Chapter 7. Security Security in JBoss EAP is a vast topic. Both JBoss EAP and Camel have well documented, standardised methods of securing configuration, endpoints and payloads. 7.1. HawtIO Security To secure the HawtIO console, do the following: Add system properties to standalone.xml <system-properties> <property name="hawtio.authenticationEnabled" value="true" /> <property name="hawtio.realm" value="hawtio-domain" /> </system-properties> Add a security realm for HawtIO within the security subsystem <security-domain name="hawtio-domain" cache-type="default"> <authentication> <login-module code="RealmDirect" flag="required"> <module-option name="realm" value="ManagementRealm"/> </login-module> </authentication> </security-domain> Configure a management user Browse to http://localhost:8080/hawtio , and authenticate with the credentials configured for the management user. Note If you are running Fuse on EAP, and you are using Keycloak, then Elytron security is not supported. Tip If you are running Fuse on EAP on JDK 17, protected by Keycloak and have problems with logging into the HawtIO console, downgrade to JDK 8 or 11 and disable Elytron on EAP. 7.2. JAX-RS Security The following topics explain how to secure JAX-RS endpoints. WildFly HTTP basic authentication Security Realms & SSL Securing EJBs 7.3. JAX-WS Security The following topics explain how to secure JAX-WS endpoints. WildFly HTTP basic authentication WS-Security CXF Security Security Realms & SSL Securing EJBs 7.4. JMS Security The following topics explain how to secure JMS endpoints. ActiveMQ Artemis security documentation Security settings for ActiveMQ Artemis addresses and JMS destinations ActiveMQ Artemis security domain configuration ActiveMQ Security Additionally, you can use Camel's notion of Route Policies to integrate with the JBoss EAP security system. 7.5. Route Policy Camel supports the notion of RoutePolicies , which can be used to integrate with the JBoss EAP security system. There are currently two supported scenarios for security integration. 7.5.1. Camel calls into Jarkarta EE When a camel route calls into a secured Jarkarta EE component, it acts as a client and must provide appropriate credentials associated with the call. You can decorate the route with a ClientAuthorizationPolicy as follows: CamelContext camelctx = new DefaultCamelContext(); camelctx.addRoutes(new RouteBuilder() { @Override public void configure() throws Exception { from("direct:start") .policy(new ClientAuthorizationPolicy()) .to("ejb:java:module/AnnotatedSLSB?method=doSelected"); } }); This does not do any authentication and authorization, as a part of the camel message processing. Instead, it associates the credentials that come with the Camel Exchange with the call into the EJB3 layer. The client that calls the message consumer must provide appropriate credentials in the AUTHENTICATION header like this: ProducerTemplate producer = camelctx.createProducerTemplate(); Subject subject = new Subject(); subject.getPrincipals().add(new DomainPrincipal(domain)); subject.getPrincipals().add(new EncodedUsernamePasswordPrincipal(username, password)); producer.requestBodyAndHeader("direct:start", "Kermit", Exchange.AUTHENTICATION, subject, String.class); Authentication and authorization will happen in the Jarkarta EE layer. 7.5.2. Securing a Camel Route In order to secure a Camel Route, you can associate a DomainAuthorizationPolicy with the route. This policy requires a successful authentication against the given security domain and authorization for "Role2". CamelContext camelctx = new DefaultCamelContext(); camelctx.addRoutes(new RouteBuilder() { @Override public void configure() throws Exception { from("direct:start") .policy(new DomainAuthorizationPolicy().roles("Role2")) .transform(body().prepend("Hello ")); } }); camelctx.start(); Again, the client that calls the message consumer must provide appropriate credentials in the AUTHENTICATION header like this: ProducerTemplate producer = camelctx.createProducerTemplate(); Subject subject = new Subject(); subject.getPrincipals().add(new DomainPrincipal(domain)); subject.getPrincipals().add(new EncodedUsernamePasswordPrincipal(username, password)); producer.requestBodyAndHeader("direct:start", "Kermit", Exchange.AUTHENTICATION, subject, String.class); 7.6. Deploying CXF JAX-WS quickstart This example demonstrates using the camel-cxf component with Red Hat Fuse on EAP to produce and consume JAX-WS web services secured by an Elytron Security Domain. Elytron is a new security framework