Red Hat Training
A Red Hat training course is available for JBoss Enterprise SOA Platform
Chapter 9. Securing the Service Registry
9.1. jUDDI and the JBoss Enterprise SOA Platform
jUDDI and the JBoss Enterprise SOA Platform
The JBoss Enterprise SOA Platform product includes a pre-configured installation of a jUDDI registry. You can use a specific API to access this registry through your custom client. However, any custom client that you build will not covered by your SOA Platform support agreement. You can access the full set of jUDDI examples, documentation and APIs from: http://juddi.apache.org/.
9.2. Service Registry Authentication
Introduction
Here is a theoretical understanding of how the authentication process works.
Authentication is a two-phase process. These are known as the authenticate phase and the identify phase. Both of these phases are represented by a method in the
Authenticator
interface.
The authenticate phase occurs when the
GetAuthToken
request is made. The goal of this phase is to turn a user id and credentials into a valid publisher id. The publisher id (referred to as the authorized name in UDDI terminology) is the value that assigns ownership within UDDI. Whenever a new entity is created, it must be tagged with ownership by the authorized name of the publisher.
The value of the publisher id is irrelevant to the jUDDI Registry: the only requirement is that one exists to assign to new entities so it must be non-null. Upon completion of the
GetAuthToken
request, an authentication token
is issued to the caller.
When you make subsequent calls to the UDDI API that require authentication, you must provide the token issued in response to the
GetAuthToken
request. This leads to the identify phase.
The identify phase is responsible for turning the authentication token (or the publisher id associated with that token) into a valid
UddiEntityPublisher
object. This object contains all the properties necessary to handle ownership of UDDI entities. Thus, the token (or publisher id) is used to identify the publisher.
The two phases provide compliance with the UDDI authentication structure and grant flexibility if you wish to provide your own authentication mechanism.
Handling of credentials and publisher properties could be done entirely outside of the jUDDI Registry. However, by default, the Registry provides the
Publisher
entity, which is a sub-class of UddiEntityPublisher
. This sub-class makes publisher properties persist within the jUDDI Registry.
9.4. authToken and the Service Registry
In order to enforce proper write access to the Service Registry, each request made to it needs a valid
authToken
.
Important
Note that read access is not restricted at all.
9.5. Obtain an authToken
Procedure 9.1. Task
- Make a
GetAuthToken()
request. - A
GetAuthToken
object is returned. Set a userid and credential (password) on this object:org.uddi.api_v3.GetAuthToken ga = new org.uddi.api_v3.GetAuthToken(); ga.setUserID(pubId); ga.setCred(""); org.uddi.api_v3.AuthToken token = securityService.getAuthToken(ga);
- Locate the
juddi.properties
configuration file inSOA_ROOT/jboss-as/server/PROFILE/deploy/juddi-service.sar/juddi.war/WEB-INF
. Open it in a text editor. - Configure the juddi.authenticator property to how the Service Registry will check the credentials passed to it by the
GetAuthToken
request. (By default it uses thejUDDIAuthenticator
implementation.) - Save the file and exit.
