Glassfish Basic Authentication

In my previous post, I used Apache Shiro to authenticate users. However, I can use basic authentication from Glassfish server.

web.xml

 <security-constraint>    
   <web-resource-collection>        
   <web-resource-name>Secure Application</web-resource-name>        
   <url-pattern>/*</url-pattern>        
   <http-method>GET</http-method>        
   <http-method>POST</http-method>    
   </web-resource-collection>      
   <auth-constraint>        
      <role-name>Users</role-name>    
   </auth-constraint>   
</security-constraint>    
<login-config>    
  <auth-method>BASIC</auth-method>    
  <realm-name>file</realm-name>  
</login-config>    
<security-role>    
   <role-name>Users</role-name>  
</security-role>

Just like weblogic.xml at work, sun-web.xml needs to be modified with role mapping.

sun-web.xml

<security-role-mapping>    
      <role-name>Users</role-name>    
      <group-name>Users</group-name>  
</security-role-mapping>

Depending on the security realm (admin-realm, certificate, file), I can configure different realm. To be simple, I used file realm. By clicking Manage Users, you can add username/password. This information will be stored in the keyfile (C:\glassfish3\glassfish\domains\domain1\config). Same thing can be done through asadmin console.

Above example will use BASIC authentication. A login popup screen will be prompted to the users prior to access any url (based on the url pattern). The details of form based login is in the JEE 6 Tutorial.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s