Java EE 8 security and JSON binding API

Java EE Security and JSON-Binding

Hi!
I AM ALEX THEEDOM
Java EE consultant/trainer
@alextheedom
ReadLearnCode.com

Java EE courses
Lynda.com - First month free
RESTful services with JAX-RS
WebSocket programming
Bean validation
JSON processing
CDI 2.0 and Design patterns and architecture

Java EE 8: Only What’s New
bit.ly/CodeEuropeConf
Special price $9.95
Includes:
JSON Binding 1.0
Security 1.0
Servlet 4.0
Bean Validation 2.0
CDI 2.0
JAX-RS 2.1
JSF 2.3
JSON Processing 1.1 and JPA 2.2.

Security 1.0 API
JSON Binding 1.0 API
Round Up
Q & A
1
2
3
4
1
2
3
4

Security 1.0 API
Consistent Security Approach
1

Security 1.0 API
Objective
◦ Simplify, standardise and modernise
◦ JACC, JASPIC and proprietary APIs
◦ Security EG to resolve issues

Security 1.0 API
Historical issues
• Inconsistent across containers
• Servlets provide
HttpServletRequest.isUserInRole(String role)
• EJBs provide
EJBContext.isCallerInRole(String roleName)
• Existing security mechanisms tricky
• Limited portable authentication
• No standard identity store management
• No support for custom authentication rules

Parallel thread
◦ Enable developers
◦ APIs for authentication, identity stores, roles and permissions across containers
◦ Java EE 8 Survey Final Results
◦ 11% security simplications
Source: https://blogs.oracle.com/theaquarium/java-ee-8-survey-final-results

Specification focus
◦ Relevant to cloud native applications
◦ An API for Web Authentication Mechanism
◦ A security context API
◦ An identity store API
◦ Simplify, standardise and modernise
◦ Web authentication has been modernised
◦ New security context API standardizes authentication
◦ Identity store abstraction to simplifies the use of identity stores.
@BasicAuthenticationMechanismDefinition
SecurityContext.getCallerPrincipal()
IdentityStore

Annotation driven authentication mechanism
◦ Simplified and standardised way to implement security
◦ HttpAuthenticationMechanism interface
◦ @BasicAuthenticationMechanismDefinition
◦ @FormAuthenticationMechanismDefinition
◦ @CustomFormAuthenticationMechanismDefinition
◦ Replicate Servlet 4 (section 13.6) authentication
◦ Developer can implement custom authentication

@BasicAuthenticationMechanismDefinition
◦ Triggers HTTP basic authentication (Servlet section 13.6.1)
◦ Optional realm name sent via the WWW-Authenticate header
@BasicAuthenticationMechanismDefinition(realmName = "user-realm")
@WebServlet("/user")
@DeclareRoles({"admin", "user", "demo"})
@ServletSecurity(@HttpConstraint(rolesAllowed = "user"))
public class UserServlet extends HttpServlet {
// Servlet Code
}

@FormAuthenticationMechanismDefinition
◦ Triggers form based authentication (Servlet section 13.6.3)
◦ loginToContinue option must be set
◦ Provides “login to continue” functionality
◦ useForwardToLogin = true/false
◦ useForwardToLoginExpression = "${appConfigs.forward}"
@FormAuthenticationMechanismDefinition(
loginToContinue = @LoginToContinue(
loginPage = "/login-servlet",
errorPage = "/login-servlet-fail"
)
)
@ApplicationScoped
public class ApplicationConfig {
// Config Code
}

@CustomFormAuthenticationMechanismDefinition
◦ provides options for configuring a custom login form
@CustomFormAuthenticationMechanismDefinition(
loginToContinue = @LoginToContinue(
loginPage = "/login.do"
errorPage = "/error.do"
)
)
Backing bean
<form jsf:id="form">
Username <input jsf:id="username" type="text" jsf:value="#{loginBean.username}"/>
Password <input jsf:id="password" type="password" jsf:value="#{loginBean.password}"/>
<input type="submit" value="Login" jsf:action="#{loginBean.login}"/>
</form>
@FacesConfig(version = JSF_2_3)
@Named
@RequestScoped
public class LoginBean {
public void login() {
// login logic
}
}
◦ Only option configured
Login JSF

