Re: JASPIC AuthConfigProvider packaged with the web application not found
Hi Matthias, Am 23.09.21 um 08:03 schrieb Keil, Matthias (ORISA Software GmbH): Yes, I would like to define my Server Auth module in the jaspic-providers.xml and then provide the class with the web application. As far as of now, i have only two scenarios in my mind: 1) Transparent for developers/applications * Developer defines the security constraints with e.g. basic authentication in their web.xml * Operating places oidc-lib and the jaspci xml-configuration in tomcat. --> Same war-file can be used for development and production --> The developer doesnt know anything about oidc. 2) Transparent for operating. * Developer put the oidc-lib in their application and is responsible to register the AuthProvider class. In both cases, i assume there exist only one oidc provider in the company (maybe federated with other external oidc provider) with one corresponding oidc-lib implementation. Probably you have an other setup/requirement ? -- greets Bernd - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: JASPIC AuthConfigProvider packaged with the web application not found
Hi, Am 19.09.21 um 19:48 schrieb Keil, Matthias (ORISA Software GmbH): Hello everyone and thanks for the hints. They also work as expected and I can package the provider in the web application . Nevertheless, the Configuration Reference (https://tomcat.apache.org/tomcat-9.0-doc/config/jaspic.html) suggests that you define your own provider in jaspic-providers.xml and Tomcat will then find it. I am really only interested in a separate server auth module (SAM). Since I saw no way in the documentation to pack this into the web application. That's why I tried the way through the provider. You want to define the class in the jaspic-providers.xml but package the provider implementation(s) in the application(s) ? As I said, your suggestions work, but there are also a number of additional classes needed to provide the actual SAM. Thank you again If you dont need the whole flexibility of JASPI you can also do something like this: public class MyAuthProvider implements AuthConfigProvider, ServerAuthConfig, ServerAuthModule, ServerAuthContext -- Greets Bernd - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: JASPIC AuthConfigProvider packaged with the web application not found
Bernd,
On 9/17/21 03:52, Bernd Schatz wrote:
Hi Matthias,
Am 17.09.21 um 09:39 schrieb bernd.sch...@daimler.com:
From: "Keil, Matthias (ORISA Software GmbH)"
To: users@tomcat.apache.org
Subject: JASPIC AuthConfigProvider packaged with the web application
not found
I would like to develop an AuthConfigProvider and would like to deploy
it together in a web application.
The Tomcat 9 configuration reference for the AuthConfigProvider
indicates that "The implementation may be packaged with the web
application or in Tomcat's $ CATALINA_BASE / lib directory."
The variant with the $ CATALINA_BASE / lib directory works as
expected. My class of the AuthConfigProvider is found and instantiated.
The variant of packing the implementation together with the web
application does not work. In this case I get a
java.lang.ClassNotFoundException.
[SNIP]
You can register it by using a ServletContextListener (or via CDI):
AuthConfigFactory factory = AuthConfigFactory.getFactory();
factory.registerConfigProvider(new AuthProvider(), "HttpServlet", null,
"TEST");
Don't forget to:
private String configRegistrationId;
public void contextInitialized(...) {
AuthConfigFactory factory = AuthConfigFactory.getFactory();
configRegistrationId = factory.registerConfigProvider(new
AuthProvider(), "HttpServlet", null, "TEST");
}
public void contextDestroyed(...) {
if(null != configRegistrationId) {
AuthConfigFactory.getFactory().removeRegistration(configRegistrationId);
}
}
... or you will introduce a memory leak.
-chris
-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
Re: JASPIC AuthConfigProvider packaged with the web application not found
Hi Matthias, Am 17.09.21 um 09:39 schrieb bernd.sch...@daimler.com: From: "Keil, Matthias (ORISA Software GmbH)" To: users@tomcat.apache.org Subject: JASPIC AuthConfigProvider packaged with the web application not found I would like to develop an AuthConfigProvider and would like to deploy it together in a web application. The Tomcat 9 configuration reference for the AuthConfigProvider indicates that "The implementation may be packaged with the web application or in Tomcat's $ CATALINA_BASE / lib directory." The variant with the $ CATALINA_BASE / lib directory works as expected. My class of the AuthConfigProvider is found and instantiated. The variant of packing the implementation together with the web application does not work. In this case I get a java.lang.ClassNotFoundException. [SNIP] You can register it by using a ServletContextListener (or via CDI): AuthConfigFactory factory = AuthConfigFactory.getFactory(); factory.registerConfigProvider(new AuthProvider(), "HttpServlet", null, "TEST"); -- greets Bernd - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
