Uploaded image for project: 'Karaf'
  1. Karaf
  2. KARAF-172

Implement a mechanism that would allow a karaf application to distingush between UserPrincipal & RolePrincipal without depending from Karaf JAAS Modules

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.1.0
    • Component/s: None
    • Labels:
      None

      Description

      A karaf application that makes use of JAAS for authentication and authorization will obtain a LoginContext that contains UserPrincipal and RolePrincipal objects (both classes are inside org.apache.karaf.jaas:org.apache.karaf.jaas.modules).

      If such application needs to distinguish between those two(e.g role based authorization), will have to depend from org.apache.karaf.jaas:org.apache.karaf.jaas.modules.

      I think that the application needs to be decoupled from Karaf JAAS Modules and this is why I think that an alternative needs to be provided to the user.

      Such alternative could be the use of a convention (maybe like having a prefix on Roles, or goruping roles under a Group with a fixed name (jboss approach)). This mechanism could be implemented by Karaf Login Modules and even better could be pluggable.

      1. KARAF-172-patch.txt
        12 kB
        Ioannis Canellos

        Activity

        Hide
        iocanel Ioannis Canellos added a comment -

        Adding jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
        Adding jaas/modules/src/main/java/org/apache/karaf/jaas/modules/GroupPrincipal.java
        Adding jaas/modules/src/main/java/org/apache/karaf/jaas/modules/RolePolicy.java
        Sending jaas/modules/src/main/java/org/apache/karaf/jaas/modules/osgi/OsgiConfigLoginModule.java
        Sending jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesLoginModule.java
        Transmitting file data .....
        Committed revision 992286.

        Show
        iocanel Ioannis Canellos added a comment - Adding jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java Adding jaas/modules/src/main/java/org/apache/karaf/jaas/modules/GroupPrincipal.java Adding jaas/modules/src/main/java/org/apache/karaf/jaas/modules/RolePolicy.java Sending jaas/modules/src/main/java/org/apache/karaf/jaas/modules/osgi/OsgiConfigLoginModule.java Sending jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesLoginModule.java Transmitting file data ..... Committed revision 992286.
        Hide
        iocanel Ioannis Canellos added a comment -

        I am uploading a patch that does the following:

        a) Introduces KarafAbstractLoginModule which handles RolePolicies if any (the rest login modules inherit from that).
        b) Introduces a group policy GROUP_ROLES. This policy creates a Group Object with a configurable name and adds all RolesPrincipals into that Group (JBoss-like approach).
        c) Introduces a group policy PREFIXED_ROLES which discriminates RolePricipals by adding a configurable prefix.

        Some policy examples:

        GROUP_ROLES:

        <jaas:config name="example">
        <jaas:module className="org.apache.karaf.jaas.modules.properties.PropertiesLoginModule" flags="required">
        users = $[karaf.base]/etc/users.properties
        rolePolicy = group
        roleDisciriminator = ROLES
        </jaas:module>
        </jaas:config>

        PREFIXED_ROLES:

        <jaas:config name="example">
        <jaas:module className="org.apache.karaf.jaas.modules.properties.PropertiesLoginModule" flags="required">
        users = $[karaf.base]/etc/users.properties
        rolePolicy = prefix
        roleDisciriminator = ROLE_
        </jaas:module>
        </jaas:config>

        Show
        iocanel Ioannis Canellos added a comment - I am uploading a patch that does the following: a) Introduces KarafAbstractLoginModule which handles RolePolicies if any (the rest login modules inherit from that). b) Introduces a group policy GROUP_ROLES. This policy creates a Group Object with a configurable name and adds all RolesPrincipals into that Group (JBoss-like approach). c) Introduces a group policy PREFIXED_ROLES which discriminates RolePricipals by adding a configurable prefix. Some policy examples: GROUP_ROLES: <jaas:config name="example"> <jaas:module className="org.apache.karaf.jaas.modules.properties.PropertiesLoginModule" flags="required"> users = $ [karaf.base] /etc/users.properties rolePolicy = group roleDisciriminator = ROLES </jaas:module> </jaas:config> PREFIXED_ROLES: <jaas:config name="example"> <jaas:module className="org.apache.karaf.jaas.modules.properties.PropertiesLoginModule" flags="required"> users = $ [karaf.base] /etc/users.properties rolePolicy = prefix roleDisciriminator = ROLE_ </jaas:module> </jaas:config>
        Hide
        gnt Guillaume Nodet added a comment -

        +1 for that. That always struck me as odd that one had to depend on a specific implementation classes for that. I actually did not investigate how others had fixed that A pluggable (or configurable) mechanism would be awesome.

        Show
        gnt Guillaume Nodet added a comment - +1 for that. That always struck me as odd that one had to depend on a specific implementation classes for that. I actually did not investigate how others had fixed that A pluggable (or configurable) mechanism would be awesome.

          People

          • Assignee:
            iocanel Ioannis Canellos
            Reporter:
            iocanel Ioannis Canellos
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development