To provide a lightweight guide for other CBIIT applications (eg, caArray) can secure their own grid services.
|
nci-commons-core
version 1.2.4 or greater see http://maven.5amsolutions.com/archiva/browse/com.fiveamsolutions/nci-commons-corejbosssx.jar
as runtime dependency to handle decryption of encrypted pre-shared key within CommonsGridLoginModule
class. Typically included with JBoss by default, please verify.
<login-module code="com.fiveamsolutions.nci.commons.authentication.CommonsGridLoginModule" flag="optional"> <module-option name="gridServicePrincipal">${gridServicePrincipal}</module-option> <module-option name="gridServiceCredential">${gridServiceCredential}</module-option> <module-option name="gridServicePrincipalSeparator">||</module-option> </login-module> |
<gridServicePrincipal>Gr1DU5er</gridServicePrincipal> <gridServiceCredential>ltHZmZ1rqYq8j2uyHEABIQ==</gridServiceCredential> |
'po'
to your application's name
INSERT INTO CSM_GROUP (GROUP_NAME, GROUP_DESC, APPLICATION_ID) VALUES ('gridClient', 'Grid Service Invocation Group', (select application_id from csm_application where application_name = 'po')); |
@RolesAllowed("gridClient") public void myRemoteEndpointMethod() { ... } |
Key |
Default Value |
Description |
---|---|---|
gridServicePrincipalSeparator |
|| |
The separator used to encord the gridServicePrincipal and grid user's identity when Using the com.fiveamsolutions.nci.commons.authentication.CommonsGridLoginModule |
GridSecurityJNDIServiceLocator
class to authenticate using both the Grid User's Identity (eg, /O=caBIG/OU=caGrid/OU=Training/OU=Dorian/CN=coppagridtest
instead of a typical remote service user. In short, you'll base your implementation off of your existing Locator (eg, JNDIServiceLocator
) and replace existing occurrences with the new GridSecurityJNDIServiceLocator
See http://gforge.nci.nih.gov/svnroot/coppa/trunk/code/po-grid/src/gov/nih/nci/coppa/po/grid/remote/GridSecurityJNDIServiceLocator.java for full code |
GridSecurityJNDIServiceLocator
class.
|
|
... private InitialContext context; private static final String JNDI_PRINCIPAL = "java.naming.security.principal"; private static final String JNDI_CREDENTIALS = "java.naming.security.credentials"; /** * @return a ServiceLocator with the caller's identity * @throws Exception if a problem occurs */ public static ServiceLocator newInstance() throws Exception { return new GridSecurityJNDIServiceLocator(SecurityUtils.getCallerIdentity()); } /** * Get an instance of the service locator. specific to the grid user. * * @param userIdentity user identity of the grid user */ public GridSecurityJNDIServiceLocator(String userIdentity) { try { Properties props = new Properties(); props.load(GridSecurityJNDIServiceLocator.class.getClassLoader().getResourceAsStream("jndi.properties")); // set grid service principal and grid identity as java.naming.security.principal CoreServicesConfiguration coreConfiguration = CoreServicesConfiguration.getConfiguration(); String principal = props.getProperty(JNDI_PRINCIPAL) + coreConfiguration.getGridServicePrincipalSeparator() + userIdentity; props.setProperty(JNDI_PRINCIPAL, principal); LOG.debug("Properties " + props.toString()); context = new InitialContext(props); } catch (Exception e) { LOG.error("Unable to load jndi properties.", e); throw new RuntimeException("Unable to load jndi properties.", e); } } private Object lookup(String name) throws NamingException { Object object = null; int i = 0; while (object == null && i < MAX_RETRIES) { try { LOG.debug("Performing JNDI Lookup of : " + name); object = context.lookup(name); } catch (CommunicationException com) { LOG.warn("Unable to lookup: " + name); } i++; } return object; } /** * {@inheritDoc} */ public PersonEntityServiceRemote getPersonService() throws NamingException { PersonEntityServiceRemote object = (PersonEntityServiceRemote) lookup("po/PersonEntityServiceBean/remote"); return object; } ... |
This section will likely vary based on many factors and more notably your specific version of BDA and existing deployment configuration steps.