Custom HttpAuthentictionMechanism
◦ Develop your own implementation
◦ Must be implemented as CDI bean with @ApplicationScope
◦ validateRequest() authenticates an HTTP request from a caller
◦ secureResponse() secures the HTTP response message
◦ cleanSubject() clears the subject of provided principals and credentials
◦ HttpServletRequest, HttpServletResponse, and
HttpMessageContext

Custom HttpAuthentictionMechanism
◦ Example implementation
@ApplicationScoped
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {
@Inject
private IdentityStoreHandler idStoreHandler;
@Override
public AuthenticationStatus validateRequest(
HttpServletRequest req,
HttpServletResponse res,
HttpMessageContext msg) {
String username = ...get username from HttpRequest...
String password = ...get password from HttpRequest...
CredentialValidationResult result = idStoreHandler.validate(
new UsernamePasswordCredential(username, password));
return msg.notifyContainerAboutLogin(result);
}
}

Remember Me Feature
◦ Class level @RememberMe annotation
@RememberMe(
cookieMaxAgeSeconds = 3600
)
◦ cookieMaxAgeSeconds: Life of the remember me cookie
◦ cookieMaxAgeSecondsExpression: EL version of cookieMaxAgeSeconds
◦ cookieSecureOnly: accessed cookie via secure means
◦ cookieSecureOnlyExpression: EL version of cookieSecureOnly
◦ cookieHttpOnly: sent with HTTP requests only
◦ cookieHttpOnlyExpression: EL version cookieHttpOnly
◦ cookieName: The cookie’s name
◦ isRememberMe: Switches “remember me” on or off
◦ isRememberMeExpression: EL version of isRememberMe

Identity store abstraction
◦ IdentityStore interacts with identity stores to retrieve group memberships
◦ Intended use with HttpAuthenticationMechanism implementations
◦ Containers are not tiered to the IdentityStore
◦ Instances of the IdentityStore are handled via the
IdentityStoreHandler
◦ validate() method invokes IdentityStore methods and aggregates
result
◦ Create your own identity store by implementing the IdentityStore
@Inject
private IdentityStoreHandler idStoreHandler;
public interface IdentityStoreHandler {
CredentialValidationResult validate(Credential credential);
}

Default identity store implementation
◦ Default implementation of IdentityStoreHandler should suffice
◦ Authenticate against multiple identity stores
◦ Aggregate result as a CredentialValidationResult

Built-in identity stores
◦ Comes with two built-in IdentityStore implementations for LDAP and
RDBMS

@DataBaseIdentityStoreDefinition
◦ RDBMS identity store configured by @DataBaseIdentityStoreDefinition
◦ Configurations are fairly self-explanatory, with 9 config options
◦ NOTE: priority specifies order in case of multiple identity stores
@DatabaseIdentityStoreDefinition(
dataSourceLookup = "${'java:global/permissions_db'}",
callerQuery = "#{'select password from caller where name = ?'}",
groupsQuery =
"select group_name from caller_groups where caller_name = ?",
hashAlgorithm = PasswordHash.class,
priority = 10
)
@ApplicationScoped
@Named
public class ApplicationConfig { }

@LdapIdentityStoreDefinition
◦ LDAP identity store configured by @LdapIdentityStoreDefinition
◦ Configurations are fairly self-explanatory, 24 config options
◦ NOTE: priority specifies order in case of multiple identity stores
@LdapIdentityStoreDefinition(
url = "ldap://localhost:33389/",
callerBaseDn = "ou=caller,dc=jsr375,dc=net",
groupSearchBase = "ou=group,dc=jsr375,dc=net" ,
priority = 20
)
@WebServlet("/admin")
public class AdminServlet extends HttpServlet { }

