search

SoftInstigate / restheart

Rapid API Development with MongoDB
https://restheart.org
GNU Affero General Public License v3.0
805 stars 171 forks source link

Document Pluggable Security #50

Closed adeady closed 9 years ago

adeady commented 9 years ago

I am looking at the feasibility of using RESTheart in a production environment. I see references to the ability to use a custom security. I imagine this is done by changing the implementation class from org.restheart.security.impl.SimpleFileIdentityManager to a custom implementation. A more in-depth how-to would go a long way in helping developers make RESTheart production ready

mkjsix commented 9 years ago

Hi, Thank you for your comments, at present we're working with the documentation and any suggestion is welcome.

Regarding custom security there is something more: https://softinstigate.atlassian.net/wiki/display/RH/Advanced+Configuration#AdvancedConfiguration-Security

You can indeed create your own security provider by looking at https://github.com/SoftInstigate/restheart/blob/develop/src/main/java/org/restheart/security/impl/SimpleFileIdentityManager.java You have to implement your own class and register it in the configuration file as explained in https://softinstigate.atlassian.net/wiki/display/RH/Security

idm:   
    implementation-class: org.restheart.security.impl.SimpleFileIdentityManager
    conf-file: ./etc/security.yml

Finally I suggest to have a look at https://softinstigate.atlassian.net/wiki/display/RH/Application+Logic It explains that the class of the custom handler must be added to the java classpath.

For example, RESTHeart could be started with the following command:

$ java -server -classpath restheart.jar:custom-handler.jar org.restheart.Bootstrapper restheart.yml

Hope it helps, but please feel free to point out what is still missing and how we could make the docs easier or even improve the product itself.

ujibang commented 9 years ago

I created a task in jira (https://softinstigate.atlassian.net/browse/RH-105), and the documentation page "Custom Access Manager" placeholder (https://softinstigate.atlassian.net/wiki/x/PgC4).

Will write it asap.

ujibang commented 8 years ago

took some time but both Access Manager and Identity Manger are now documented, plus more detailed information on security in general.

in case you still need it, please refer to https://softinstigate.atlassian.net/wiki/x/W4CM