Red Hat JBoss Enterprise Application Platform Administration I

Instructions

1. Start the standalone instance of JBoss EAP by running the following command, which uses /home/student/AD248/labs/security-dbrealm/standalone as the base directory:

   [student@workstation ~]$ cd /opt/jboss-eap-7.4/bin
   [student@workstation bin]$ ./standalone.sh \
   -Djboss.server.base.dir=/home/student/AD248/labs/security-dbrealm/standalone/

2. Connect to the security data source.

   In this step, you configure the non-XA data source that connects to the database storing the credentials used by the example application. The data source is used later by the security subsystem to fetch the username and the password.

   The database is a MariaDB database running on localhost and it is named bksecurity. The credentials to access the database are bkadmin/redhat123. Use java:/jboss/datasource/bksecurity-ds as the JNDI name.

   1. On the workstation machine, open the management console by pointing a web browser to localhost:9990.

      Use admin as the username, and redhat123 as the password. Go to the Configuration page.

   2. Navigate to the data sources subsystem by clicking Subsystems and then Data Sources & Drivers.

   3. In the third column click Datasources.

      Then, in the fourth column, click the arrow next to the plus icon, and click Add Datasource.

   4. On the first step of the Add Datasource wizard, select MariaDB and click Next.

   5. Use the following parameters to complete the form:

      Field	Value
      Name	bksecurity-ds
      JNDI Name	java:/jboss/datasources/bksecurity-ds

      Click Next.

   6. On the third step of the Add Datasource wizard, the mariadb driver is already selected. Click Next.

   7. Use the following information for the database connection:

      Field	Value
      Connection URL	jdbc:mariadb://localhost:3306/bksecurity
      User Name	bkadmin
      Password	redhat123
      Security Domain	Leave empty

      Click Next.

   8. On step 5 of the 'Add Datasource' wizard, click Test Connection. Then click Next to review all the data, and close the wizard by clicking Finish, and Close.

3. Configure the security domain.

   Create a security domain that uses the bksecurity-ds data source. The security domain must have a default cache type.

   1. Go back to the Subsystem column.

   2. In the second column, click Security Legacy. Then, click the plus icon button in the Security Domain column.

   3. Enter bksecurity as the security domain name, and set the Cache Type to default. Click Add.

   4. Start the management CLI in a new terminal and connect to the standalone server.

      [student@workstation ~]$ cd /opt/jboss-eap-7.4/bin
      [student@workstation bin]$ ./jboss-cli.sh --connect

   5. Use the following command to create an authentication login module.

      [standalone@localhost:9990] /subsystem=security/security-domain\
      =bksecurity/authentication\
      =classic:add

      Note

      The output indicates that a server reload is required. You can safely ignore that message, because you reload the server in the next steps.

   6. Create a login module that connects to the data source. It should query the table's users and roles to identify the credentials. The password is encrypted with a SHA-256 algorithm and the hash uses a base64 encoding.

      Use the following values when creating the login module:

      Field	Value
      Name	database
      Code	Database
      Flag	required
      dsJndiName	java:jboss/datasources/bksecurity-ds
      principalsQuery	select password from users where username=?
      rolesQuery	select role, "Roles" from roles where username=?
      hashAlgorithm	SHA-256
      hashEncoding	base64

      Use the following management CLI command to create the login module:

      [standalone@localhost:9990] /subsystem=security/security-domain=bksecurity/\
      authentication=classic/login-module=database:add( \
        code=Database, \
        flag=required, \
        module-options=[ \
          ("dsJndiName"=>"java:jboss/datasources/bksecurity-ds"), \
          ("principalsQuery"=>"select password from users where username=?"), \
          ("rolesQuery"=>"select role, 'Roles' from roles where username=?"), \
          ("hashAlgorithm"=>"SHA-256"), \
          ("hashEncoding"=>"base64") \
        ])

   7. Reload the server to allow the changes to take place:

      [standalone@localhost:9990] :reload

   8. Verify that your settings are correct by running the following CLI command:

      [standalone@localhost:9990] /subsystem=security/security-domain=bksecurity\
      /authentication=classic/login-module=database:read-resource

      The response is similar to the following output:

      {
          "outcome" => "success",
          "result" => {
            "code" => "Database",
            "flag" => "required",
            "module" => undefined,
            "module-options" => {
               ("rolesQuery" => "select role, "Roles" from roles where username=?"),
               ("principalsQuery" => "select password from users where username=?"),
               ("dsJndiName" => "java:jboss/datasources/bksecurity-ds"),
               ("hashAlgorithm" => "SHA-256"),
               ("hashEncoding" => "base64"),
               }
          }
      }

      Note

      If there is any mistake in the module-options, you can update each module option by using the map-put command in the management CLI. For example, if there is an error with the dsJndiName value, then the following command can update the module option:

      [standalone@localhost:9990] /subsystem=security/security-domain\
      =bksecurity/authentication=classic/login-module=database\
      :map-put(name=module-options,key="dsJndiName",\
      value="java:/jboss/datasources/bksecurity-ds")

4. Configure the application security.

   To secure an application deployed on JBoss EAP, the first step is to modify the application so that it requires credentials to access it.

   1. By using a text editor, open the /home/student/AD248/labs/security-dbrealm/example/src/main/webapp/WEB-INF/web.xml file.

   2. After the <welcome-file-list> section, add the following XML snippet, which defines a security constraint on all URLs to the application and requires a user to be authenticated.

   <security-constraint>
       <web-resource-collection>
            <web-resource-name>All resources</web-resource-name>
            <url-pattern>/*</url-pattern>
       </web-resource-collection>
       <auth-constraint>
            <role-name>*</role-name>
       </auth-constraint>
   </security-constraint>
   <security-role>
       <role-name>*</role-name>
   </security-role>
   <login-config>
       <auth-method>BASIC</auth-method>
       <realm-name>bksecurity</realm-name>
   </login-config>

   Save your changes to the web.xml file.

5. Configure the security domain in the application.

   1. Using a text editor, open the jboss-web.xml file in the /home/student/AD248/labs/security-dbrealm/example/src/main/webapp/WEB-INF directory.

   2. Within the <jboss-web> tag, enter the following <security-domain> tag:

      <security-domain>bksecurity</security-domain>

      bksecurity references the security domain that was created previously.

   3. Save your changes to the jboss-web.xml file.

6. Package the application.

   Open a new terminal and enter the following command to create a WAR file of the example application:

   [student@workstation ~]$ cd /home/student/AD248/labs/security-dbrealm/\
   example/src/main/webapp
   [student@workstation webapp]$ jar -cvf example.war .

7. Deploy the application.

   Using the management console or management CLI, deploy the example.war file located at /home/student/AD248/labs/security-dbrealm/example/src/main/webapp/ on the standalone server.

   [standalone@localhost:9990 /] ​deploy \
   /home/student/AD248/labs/security-dbrealm/example/src/main/webapp/example.war

   Inspect the server log in the terminal console, and verify that there are no errors on the deployment.

8. Verify the security settings.

   1. Navigate to http://127.0.0.1:8080/example/. You should be prompted to log in.

   2. Enter admin as the username and admin as the password. You should see the "Welcome to JBoss EAP 7" page after you are logged in successfully.

      Note

      If the authentication fails with those credentials, verify that the security domain was set up correctly with the correct values for each module option.

   3. Undeploy the example application from the standalone server by using the management CLI:

      [standalone@localhost:9990] undeploy example.war

   4. Exit the management CLI and stop the running instance of JBoss EAP.