IdentityStore interface
◦ Custom identity store implement IdentityStore interface
◦ Four methods
◦ CredentialValidationResult validate(Credential)
◦ Set<String> getCallerGroups(CredentialValidationResult)
◦ Set<ValidationType> validationTypes() returns set of VALIDATE
and/or PROVIDE_GROUPS
◦ int priority()
◦ All methods have default implementations

Multiple identity store interface
◦ Multiple IdentityStore implementations are handled by
the IdentityStoreHandler
◦ Identity stores called in accordance with declared capabilities and priority
◦ Two phase interation: 1st validates user 2nd gather group membership
◦ Caller validated by one IdentityStore and group membership list built from
another
1st iteration 2nd iteration

Security Context
◦ Consistent approach to security across the servlet and EJB containers
◦ Entry point for programmatic security and is injectable
◦ getCallerPrincipal() container-specific principal
◦ getPrincipalsByType() returns all Principals of the specified type
◦ isCallerInRole() determines if the caller is included in the role
◦ hasAccessToWebResource() determines caller access to the given recourse
◦ authenticate() triggers start/continuation of HTTP authentication with
caller. Requires valid servlet context

Security Context
boolean role = securityContext.isCallerInRole("admin");
name = securityContext.getCallerPrincipal().getName();
Set<CustomPrincipal> customPrincipals =
securityContext.getPrincipalsByType(CustomPrincipal.class);
for (CustomPrincipal customPrincipal : customPrincipals) {
response.getWriter().write((customPrincipal.getName()));
}
@Inject
private SecurityContext securityContext;
◦ Inject the SecuirtyContext
◦ Test user’s role membership
◦ Retrieve the caller principle
◦ Retrieve all CustomPrinciple

Security Context
@WebServlet("/hasAccessServlet")
public class HasAccessServlet extends HttpServlet {
@Inject
private SecurityContext securityContext;
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException {
boolean hasAccess =
securityContext.hasAccessToWebResource("/secretServlet", "GET");
if (hasAccess) {
req.getRequestDispatcher("/secretServlet").forward(req, res);
} else {
req.getRequestDispatcher("/logout").forward(req, res);
}
}
}

Security Context
@FacesConfig(version = JSF_2_3)
@Named
@RequestScoped
public class LoginBean {
@Inject private SecurityContext securityContext;
@Inject private FacesContext facesContext;
private String username, password;
public void login() {
Credential credential = new UsernamePasswordCredential(username, new Password(password));
AuthenticationStatus status = securityContext.authenticate(
getRequestFrom(facesContext),
getResponseFrom(facesContext),
withParams().credential(credential));
if (status.equals(SEND_CONTINUE)) {
facesContext.responseComplete();
} else if (status.equals(SEND_FAILURE)) {
addError(facesContext, "Authentication failed");
}
}

JSON Binding API
JSON serialiser and deserialiser
2

JSON Binding 1.0
JSON Binding (JSON-B) 1.0
◦ Strengthens JSON support
◦ Codifies industry practice
◦ Reasonable defaults and customisations
◦ Adapters and de/serializers
◦ Compile-time annotations
◦ Runtime configuration builder

JSON Binding 1.0
Headline Features
◦ Binding support
◦ Two entry interfaces
◦ Jsonb
◦ JsonbBuilder

JSON serialiser and deserialiser
◦ Instance of Jsonb jsonb = JsonbBuilder.create()
◦ toJson() pass it the Java instance
Book book = new Book("SHDUJ-4532", "Fun with Java", "Alex Theedom");
String bookJson = JsonbBuilder.create().toJson(book);
◦ fromJson() pass it the JSON doc and Java class
String json = "{"author":"Alex Theedom"," +
""id":"SHDUJ-4532"," +
""title":"Fun with Java"}";
Book book = JsonbBuilder.create().fromJson(json, Book.class);

JSON Binding customisation
◦ Default mapping for simple scenarios
◦ Annotation model
◦ Runtime configuration
◦ Advanced customisation
◦ Adapters and custom serializers/deserializers
@JsonbNumberFormat("#0.00")
private Float price;
JsonbBuilder.create(new JsonbConfig().withNullValues(true));

