JarCastingJaxrs Security
Jaxrs Security provides an authorization filter that uses Authorization HTTP header to set JAX-RS API security context. It allows you to use Javax security annotations in your resources.
This library use JWT for securely transmitting information between parties encoded as a JSON object.
You can do a single sign-on (SSO) authentication by choosing the multiple application token type.
Get it
Add the following to your Maven configuration:
<dependency>
<groupId>com.bekioui.jaxrs</groupId>
<artifactId>jaxrs-security</artifactId>
<version>1.1.0</version>
</dependency>
Use it
Import the JaxrsSecurityConfig class in your Spring configuration file:
@Configuration
@Import({ JaxrsSecurityConfig.class })
public class SpringConfig {
}
Configure it
You need to define a secret to encode and decode tokens on the server. In case you have a multiple application context, you need to define the same secret for all your applications.
Single application context
Token has an identifier that represents the user and a list of roles on the application.
{
"identifier":"solid",
"roles":["USER"]
}
Add the following to your Spring configuration file:
@Bean
public ApplicationTokenDescriptor getTokenDescriptor() {
return ApplicationTokenDescriptor.getSingleApplicationTokenDescriptor(secret);
}
Multiple application context
Token has an identifier that represents the user and a map of roles which contains a list of roles for each application defined by its package name.
{
"identifier":"solid",
"roles":{
"com.bekioui.app1":["USER"],
"com.bekioui.app2":["ADMIN"],
}
}
Each application from your microservices architecture has to add the following to its Spring configuration file:
@Bean
public ApplicationTokenDescriptor getTokenDescriptor() {
return ApplicationTokenDescriptor.getMultipleApplicationTokenDescriptor("com.bekioui.app", secret);
}
Don't forget to use the same secret for all your applications.
Resources
Now you can add, for example, RolesAllowed annotation to specify which roles are allowed to access to your resource.
@Path("/users")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public interface UserResource {
@GET
@RolesAllowed("USER")
List<String> findAllLogins();
}
License
Copyright (C) 2016 Mehdi Bekioui ([email protected])
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.