Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add example applications for identity propagation with OIDC #194

Merged
merged 1 commit into from
Nov 14, 2023
Merged

Add example applications for identity propagation with OIDC #194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions oidc-with-identity-propagation-same-domain/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
## Identity Propagation with OpenID Connect (OIDC)

When securing an application with OpenID Connect (OIDC), the `elytron-oidc-client` subsystem will automatically create a
virtual security domain for you. If your application invokes an EJB, additional configuration might be required to propagate
the security identity from the virtual security domain depending on how the EJB is being secured.

If your application secured with OIDC invokes an EJB within the same deployment and you'd like to secure the EJB
using the same virtual security domain, no additional configuration is required.

If your application secured with OIDC invokes an EJB in a separate deployment and you'd like to secure the EJB using
the same virtual security domain, additional configuration will be needed as shown in this example.
7 changes: 7 additions & 0 deletions oidc-with-identity-propagation-same-domain/configure-server.cli
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
batch

# Configure a virtual-security-domain that will be referenced by the WhoAmIBean
/subsystem=elytron/virtual-security-domain=same-virtual-domain.ear:add()

# Run the batch commands
run-batch
52 changes: 52 additions & 0 deletions oidc-with-identity-propagation-same-domain/ejb-same-domain/ear/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.wildfly.security.examples</groupId>
<artifactId>ejb-same-domain</artifactId>
<version>2.0.0.Alpha1-SNAPSHOT</version>
</parent>
<artifactId>ejb-same-domain-ear</artifactId>
<packaging>ear</packaging>

<properties>
<version.wildfly.maven.plugin>4.2.0.Final</version.wildfly.maven.plugin>
<version.wildfly.maven.ear.plugin>3.3.0</version.wildfly.maven.ear.plugin>
</properties>

<dependencies>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>ejb-same-domain-ejb</artifactId>
<type>ejb</type>
</dependency>
</dependencies>

<build>
<finalName>${project.parent.artifactId}</finalName>
<plugins>
<!-- EAR plug-in -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-ear-plugin</artifactId>
<version>3.3.0</version>
<configuration>
<!-- Use Jakarta EE ear libraries as needed. Jakarta EE ear libraries
are in easy way to package any libraries needed in the ear, and automatically
have any modules (EJB-JARs and WARs) use them -->
<version>7</version>
<defaultLibBundleDir>lib</defaultLibBundleDir>
<outputFileNameMapping>@{artifactId}@@{dashClassifier?}@.@{extension}@</outputFileNameMapping>
</configuration>
</plugin>
<plugin>
<groupId>org.wildfly.plugins</groupId>
<artifactId>wildfly-maven-plugin</artifactId>
<version>${version.wildfly.maven.plugin}</version>
<configuration>
<skip>false</skip>
</configuration>
</plugin>
</plugins>
</build>
</project>
72 changes: 72 additions & 0 deletions oidc-with-identity-propagation-same-domain/ejb-same-domain/ejb/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
JBoss, Home of Professional Open Source
Copyright 2017, Red Hat, Inc. and/or its affiliates, and individual
contributors by the @authors tag. See the copyright.txt in the
distribution for a full listing of individual contributors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<parent>
<groupId>org.wildfly.security.examples</groupId>
<artifactId>ejb-same-domain</artifactId>
<version>2.0.0.Alpha1-SNAPSHOT</version>
</parent>
<artifactId>ejb-same-domain-ejb</artifactId>

<dependencies>
<dependency>
<groupId>jakarta.enterprise</groupId>
<artifactId>jakarta.enterprise.cdi-api</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>jakarta.annotation</groupId>
<artifactId>jakarta.annotation-api</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>jakarta.ejb</groupId>
<artifactId>jakarta.ejb-api</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.jboss.ejb3</groupId>
<artifactId>jboss-ejb3-ext-api</artifactId>
</dependency>
</dependencies>
<build>
<finalName>${project.artifactId}</finalName>
<resources>
<resource>
<targetPath>META-INF</targetPath>
<directory>src/main/resources/META-INF</directory>
<!-- add the jboss configuration to declare the security domain without using the JBoss specific annotation -->
<includes>
<include>jboss-ejb3.xml</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.wildfly.plugins</groupId>
<artifactId>wildfly-maven-plugin</artifactId>
<configuration>
<skip>true</skip>
</configuration>
</plugin>
</plugins>
</build>
</project>
24 changes: 24 additions & 0 deletions ...ith-identity-propagation-same-domain/ejb-same-domain/ejb/src/main/java/META-INF/beans.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
JBoss, Home of Professional Open Source
Copyright 2015, Red Hat, Inc. and/or its affiliates, and individual
contributors by the @authors tag. See the copyright.txt in the
distribution for a full listing of individual contributors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Marker file indicating CDI should be enabled -->
<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
bean-discovery-mode="all">
</beans>
22 changes: 22 additions & 0 deletions ...me-domain/ejb/src/main/java/org/wildfly/security/examples/ejb_same_domain/ejb/WhoAmI.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
/*
* Copyright 2023 Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package org.wildfly.security.examples.ejb_same_domain.ejb;

public interface WhoAmI {

public String whoAmI();
}
43 changes: 43 additions & 0 deletions ...omain/ejb/src/main/java/org/wildfly/security/examples/ejb_same_domain/ejb/WhoAmIBean.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
/*
* Copyright 2023 Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package org.wildfly.security.examples.ejb_same_domain.ejb;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fjuma Just a detail, missing copyright here and above

