Sun Java System Application Server

LDAP Dynamic Group Realm Sample Application

This sample application demonstrates:

How to secure Jave EE components using an lightweight directory access protocol (LDAP) dynamic group realm.
How to secure J2EE application components.

Overview

The LDAP Dynamic Group Realm sample application consists of an enterprise bean and an application client. The methods of the enterprise bean have been associated with either the Administrator or the SecretRole in the enterprise bean deployment descriptor. The idea is to associate the Administrator role with a dynamic LDAP group, called ldapdynamicgroup. Then the application client verifies that user names belonging to ldapdynamicgroup have access to methods of the EJB that have been associated with the Administrator role, while access to methods not associated with that role will be denied.

Directory Layout

The application base directory, app_dir is install_dir/samples/security/ldaprealm/apps/dynamicgroup. It contains the following sub-directories:

dynamicgroup-client/src/conf: application client deployment descriptors.
dynamicgroup-client/src/java/samples/security/ldaprealm/dynamicgroup/client: application client source code
dynamicgroup-ejb/src/java/samples/security/ldaprealm/dynamicgroup/ejb: EJB source code

LDAP Configuration

To associate the Administrator role with the dynamic group ldapdynamicgroup of an LDAP server, follow these basic steps:

Create a username "sjsasuser", with password "password", on an LDAP server. To do this, import the first entry in setup/sjsas8.samples.ldif into an LDAP server.
Create a dynamic group named ldapdynamicgroup in the LDAP server so that its dynamic query includes the username "sjsasuser". To do this, import the second entry in setup/sjsas8.samples.ldif into an LDAP server.
In the src/conf/sun-application.xml deployment descriptor of the application, associate the Administrator role with ldapdynamicgroup, and this application with the ldaprealmperapp Realm.

Finally, associate ldaprealmperapp with an LDAP realm. To do this, add the following entry to Application Server's domain.xml file, located in

domain_root_dir/domain_name.
    See Directories and Variables for
    information on the location of domain_root_dir.
<auth-realm classname="com.sun.enterprise.security.auth.realm.ldap.LDAPRealm" name="ldaprealmperapp">
<property name="directory" value="ldap://localhost:389"/>
<property name="base-dn" value="dc=top,dc=org,dc=company,dc=com"/>
<property name="jaas-context" value="ldapRealm"/> </auth-realm>



Be sure to configure the directory and base-dn properties for
the LDAP server to be used for testing.

Building, Deploying, and Running the Application

The general instructions for building, deploying, and running sample applications are provided in
Building, Deploying, and Running Sample Applications.
In reading this document, use the following application-specific variables for this application:



  install_dir is the directory where Application Server is installed.
  
app_dir is the application base directory:
    install_dir/samples/security/ldaprealm/apps/dynamicgroup.
  
appname is the application name:  ldaprealm-dynamicgroup.
  
The prebuilt EAR file is ldaprealm-dynamicgroup.ear.



Follow this general procedure:

    Build the Application.
      The build file, build.xml, is in the app_dir directory.
    
Perform LDAP Configuration, as described previously.
    
Deploy the Application
      The EAR file is app_dir/ldaprealm-dynamicgroup.ear.
    
Run the Application as described below.


Running the Application

In a shell window make app_dir your working directory.
Execute the command asant run.

This command invokes the application client, which looks up the enterprise bean and invokes some
of its methods. Those methods associated with the Administrator role will be successfully executed.
Access to the ones associated with the SecretRole will be denied.

This is the output that will displayed in the shell window:
[echo] Running the ldaprealm-dynamicgroup program:
[exec] ****************************************************************
[exec] *  LDAP LdapRealmAppClient with DynamicGroup *
[exec] ****************************************************************
[exec] Testing with user: sjsasuser; role:Administrator
[exec] [1] Calling testIsCallerInRole()...
[exec] [1] PASSED
[exec] [2] Calling testIsCallerExpected()...
[exec] [2] PASSED
[exec] [3] Calling authorized method - methodIsAuthorized()
[exec] [3] PASSED
[exec] [4] Calling unauthorized method - methodIsNotAuthorized():
[exec] [4] PASSED: Got expected AccessException!






 Copyright © 2006 Sun Microsystems, Inc.
All rights reserved.