</role-name>
</security-role>

<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users.
      <security-domain>java:/jaas/jmx-console</security-domain>
   -->
<security-domain>java:/jaas/LdapRealm</security-domain>
</jboss-web>

/*HelloClient.java*/
import java.util.*;
import javax.ejb.CreateException;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.rmi.PortableRemoteObject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.io.*;
import java.rmi.RemoteException;
import javax.security.auth.callback.*;

public class HelloClient
{
  public static void main( String [] args ){
        String userName = args[0];
        String password = args[1];

        System.out.println("Logging in user:" + userName);
        final String authFile = "./ejbLogin.conf";
        System.setProperty("java.security.auth.login.config", authFile);
        MyCallbackHandler handler = new
 							MyCallbackHandler(userName,password);
        try{
                LoginContext lc = new 
LoginContext("ejbLogin",handler);
                lc.login();
                System.out.println("Successfully logged in user:" + 
userName);
        }
        catch (LoginException le){
                System.out.println("Login failed");
                le.printStackTrace();
                return;
        }
        try{
Properties props = new Properties();
props.put("java.naming.factory.initial", "org.jnp.interfaces.NamingContextFactory");
props.put("java.naming.factory.url.pkgs", "org.jboss.naming:org.jnp.interfaces");
props.put("java.naming.provider.url", "localhost:1099");                

Context context = new InitialContext(props);
                Object lookupObj = context.lookup("osmsHello");
        HelloHome home = (HelloHome)
PortableRemoteObject.narrow(lookupObj, 
HelloHome.class);
                Hello hello = home.create();
                System.out.println("EJB method hello returns:" + 
hello.hello());
        }
        catch(Exception e){
                e.printStackTrace();
                return;
        }
  }
}
class MyCallbackHandler implements CallbackHandler
{
        private String username;
        private String password;
        public MyCallbackHandler(String username, String password){
                this.username = username;
                this.password = password;
        }
        public void handle(Callback[] callbacks) throws IOException,
 							UnsupportedCallbackException {
                for (int i = 0; i < callbacks.length; i++){
                        if (callbacks[i] instanceof NameCallback){
                                NameCallback nc = (NameCallback)
 												callbacks[i];
                                nc.setName(username);

                        }
                         else if (callbacks[i] instanceof
 												PasswordCallback){
                             PasswordCallback pc =
(PasswordCallback) callbacks[i];
pc.setPassword(password.toCharArray());

                        }
                        else{
                            throw new UnsupportedCallbackException(
callbacks[i], "Unrecognized Callback");
                        }
                }
        }
}

ejbLogin{
org.jboss.security.ClientLoginModule required;
};

Logging in user:benw
Successfully logged in user:benw
EJB method hello returns:This is from hello!

Logging in user:tomy
Successfully logged in user:tomy
java.rmi.AccessException: SecurityException; nested exception is:
         java.lang.SecurityException: Insufficient method permissions,
				principal=tomy, ejbName=Hello, method=hello, interface=REMOTE, 
				requiredRoles=[ejbRole], principalRoles=[jmxRole]
…

<%@page contentType="text/html;charset=GBK"%>
<%@page import="java.io.*,
javax.naming.Context,
javax.naming.InitialContext"
%>
<html>
<body>
<%
        try{
                Context ctx = new InitialContext();
                Object obj = ctx.lookup("osmsHello");
                HelloHome home =(HelloHome)javax.rmi.PortableRemoteObject.narrow(obj,
							HelloHome.class );
                Hello helloWorld = home.create();
                out.println("helloWorld method returns:" + helloWorld.helloWorld());
        }
        catch (Exception e){
                out.println(e.toString());
        }
%>
</body>
</html>

<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC
   "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
   "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>
<ejb-ref><ejb-ref-name>ejb/Hello</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<home>HelloHome</home><remote> Hello</remote>
<ejb-link>Hello</ejb-link>
</ejb-ref>

<security-constraint>
<display-name>Constraints of osms Security Environment
</display-name>
<!-- URI security patterns and the HTTP methods to protect on them. -->
<web-resource-collection><web-resource-name>
Protected Admininistration Console Resources
</web-resource-name>
<url-pattern>/helloWorld.jsp</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<!-- Anyone with these roles may enter this area. -->
<auth-constraint>
<role-name>ejbRole</role-name>
<role-name>jmxRole</role-name>
</auth-constraint>
<user-data-constraint>
<description>no description</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- Default login configuration uses form-based authentication -->
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>LdapRealm</realm-name>
</login-config>
<!-- Security roles referenced by this web application -->
<security-role><role-name>ejbRole</role-name></security-role>
<security-role><role-name>jmxRole</role-name></security-role>
</web-app>

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
<ejb-ref>
<ejb-ref-name>ejb/Hello</ejb-ref-name><jndi-name>osmsHello</jndi-name>
</ejb-ref>
<security-domain>java:/jaas/LdapRealm</security-domain>
</jboss-web