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed.


import jakarta.ejb.Remote;
import jakarta.ejb.Stateful;
import jakarta.annotation.security.RolesAllowed;
import jakarta.annotation.security.PermitAll;
import jakarta.annotation.Resource;

import org.jboss.ejb3.annotation.SecurityDomain;
import jakarta.ejb.SessionContext;

@Stateful
@Remote(WhoAmI.class)
@SecurityDomain("same-virtual-domain.ear")
public class WhoAmIBean implements WhoAmI {

@Resource
private SessionContext sessionContext;

@Override
public String whoAmI() {
String callerPrincipal = sessionContext.getCallerPrincipal().getName();
boolean isCallerUser = sessionContext.isCallerInRole("User");
boolean isCallerAdmin = sessionContext.isCallerInRole("Admin");
return "Principal : " + callerPrincipal + "<br/><br/>Caller Has Role 'User'=" + String.valueOf(isCallerUser) + "<br/><br/>Caller Has Role 'Admin'=" + String.valueOf(isCallerAdmin);
}
}
19 changes: 19 additions & 0 deletions ...ty-propagation-same-domain/ejb-same-domain/ejb/src/main/resources/META-INF/jboss-ejb3.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright The WildFly Authors
~ SPDX-License-Identifier: Apache-2.0
-->

<jboss:jboss
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
xmlns:s="urn:security:1.1"
version="3.1" impl-version="2.0">

<assembly-descriptor>
<s:security>
<ejb-name>*</ejb-name>
<s:missing-method-permissions-deny-access>false</s:missing-method-permissions-deny-access>
</s:security>
</assembly-descriptor>
</jboss:jboss>
56 changes: 56 additions & 0 deletions oidc-with-identity-propagation-same-domain/ejb-same-domain/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.wildfly.security.examples</groupId>
<version>2.0.0.Alpha1-SNAPSHOT</version>
<artifactId>ejb-same-domain</artifactId>
<packaging>pom</packaging>

<properties>
<version.wildfly.maven.plugin>4.2.0.Final</version.wildfly.maven.plugin>
<version.wildfly.maven.ear.plugin>3.3.0</version.wildfly.maven.ear.plugin>
<version.server.bom>30.0.0.Final</version.server.bom>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
</properties>

<modules>
<module>ejb</module>
<module>ear</module>
</modules>

<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.wildfly.bom</groupId>
<artifactId>wildfly-ee-with-tools</artifactId>
<version>${version.server.bom}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>ejb-same-domain-ejb</artifactId>
<version>${project.version}</version>
<type>ejb</type>
</dependency>
</dependencies>
</dependencyManagement>

<build>
<plugins>
<!-- The WildFly plug-in deploys your ear to a local WildFly container.
Due to Maven's lack of intelligence with EARs we need to configure
the WildFly Maven plug-in to skip deployment for all modules. We then enable
it specifically in the ear module. -->
<plugin>
<groupId>org.wildfly.plugins</groupId>
<artifactId>wildfly-maven-plugin</artifactId>
<configuration>
<skip>true</skip>
</configuration>
</plugin>
</plugins>
</build>

</project>
58 changes: 58 additions & 0 deletions oidc-with-identity-propagation-same-domain/same-virtual-domain/ear/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.wildfly.security.examples</groupId>
<artifactId>same-virtual-domain</artifactId>
<version>2.0.0.Alpha1-SNAPSHOT</version>
</parent>
<artifactId>same-virtual-domain-ear</artifactId>
<packaging>ear</packaging>

<dependencies>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>same-virtual-domain-ejb</artifactId>
<type>ejb</type>
</dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>same-virtual-domain-web</artifactId>
<type>war</type>
</dependency>
</dependencies>

<build>
<finalName>${project.parent.artifactId}</finalName>
<plugins>
<!-- EAR plug-in -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-ear-plugin</artifactId>
<version>3.3.0</version>
<configuration>
<!-- Use Jakarta EE ear libraries as needed. Jakarta EE ear libraries
are in easy way to package any libraries needed in the ear, and automatically
have any modules (EJB-JARs and WARs) use them -->
<version>7</version>
<defaultLibBundleDir>lib</defaultLibBundleDir>
<modules>
<webModule>
<groupId>${project.groupId}</groupId>
<artifactId>same-virtual-domain-web</artifactId>
<contextRoot>/same-virtual-domain</contextRoot>
</webModule>
</modules>
<outputFileNameMapping>@{artifactId}@@{dashClassifier?}@.@{extension}@</outputFileNameMapping>
</configuration>
</plugin>
<plugin>
<groupId>org.wildfly.plugins</groupId>
<artifactId>wildfly-maven-plugin</artifactId>
<configuration>
<skip>false</skip>
</configuration>
</plugin>
</plugins>
</build>
</project>
Loading