available since EAP 7.1. In this quickstart, a Camel route takes a message payload from a direct endpoint and passes it on to a CXF producer endpoint. The producer uses the payload to pass arguments to a CXF JAX-WS web service that is secured by BASIC HTTP authentication. Prerequisites Ensure that Maven installed and configured. Ensure that an application server with Red Hat Fuse is installed and configured. Procedure Set the JBOSS_HOME environment variable to point at the root directory of your application server installation. For Linux For Windows: Use the add-user script to create a new server application user and group. For Linux For Windows: Start the application server in the standalone mode. For Linux For Windows: The jboss-web-xml and web.xml files in the webapp/WEB-INF directory of this project set the application security domain, security roles and constraints. Build and deploy the project. This command also invokes the CLI script configure-basic-security.cli that creates the security domain and a few other management objects. Browse to http://localhost:8080/example-camel-cxf-jaxws-secure/ . A page titled Send A Greeting is displayed. This UI enables you to interact with the test greeting web service which has already started. The service WSDL is available at http://localhost:8080/webservices/greeting-security-basic?wsdl . There is a single service operation named greet which takes two String parameters named message and name . Invoking the web service will return a response where these values have been linked together. Testing the Camel Secure CXF JAX-WS quickstart Browse to http://localhost:8080/example-camel-cxf-jaxws-secure/ . On the Send A Greeting web form, enter a message and name into the text fields and then press the send button. The information that you have entered is displayed as a greeting on the UI. The CamelCxfWsServlet handles the POST request from the web UI. It retrieves the message and name from the parameter values and constructs an object array. This object array is the message payload that is sent to the direct:start endpoint. A ProducerTemplate sends the message payload to Camel. The direct:start endpoint passes the object array to a cxf:bean web service producer. The web service response is used by CamelCxfWsServlet to display the greeting on the web UI. You can see the full Camel route in src/main/webapp/WEB-INF/cxfws-security-camel-context.xml file. Undeploying the quickstart Run the following command to undeploy the quickstart.

Commands:
<system-properties> <property name="hawtio.authenticationEnabled" value="true" /> <property name="hawtio.realm" value="hawtio-domain" /> </system-properties>
<security-domain name="hawtio-domain" cache-type="default"> <authentication> <login-module code="RealmDirect" flag="required"> <module-option name="realm" value="ManagementRealm"/> </login-module> </authentication> </security-domain>
USDJBOSS_HOME/bin/add-user.sh -u someuser -p s3cret
CamelContext camelctx = new DefaultCamelContext(); camelctx.addRoutes(new RouteBuilder() { @Override public void configure() throws Exception { from("direct:start") .policy(new ClientAuthorizationPolicy()) .to("ejb:java:module/AnnotatedSLSB?method=doSelected"); } });
ProducerTemplate producer = camelctx.createProducerTemplate(); Subject subject = new Subject(); subject.getPrincipals().add(new DomainPrincipal(domain)); subject.getPrincipals().add(new EncodedUsernamePasswordPrincipal(username, password)); producer.requestBodyAndHeader("direct:start", "Kermit", Exchange.AUTHENTICATION, subject, String.class);
CamelContext camelctx = new DefaultCamelContext(); camelctx.addRoutes(new RouteBuilder() { @Override public void configure() throws Exception { from("direct:start") .policy(new DomainAuthorizationPolicy().roles("Role2")) .transform(body().prepend("Hello ")); } }); camelctx.start();
ProducerTemplate producer = camelctx.createProducerTemplate(); Subject subject = new Subject(); subject.getPrincipals().add(new DomainPrincipal(domain)); subject.getPrincipals().add(new EncodedUsernamePasswordPrincipal(username, password)); producer.requestBodyAndHeader("direct:start", "Kermit", Exchange.AUTHENTICATION, subject, String.class);
export JBOSS_HOME=
set JBOSS_HOME=
USD{JBOSS_HOME}/bin/add-user.sh -a -u testUser -p testPassword1+ -g testRole
%JBOSS_HOME%\bin\add-user.bat -a -u testUser -p testPassword1+ -g testRole
USD{JBOSS_HOME}/bin/standalone.sh -c standalone-full.xml
%JBOSS_HOME%\bin\standalone.bat -c standalone-full.xml
mvn install -Pdeploy
mvn clean -Pdeploy