JakartaEE Security Options

JakartaEE Security Options

The old problem still difficult to tackle: LDAP is nice for role based access, but not fine grained enough. Ans all the developers want to do is make use of

RolesAllowed("fineGrainedRole") 

annotations. So the default security providers of an application server need to be extended.

This post contains some links to ways to write your own authentication module in JakartaEE using jaspic:

• https://blog.payara.fish/using-jaspic-to-secure-a-web-application-in-payara-server

And old documentation about: JSR-196 (ASPIC) and JSR-375 (JavaEE Security API)

• https://javaee.github.io/tutorial/security-intro003a.html

A usefull recap of the Jakarta Security 3 update:

• https://arjan-tijms.omnifaces.org/2022/04/whats-new-in-jakarta-security-3.html

And the excellent old blogs of Arjan Thijms for those still using JavaEE 8 / JakartaEE 8 to write your own RoleMapper:

• https://arjan-tijms.omnifaces.org/2015/01/java-ee-authorization-jacc-revisited.html
• https://arjan-tijms.omnifaces.org/2015/03/java-ee-authorization-jacc-revisited.html

Some better documentation is needed about these options and how all the specifications are connected. List of relevant specifications:

• JSR 196 https://jcp.org/en/jsr/detail?id=196 (final release 2007 / JavaEE 6)
  • https://javaee.github.io/security-spec/
• JSR 375 https://jcp.org/en/jsr/detail?id=375 (final release 2017 / JavaEE 8 / JakartaEE 8)
  • Reference implementation: https://github.com/eclipse-ee4j/soteria
• Jakarta security spec: https://jakarta.ee/specifications/security/2.0/jakarta-security-spec-2.0
• Jakarta authentication spec: -> https://jakarta.ee/specifications/authentication/2.0/jakarta-authentication-spec-2.0

Shiro

The options cannot be used in Microprofile applications at this moment. The options in Microprofile are very limited. The only feasible (portable) alternative seems to be using Apache Shiro.

• https://shiro.apache.org/

But the documentation is lacking, the examples are old and no longer working, and CDI integration has been long awaited for:

• https://issues.apache.org/jira/browse/SHIRO-337

Example documentation that seems straight forward, but fails because Stormpath is down.

• https://shiro.apache.org/webapp-tutorial.html

It would be very nice if this example was updated to just use a database example. Finding database examples is also a bit difficult and you have to look around in the source code and online for examples using ‘org.apache.shiro.realm.jdbc.JdbcRealm’.

• https://gist.github.com/dominicfarr/9637357

Baeldung has a better introduction:

• https://www.baeldung.com/apache-shiro