Can you explain me how to implement authentication and authorization in Java EE 7 using WildFly server?
Spring Security requires you do provide a database model http://springinpractice.com/2010/07/06/spring-security-database-schemas-for-mysql
In Spring Security I can use taglibs http://docs.spring.io/spring-security/site/docs/3.0.x/reference/taglibs.html
So I don't understand how to do this in Java EE ? I would like to use JSF + EJB 3.2 ... JPA - Hibernate ..
WildFly:
Instead of specifying fixed tables and columns for users and groups, I can actually specify a SQL query that finds in the database what the security domain needs to authenticate and to authorize users.
<security-domain name="app" cache-type="default">
<authentication>
<login-module code="Database" flag="required">
<module-option name="dsJndiName" value="java:jboss/datasources/AppDS"/>
<module-option name="principalsQuery" value="select password from authentication where username=?"/>
<module-option name="rolesQuery" value="select group_name, 'Roles' from user_group ug inner join authentication a on ug.user_id = a.user_account where a.username = ?"/>
<module-option name="hashAlgorithm" value="SHA-256"/>
<module-option name="hashEncoding" value="BASE64"/>
<module-option name="unauthenticatedIdentity" value="guest"/>
</login-module>
<login-module code="RoleMapping" flag="required">
<module-option name="rolesProperties" value="file:${jboss.server.config.dir}/app.properties"/>
<module-option name="replaceRole" value="false"/>
</login-module>
</authentication>
</security-domain>
So now I can't understand. This means that I do not need specify database schema for example entity like a Person which implement suitable interface? How can I use security annotation in my application?
I think Spring Security is the best choice to secure app, and its security policy is transferable, because it does not depend on the application server.
Can you give me example how can I secure my application ?
I am using:
- EJB 3.1
- JSF 2.2
- WildFly 8.2
I want a solution to be flexible.
I have entity Person and Roles ...