9.6. Security Authentication Implementations Available for the Service Registry
- jUDDI Authentication
Warning
Do not use this authentication method in a production environment. It accepts any credentials provided, and effectively removes the need for clients to authenticate when accessing the registry.The default authentication mechanism provided by the Service Registry is thejUDDIAuthenticator
.jUDDIAuthenticator
's authenticate phase checks to see if the, user ID submitted matches against a record in thePublisher
table. No credentials checks are made. If, during the authentication process, the Publisher record is found to be non-existent, it is added "on-the-fly".In the identify phase, the publisher ID is used to retrieve the Publisher record and return it. The Publisher inherits every property it needs fromUddiEntityPublisher
:juddi.authenticator = org.apache.juddi.auth.JUDDIAuthentication
- XMLDocAuthentication
- The authenticate phase checks that the user id and password match a value in the XML file. The identify phase uses the user ID to populate a new
UddiEntityPublisher
. - CryptedXMLDocAuthentication
- The
CryptedXMLDocAuthentication
implementation is similar to theXMLDocAuthentication
implementation, but the passwords are encrypted:juddi.authenticator = org.apache.juddi.auth.CryptedXMLDocAuthentication juddi.usersfile = juddi-users-encrypted.xml juddi.cryptor = org.apache.juddi.cryptor.DefaultCryptor
Here, the user credential file isjuddi-users-encrypted.xml
, and the content of the file will be similar to this:<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <juddi-users> <user userid="anou_mana" password="+j/kXkZJftwTFTBH6Cf6IQ=="/> <user userid="bozo" password="Na2Ait+2aW0="/> <user userid="sviens" password="+j/kXkZJftwTFTBH6Cf6IQ=="/> </juddi-users>
TheDefaultCryptor
implementation usesBEWithMD5AndDES
andBase64
to encrypt the passwords.Note
You can use the code in theAuthenticatorTest
to learn more about how to use this Authenticator implementation. You can plug in your own encryption algorithm by implementing theorg.apache.juddi.cryptor.Cryptor
interface and referencing your implementation class in the juddi.cryptor property.The authenticate phase checks that the user ID and password match values in the XML file. The identify phase uses the user ID to populate a newUddiEntityPublisher
. - LDAP Authentication
- Use
LdapSimpleAuthenticator
to authenticate users via LDAP's simple authentication functionality. This class allows you to authenticate a user based on an LDAP principle, provided that the principle and the jUDDI publisher ID are identical. - JBoss Authentication
- A final alternative is to interface with third-party credential stores. You can link it to the JBoss Application Server's authentication component.You will find the
JBossAuthenticator
class provided in thedocs/examples/auth
directory. This class enables jUDDI deployments on JBoss to use a server security domain to authenticate users.
9.7. Configure XMLDocAuthentication
Procedure 9.2. Task
- Create a text file called
juddi-users.xml
and save it injbossesb-registry.sar
.<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <juddi-users> <user userid="sscholl" password="password" /> <user userid="dsheppard" password="password" /> <user userid="vbrittain" password="password" /> </juddi-users>
- Save the file and exit.
- Add the file to the class-path.
- Open the
juddi.properties
file in your text editor (located inSOA_ROOT/jboss-as/server/PROFILE/deploy/juddi-service.sar/juddi.war/WEB-INF
). - Modify the file so that it looks like this:
juddi.authenticator = org.apache.juddi.auth.XMLDocAuthentication juddi.usersfile = juddi-users.xml
- Save the file and exit.
9.8. Lightweight Directory Access Protocol (LDAP)
Lightweight Directory Access Protocol (LDAP) is a protocol for accessing distributed directory information over the internet.
9.9. Configure LDAP Authentication
Procedure 9.3. Task
- Locate the
juddi.properties
file inSOA_ROOT/jboss-as/server/PROFILE/deploy/juddi-service.sar/juddi.war/WEB-INF
. Open it in your text editor. - Add the following configuration settings:
juddi.authenticator=org.apache.juddi.auth.LdapSimpleAuthenticator juddi.authenticator.url=ldap://localhost:389
The juddi.authenticator.url property tells theLdapSimpleAuthenticator
class where the LDAP server resides. - Save the file and exit.
9.10. Configure JBoss Authentication
Procedure 9.4. Task
- Locate the
juddi.properties
file inSOA_ROOT/jboss-as/server/PROFILE/deploy/juddi-service.sar/juddi.war/WEB-INF
. Open it in your text editor. - Add the following lines to the file:
uddi.auth=org.apache.juddi.auth.JBossAuthenticator juddi.securityDomain=java:/jaas/other
The juddi.authenticator property connects theJbossAuthenticator
class to the jUDDI Registry's Authenticator framework. Thejuddi.security.domain
tellsJBossAuthenticator
where it can find the Application Server's security domain. It uses this domain to perform the authentications.Note that JBoss creates one security domain for each application policy element in theSOA_ROOT/jboss-as/server/PROFILE/conf/login-config.xml
file. These domains are bound to the server JNDI tree with this name:java:/jaas/<application-policy-name>
. (If a look-up refers to a non-existent application policy, a policy namedother
will be used by default.) - Save the file and exit.