Date post: | 01-Apr-2015 |
Category: |
Documents |
Upload: | moises-attard |
View: | 227 times |
Download: | 1 times |
Session HandlingAuthentication and Security
Joshua Scotton
Sessions Login and Authentication
Overview
SessionsTr a c k i n g t h e U s e r
Cookies◦ Store a unique identifier in a cookie for the
website URL Rewriting
◦ Append a unique identifier to the end of each URL Hidden Form Fields
◦ <INPUT TYPE="HIDDEN" NAME="session" VALUE="...">
Tracking the User
Customization◦ Adaptive Content◦ Adaptable Content
Security◦ Restrict areas of the site based on user◦ User login tracked using session
User Behaviour◦ Track page accesses
User Information◦ Store user settings and information
Benefits
getAttribute(), getAttributeNames(), setAttribute(), removeAttribute()◦ These methods are used to set, get and remove objects from a user session
getId()◦ Every session created by the server has a unique 'id' associated with it in
order to identify this session from other sessions. getCreationTime()
◦ Simple returns a long value indicating the date and time this session was created.
getLastAccessedTime() ◦ Returns a long value indicating the last time user accessed any resource on
this server. getMaxInactiveInterval(), setMaxInactiveInterval()
◦ Return and set the maximum inactive interval in seconds for this session respectively.
isNew()◦ Returns a boolean value indicating if the session is new.
invalidate() ◦ Simply invalidates a session. Can be used for logout
javax.servlet.http.HttpSession
Most Java servers will use cookies if the browser supports them, but automatically revert to URL-rewriting when cookies are unsupported or explicitly disabled.
Sessions in Java
Sessions can be accessed and managed by both Servlets and JSPs.
This can happen in combination as in the following demo.
Counter Example
public class CounterBean implements Serializable {private Integer count;
public CounterBean() {super();this.count = 0;
}
public Integer getCount() { return this.count; }
public void setCount(Integer count) { this.count = count; }
public void incrementCount() { this.count++; }}
CounterBean
<jsp:useBean id="counter" class="webdev.examples.sessions.CounterBean" scope="session"/>
<p>The counter was: <%= counter.getCount() %></p><% counter.incrementCount(); %><p>The counter is now: <%= counter.getCount() %></p>
UpdateCounter.jsp
PrintWriter out = response.getWriter();HttpSession session = request.getSession(true);CounterBean counter;
if(session.isNew()) {counter = new CounterBean();session.setAttribute("counter", counter);
}
counter = ((CounterBean)session.getAttribute("counter"));
counter.incrementCount();out.println("Counter now: " + counter.getCount());out.close();
UpdateCounter Servlet
Login and Authentication
Allowing Persistent Storage
1. A user accesses a protected page2. If the user is authenticated and has
permission to access the page then the resource is made available. Otherwise a login page is shown
3. If the name and password cannot be authenticated then an error is shown
JSP and Servlet Authentication
User/Group Database Access Control List (ACL) Login Page
Security Setup
A Principal is a named entity, commonly representing an individual or corporation.
Principal’s can fill one or more Roles. Resources can be protected by associating
them with Roles. Principals and Roles are similar to Users and
Groups in Linux.
Principals and Roles
<web-app> ... <security-constraint> <web-resource-collection><web-resource-name>Protected Page</web-resource-name>
<url-pattern>/secretPage.jsp
</url-pattern></web-resource-collection> <auth-constraint>
<role-name>employee</role-name></auth-constraint>
</security-constraint><security-role><role-name>employee</role-name>
</security-role><web-app>
/WEB_INF/web.xmlThe ACL of Java
<url-pattern>/members/*</url-pattern> More than one url-pattern in the web-
resource-collection
/WEB_INF/web.xml
Principal getUserPrincipal()◦ Returns a reference to a java.security.Principal
boolean isUserInRole(String)◦ Determines whether a user is in a role, specified
by the string argument String getRemoteUser()
◦ Returns the username that was used for login
HttpServletRequest Security Methods
String getAuthType()◦ Returns the authentication type: BASIC, SSL, or
null boolean isSecure()
◦ Returns true if the connection is HTTPS String getScheme()
◦ Scheme represents transport mechanism: http, https...
