Request authentication from servlet filter in Elytron

[gersonjohan]

Hi,

I'm new in Elytron Security. I've been trying to migrate a wildfly application from 10 to 15. I need to authenticate the requests that comme through a Servlet. What is the best way to do this programmatically?

I do not have web security configured, since the application is (Single Page Application) made with GWT. Currently, each request is authenticated in a filter servlet using Client-Login and Custom Login Module (Database access login module) definded in a legacy security domain.

LoginContext lc = new LoginContext("client-login", new ClientCallbackHandler(login, password));

lc.login();

What is the best alternative to replace this? The authentication cache will continue to working, so as not to access the database in each request?

Thank you

Gerson Samaniego

[mayerw01]

The login could be done via the HttpServletRequest like:

protected void processRequest(HttpServletRequest request, HttpServletResponse response)

    throws ServletException {

              request.login(username, password);

     ...

You should mention the security-domain in your jboss-web.xml like

<jboss-web>

      ...

     <security-domain>mySecurityDomain</security-domain>

     ...

</jboss-web>

[gersonjohan]

Hi Mayer,

I followed your recommendations and it did not work. The login method is invoked without problems, but in a next invokation to de ejb sever (via @EJB injection), I get the exception "EJBAccessException: WFLYEJB0364: Invocation on method ...  is not allowed." It seems that the authentication against the server is not carried out.

On the other hand, how would authentication be done in case of being in a non-web context, such as a task scheduled with @Schedule, which I did in the same way with LoginContext.login?

Thank you

[mayerw01]

WildFly (Elytron) uses the standard EJB security annotations. So you should make sure that your user has a role assigned which is allowed via the @RolesAllowed annotation like:

@Stateless

@RolesAllowed({"admin"})

public class HelloBean {

    ...

On the other hand, how would authentication be done in case of being in a non-web context, such as a task scheduled with @Schedule, which I did in the same way with LoginContext.login?

You could use the @RunAs annotation to "simulate" some login.

But I'd suggest to look also into the JavaEE tutorial and the 'quickstart' (GitHub - wildfly/quickstart: Holds all versioned WildFly quickstarts )

[gersonjohan]

Thank you Mayer,

It worked. I forgot enable this property in EJB:

<default-missing-method-permissions-deny-access value="false"/>