Hello, Kumar Jayanti of Sun Microsystems had written a blog entry[1] showing
how on GlassFish, for web service calls, how roles can be dynamically
assigned to the SOAP client (here, based on the validation of a SAML
assertion). I was wondering if I could do the same for Tomcat.
Basically, his web.xml defines a security role called "doctor":
<security-role>
<description>A doctor</description>
<role-name>doctor</role-name>
</security-role>
This of course is the same for GlassFish and Tomcat. Next, though, in the
GlassFish-specific sun-web.xml file, there is a mapping between a
java.security.Principal "DrRobert" and the doctor role:
<security-role-mapping>
<role-name>doctor</role-name>
<principal-name>DrRobert</principal-name>
</security-role-mapping>
Later, in the service-side MySAMLValidator class activated for each web
service call, if the assertion is valid the DrRobert principal is added to
the web service call's list of principals, effectively giving the web
service call the "doctor" role as a consequence of the principle-to-role
mapping above:
if (child.startsWith("CN=DrRobert")) {
Principal p = new
com.sun.enterprise.deployment.PrincipalImpl("DrRobert");
subject.getPrincipals().add(p);
}
This informs the web service provider implementation that the SOAP call is
being made by someone with the doctor role:
@WebService()
public class SAMLService {
@Resource
private WebServiceContext context;
@WebMethod(operationName = "operation")
public String operation(@WebParam(name = "parameter") String parameter)
{
Boolean bool = context.isUserInRole("doctor"); // returns true
if (bool == true) {
... do different logic...
}
return "Hello " + parameter;
}
}
Does Tomcat have an equivalent functionality--an ability to work with
principals and dynamically tie them to roles?
Thanks,
Glen
[1]
http://weblogs.java.net/blog/kumarjayanti/archive/2008/09/support_for_pro.html
--
View this message in context:
http://www.nabble.com/Using-java.security.Principal-with-web-service-calls-on-Tomcat-tp21175498p21175498.html
Sent from the Tomcat - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
