This chapter is from the book
This chapter is from the book
This chapter is from the book
7.3 BASIC Authentication
The most common type of container-managed security is built on form-based authentication, discussed in Section 7.1. There, the server automatically redirects unauthenticated users to an HTML form, checks their username and password, determines which logical roles they are in, and sees whether any of those roles is permitted to access the resource in question. Then, it uses a variation of session tracking to remember the users that have already been authenticated.
This approach has the advantage that the login form can have the same look and feel as the rest of the Web site. However, it has a few disadvantages. For example, if the client's browser does not support cookies, session tracking would have to be performed with URL rewriting. Or, the server might be configured to always use URL rewriting. The servlet specification explicitly states that form-based authentication is not guaranteed to work in such a case.
So, another approach is to use the standard HTTP BASIC security. With BASIC security, the browser uses a dialog box instead of an HTML form to collect the user-name and password. Then, the Authorization request header is used to remember which users have already been authenticated. As with form-based security, you must use SSL if you are concerned with protecting the network traffic. However, doing so neither changes the way BASIC authentication is set up nor necessitates changes in the individual servlets or JSP pages.
There is also DIGEST security and security based on client certificates. However, few browsers or servers support DIGEST, and only fully J2EE-compliant servers are required to support client certificates. For more information on client certificates, see Section 8.5 (Using Programmatic Security with SSL).
Compared to form-based authentication, the two main disadvantages of BASIC authentication are that the input dialog looks glaringly different than the rest of your application and that it is very difficult to log in as a different user once you are authenticated. In fact, once authenticated, you have to quit the browser and restart if you want to log in as a different user! Now, in principle it is possible to write a "relogin" servlet that sends a 401 (Unauthorized) status code and a WWW-Authenticate header containing the appropriate realm. But, that is hardly "declarative" security!
Use of BASIC security involves five steps, as shown below. Each of the steps except for the second is identical to the corresponding step used in form-based authentication.
Set up usernames, passwords, and roles. In this step, you designate a list of users and associate each with a password and one or more abstract roles (e.g., normal user, administrator, etc.). This is a completely server-specific process.
Tell the server that you are using BASIC authentication. Designate the realm name. This process uses the web.xml login-configelement with an auth-methodsubelement of BASICand a realm-namesubelement that specifies the realm (which is generally used as part of the title of the dialog box that the browser opens).
Specify which URLs should be password protected. For this step, you use the security-constraintelement of web.xml. This element, in turn, uses web-resource-collectionand auth-constraintsubelements. The first of these designates the URL patterns to which access should be restricted, and the second specifies the abstract roles that should have access to the resources at the given URLs.
Specify which URLs should be available only with SSL. If your server supports SSL, you can stipulate that certain resources are available only through encrypted https (SSL) connections. You use the user-data-constraintsubelement of security-constraint for this purpose.
Turn off the invoker servlet. If your application restricts access to servlets, the access restrictions are placed only on the custom URL that you associate with the servlet. To prevent users from bypassing the security settings, disable default servlet URLs of the form http://host/webAppPrefix/servlet/ServletName. To disable these URLs, use the servlet-mappingelement with a url-patternsubelement that designates a pattern of /servlet/*.
Details on these steps are given in the following sections.
Setting Up Usernames, Passwords, and Roles
This step is exactly the same when BASIC authentication is used as when form-based authentication is used. See Section 7.1 for details. For a quick summary, recall that this process is completely server specific. Tomcat uses install_dir/conf/tomcat-users.xml to store this information, JRun uses install_dir/lib/users.properties, and ServletExec has an interactive user interface to enable you to specify the information.
Telling the Server You Are Using BASIC Authentication; Designating Realm
You use the login-config element in the deployment descriptor to control the authentication method. To use BASIC authentication, supply a value of BASIC for the auth-method subelement and use the realm-name subelement to designate the realm that will be used by the browser in the popup dialog box and in the Authorization request header. Listing 7.22 gives an example.
Listing 7.22 web.xml (Excerpt designating BASIC authentication)
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app PUBLIC
"-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN"
"http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">
<web-app>
<!-- ... -->
<security-constraint>...</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Some Name</realm-name>
</login-config>
<!-- ... -->
</web-app>
Specifying URLs That Should Be Password Protected
You designate password-protected resources in the same manner with BASIC authentication as you do with form-based authentication. See Section 7.1 for details. For a quick summary, you use the security-constraint element to specify restricted URLs and the roles that should have access to them. The security-constraint element should come immediately before login-config in web.xml and contains four possible subelements: display-name (an optional element giving a name for IDEs to use), web-resource-collection (a required element that specifies the URLs that should be protected), auth-constraint (an optional element that designates the abstract roles that should have access to the URLs), and user-data-constraint (an optional element that specifies whether SSL is required). Multiple web-resource-collection entries are permitted within security-constraint.
Specifying URLs That Should Be Available Only with SSL
You designate SSL-only resources in the same manner with BASIC authentication as you do with form-based authentication. See Section 7.1 for details. To summarize: use the user-data-constraint subelement of security-constraint with a transport-guarantee subelement specifying INTEGRAL or CONFIDENTIAL.
In addition to simply requiring SSL, the servlet API provides a way for stipulating that users must authenticate themselves with client certificates. You supply a value of CLIENT-CERT for the auth-method subelement of login-config (see "Specifying URLs That Should Be Password Protected" in Section 7.1). However, only application servers that have full J2EE support are required to support this capability.