JBoss.org Community Documentation
Similar to the rest of the JBoss architecture, security at the lowest level is defined as a set of interfaces for which alternate implementations may be provided. Three basic interfaces define the JBoss server security layer: org.jboss.security.AuthenticationManager
, org.jboss.security.RealmMapping
, and org.jboss.security.SecurityProxy
. Figure 8.8, “The key security model interfaces and their relationship to the JBoss server EJB container elements.” shows a class diagram of the security interfaces and their relationship to the EJB container architecture.
Figure 8.8. The key security model interfaces and their relationship to the JBoss server EJB container elements.
The light blue classes represent the security interfaces while the yellow classes represent the EJB container layer. The two interfaces required for the implementation of the J2EE security model are org.jboss.security.AuthenticationManager
and org.jboss.security.RealmMapping
. The roles of the security interfaces presented in Figure 8.8, “The key security model interfaces and their relationship to the JBoss server EJB container elements.” are summarized in the following list.
AuthenticationManager
: This interface is responsible for validating credentials associated with principals. Principals are identities, such as usernames, employee numbers, and social security numbers. Credentials are proof of the identity, such as passwords, session keys, and digital signatures. The isValid
method is invoked to determine whether a user identity and associated credentials as known in the operational environment are valid proof of the user's identity.
RealmMapping
: This interface is responsible for principal mapping and role mapping. The getPrincipal
method takes a user identity as known in the operational environment and returns the application domain identity. The doesUserHaveRole
method validates that the user identity in the operation environment has been assigned the indicated role from the application domain.
SecurityProxy
: This interface describes the requirements for a custom SecurityProxyInterceptor
plugin. A SecurityProxy
allows for the externalization of custom security checks on a per-method basis for both the EJB home and remote interface methods.
SubjectSecurityManager
: This is a subinterface of AuthenticationManager
that adds accessor methods for obtaining the security domain name of the security manager and the current thread's authenticated Subject
.
SecurityDomain
: This is an extension of the AuthenticationManager
, RealmMapping
, and SubjectSecurityManager
interfaces. It is a move to a comprehensive security interface based on the JAAS Subject, a java.security.KeyStore
, and the JSSE com.sun.net.ssl.KeyManagerFactory
and com.sun.net.ssl.TrustManagerFactory
interfaces. This interface is a work in progress that will be the basis of a multi-domain security architecture that will better support ASP style deployments of applications and resources.
Note that the AuthenticationManager
, RealmMapping
and SecurityProxy
interfaces have no association to JAAS related classes. Although the JBossSX framework is heavily dependent on JAAS, the basic security interfaces required for implementation of the J2EE security model are not. The JBossSX framework is simply an implementation of the basic security plug-in interfaces that are based on JAAS. The component diagram presented in Figure 8.9, “The relationship between the JBossSX framework implementation classes and the JBoss server EJB container layer.” illustrates this fact. The implication of this plug-in architecture is that you are free to replace the JAAS-based JBossSX implementation classes with your own custom security manager implementation that does not make use of JAAS, if you so desire. You'll see how to do this when you look at the JBossSX MBeans available for the configuration of JBossSX in Figure 8.9, “The relationship between the JBossSX framework implementation classes and the JBoss server EJB container layer.”.
Figure 8.9. The relationship between the JBossSX framework implementation classes and the JBoss server EJB container layer.