Basic authentication mechanism in JBOSS

Name implies that this is the basic authentication mechanism type in JBOSS. When we trying to access to secured resource, then application will ask about username and password. If username and password are correct, then user can access to the resource. Lets see how to enable basic authentication for a resource.

First create an enterprise application like earlier discussed. Then we have to do some configurations. So first open the web.xml file under configuration files of testApp-war. Then add following code within <web-app> tag.


<security-constraint>
<web-resource-collection>
<web-resource-name>Admin Pages</web-resource-name>
<url-pattern>/protected_resource/*</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<description>Only allow users from following roles</description>
<role-name>guest</role-name>
   <role-name>admin</role-name>
</auth-constraint>
     
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>My Secure Content Authentication</realm-name>
 </login-config>


In the URL pattern tag you have to specify the URL of the secured webpage. You can specify more than
one URL pattern. A URL pattern beginning with ‘/’ and ending with ‘/*’ specifies a path mapping and ‘*.’
Specifies an extension mapping. String containing only ‘/’ specifies default server while all other strings
denote the exact matches.
<role-name> is the allowed rolls for secured resource.
Then we have to edit jboss-web.xml file also. That config file also locate in the previous directory. Open the jboss-web.xml file and add following code inside <jboss-web> tag.

<security-domain>java:/jaas/test_policy</security-domain>

Now we need to create a security domain in login-config.xml file which located under following directory.

{JBOSS_HOME}\server\default\conf\login-config.xml

Then add following application policy into login-config.xml

<application-policy name = "testPolicy">

       <authentication>

          <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"

             flag = "required">

           <module-option name="usersProperties">props/testuser.properties</module-option>

           <module-option name="rolesProperties">props/testrole.properties</module-option>

          </login-module>

       </authentication>

    </application-policy>

Now we need to create two more properties file to achieve Basic authentication. Therefore go to following directory and create to properties files called testuser.properties and testrole.properties.

{JBOSS_HOME}\server\default\conf\props

then add following username names and passwords to testuser.properties file.

akila=akila
sithum=sithum

akila is the username and the password is akila.

Then add following username with the role inside the testrole.properties file.

akila=admin
sithum=guest

akila is the username and admin is the role of akila.

now we need to test basic authentication. So go to web browser and request to protected resource. Now you will see a pop-up box that asking about user name and password like below. Then enter your username and password. Now you can access your protected resource. 

:)