ServletRequest Security Methods
Basic authentication Form-based authentication Digest authentication SSL and client certificate authentication
Authentication Types
<web-app> ... <login-config>
<auth-method>BASIC</auth-method> <realm-name>Basic Authentication
Example</realm-name></login-config>
...</web-app>
Authentication Type in /WEB_INF/web.xml
A realm is a database of usernames and passwords
It also contains a list of roles associated with each user
Realms are specific to the server being used
Realms
JDBCRealm - Accesses authentication information stored in a relational database, accessed via a JDBC driver.
DataSourceRealm - Accesses authentication information stored in a relational database, accessed via a named JNDI JDBC DataSource.
JNDIRealm - Accesses authentication information stored in an LDAP based directory server, accessed via a JNDI provider.
UserDatabaseRealm - Accesses authentication information stored in an UserDatabase JNDI resource, which is typically backed by an XML document (conf/tomcat-users.xml).
MemoryRealm - Accesses authentication information stored in an in-memory object collection, which is initialized from an XML document (conf/tomcat-users.xml).
JAASRealm - Accesses authentication information through the Java Authentication & Authorization Service (JAAS) framework.
Tomcat Realms
<Realm className="... class name for this implementation" ... other attributes for this implementation .../>
Serverwide - conf/server.xml Per Webapp – META-INF/context.xml
Configuring a Realm
<?xml version="1.0" encoding="UTF-8"><Context><Realm className="org.apache.catalina.realm.MemoryRealm" />
</Context>
In Memory Realm Context.xml
$TOMCAT_HOME/conf/tomcat-users.xml<tomcat-users> <role rolename="tomcat"/><role rolename="role1"/><user username="tomcat" password="tomcat“
roles="tomcat"/><user username="both" password="tomcat“
roles="tomcat,role1"/><user username="role1" password="tomcat“
roles="role1"/></tomcat-users>
Default Tomcat User List
members.jsp web.xml context.xml
Example – members.jsp
<p>User '<%= request.getRemoteUser() %>' has been logged out.</p>
<% session.invalidate(); %>
Example – logout.jsp
1. The login form associated with the security constraint is sent to the client and the URL path triggering the authentication is stored by the container.
2. The user is asked to fill out the form, including the username and password fields.
3. The client posts the form back to the server. 4. The container attempts to authenticate the user using the
information from the form. 5. If authentication fails, the error page is returned using either a
forward or a redirect, and the status code of the response is set to 200.
6. If authentication succeeds, the authenticated user's principal is checked to see if it is in an authorized role for accessing the resource.
7. If the user is authorized, the client is redirected to the resource using the stored URL path.
Form-based Authentication
Create custom login page with the following form fields:◦ j_username
The name of the username field◦ j_password
The name of the password field◦ j_security_check
The login form's action<form method='post' action='j_security_check'><input type='text' name='j_username'> <input type='password' name='j_password'>
</form>
Form-based Authentication
<login-config> <auth-method>FORM</auth-method> <form-login-config> <form-login-page>
/login.jsp</form-login-page> <form-error-page>
/error.jsp</form-error-page>
</form-login-config> </login-config>
Form-based Auth in web.xml
Form Based Login Example
Use a JDBC Database Realm
Create table of usernames and passwords Create table of usernames and roles Column name for the username must be the
same in both tables
Storing Authentication Details in a Database
connectionName connectionPassword connectionURL driverName roleNameCol userCredCol userNameCol userRoleTable userTable http://tomcat.apache.org/tomcat-3.3-doc/
JDBCRealm-howto.html
org.apache.catalina.realm.JDBCRealm