droolsjbpm/uberfire — pull request #1 by mswiderski (2013-04-09 11:00:47+00:00)
Title: JACC support for uberfire security

This pull requests provides support for JACC security that is implemented by most if not all application servers and allows to delegate the authentication to the application server instead of maintaing security on its own. That gives the possibility to make use of all authentication mechanisms that application server support without additional effort on uberfire side (LDAP, DB, etc)

To be able to use it following needs to be configured for the web application (for JBoss AS7):
1. additional parameter for UberFire Security Filter
<init-param>
<param-name>org.uberfire.auth.scheme</param-name>
<param-value>org.uberfire.security.server.auth.JACCAuthenticationScheme</param-value>
</init-param>

2. define security settings for the web application (sample config)
<security-constraint>
<web-resource-collection>
<web-resource-name>console</web-resource-name>
<url-pattern>/org.jbpm.console.ng.jBPMShowcase/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login_failed.jsp</form-error-page>
</form-login-config>
</login-config>

<security-role>
<role-name>admin</role-name>
</security-role>

3. include jboss-web.xml that defines security domain to be used (that is declared in standalone.xml)

4. change AuthenticationSource implementation inside services (org.uberfire.security.auth.AuthenticationSource) file to org.uberfire.security.server.auth.source.JACCAuthenticationSource

5. create (if not already there) login page and login error page that are defined in security section of web.xml