JSON Binding customisation
◦ Annotation model
◦ Runtime configuration
@JsonbNillable
@JsonbPropertyOrder(PropertyOrderStrategy.REVERSE)
public class Book {
@JsonbProperty("cost")
@JsonbNumberFormat("#0.00")
private Float price;
}
JsonbConfig jsonbConfig = new JsonbConfig()
.withPropertyNamingStrategy(
PropertyNamingStrategy.LOWER_CASE_WITH_DASHES)
.withNullValues(true)
.withFormatting(true);
Jsonb jsonb = JsonbBuilder.create(jsonbConfig);

Customize object creation
◦ No argument public constructors
public class Magazine {
private String title;
private Author authorName;
@JsonbCreator
public Magazine(@JsonbProperty("bookTitle") String title,
@JsonbProperty("firstName") String firstName,
@JsonbProperty("surname") String lastName) {
this.title = title;
this.authorName = new Author(firstName, lastName);
}
}
{
"firstName": "Alex",
"surname": "Theedom",
"bookTitle": "Fun with JSON-B"
}

JSON Binding adapters
◦ Custom object creation with JsonbAdapter
public class BookletAdapter implements JsonbAdapter<Booklet, JsonObject> {
@Override
public JsonObject adaptToJson(Booklet booklet) {
return Json.createObjectBuilder()
.add("title", booklet.getTitle())
.add("firstName", booklet.getAuthor().getFirstName())
.add("lastName", booklet.getAuthor().getLastName())
.build();
}
@Override
public Booklet adaptFromJson(JsonObject json) {
Booklet booklet = new Booklet(json.getString("title"),
new Author(json.getString("firstName"),
json.getString("lastName")));
return booklet;
}
}
JsonbConfig config = new JsonbConfig()
.withAdapters(new BookletAdapter());

JSON Binding adapters
◦ Mark with @JsonbTypeAdapter
public class Author {
@JsonbTypeAdapter(FirstNameAdapter.class)
private String firstName;
}
public class FirstNameAdapter implements JsonbAdapter<String, JsonValue> {
@Override
public JsonValue adaptToJson(String fullName) {
return Json.createValue(fullName.subSequence(0, 1).toString());
}
@Override
public String adaptFromJson(JsonValue json) {
return json.toString();
}
}

JSON Binding custom serializers and deserializers
◦ Lowest level of customisation
public class BookSerializer implements JsonbSerializer<Book> {
@Override
public void serialize(Book book,
JsonGenerator generator, SerializationContext ctx) {
generator.writeStartObject();
generator.write("id", "QWE-123-RTS");
generator.write("title", book.getTitle());
generator.write("firstName", book.getAuthor().split(" ")[0]);
generator.write("lastName", book.getAuthor().split(" ")[1]);
generator.writeEnd();
}
}

JSON Binding custom serializers and deserializers
public class BookDeserializer implements JsonbDeserializer<String> {
@Override
public String deserialize(JsonParser parser,
DeserializationContext ctx, Type rtType) {
while (parser.hasNext()) {
JsonParser.Event event = parser.next();
if (event == JsonParser.Event.KEY_NAME) {
String keyName = parser.getString();
if (keyName.equals("id")) {
return ctx.deserialize(String.class, parser);
}
}
parser.next();
}
return "";
}
}
JsonbConfig config = new JsonbConfig()
.withDeserializers(new BookDeserializer())
.withSerializers(new BookSerializer());
@JsonbTypeDeserializer(BookDeserializer.class)
public class Booklet{}

Round-up
◦ Security has a consistence approach
◦ Highly customisable with sensible defaults
◦ Developer is empowered
◦ JSON Processing is now up to date
◦ JSON-B’s standardizes the transformation of Java and JSON
◦ Two customisation models with advanced customisation

Questions and Answers4
Presentation template by SlidesCarnival

Java EE 8 security and JSON binding API

Recommended

More Related Content

What's hot (20)

Similar to Java EE 8 security and JSON binding API (20)

More from Alex Theedom (15)

Recently uploaded (20)

Java EE 8 security and JSON binding API

Editor's Notes