search

invesdwin / invesdwin-context-security

invesdwin-context modules that provide security features
GNU Lesser General Public License v3.0
1 stars 0 forks source link

readme

invesdwin-context-security

This project provides security modules for the invesdwin-context module system.

Maven

Releases and snapshots are deployed to this maven repository:

https://invesdwin.de/repo/invesdwin-oss-remote/

Dependency declaration:

<dependency>
    <groupId>de.invesdwin</groupId>
    <artifactId>invesdwin-context-security-web</artifactId>
    <version>1.0.2</version><!---project.version.invesdwin-context-security-parent-->
</dependency>

Security Modules

The invesdwin-context-security module configures the spring-security annotations for method level authorization. Other security modules reference this module to provide actual authorization rules to be used. Please note that the DefaultRolePrefixRemover changes spring-security configurations so that the ROLE_ prefix can be ommitted (which can be unintuitive when it has or has not to be used). So to make things easier, just put role names as they are (coming from a database, ldap, manual configuration and so on) inside your autorization expressions, without adding any prefixes.

Crypto Module

The invesdwin-context-security-crypto contains implementations for common cryptographic algorithms. We use JCA so you can plug in your custom (maybe native) security provider. We also have an integration for commons-crypto (which does not use JCA).

Don't reuse instance: PseudoRandomGenerator (XoShiro256+) Records: 43,115.07/ms => 401.9 times faster (insecure) ThreadLocalCryptoRandom (NativePRNG) Records: 2247.64/ms => 20 times faster CryptoRandomGeneratorObjectPool Records: 1680.83/ms => 14.7 times faster CryptoRandom (NativePRNG) Records: 191.83/ms => 79.2% faster DRBG (Hash_DRBG,SHA-256,128,reseed_only) Records: 111.24/ms => 3.9% faster (StrongRandomGenerator) jdkDefault (NativePRNG) Records: 107.02/ms => Baseline SHA1PRNG (SecureRandom) Records: 98.95/ms => 7.5% slower (CryptoRandomGenerator) CommonsCryptoRandom (OpenSslCryptoRandom) Records: 93.49/ms => 12.6% slower jdkStrong (Blocking) Records: 91.43/ms => 14.6% slower Conscrypt (OpenSSLRandom) Records: 43.31/ms => 59.5% slower NIST800-90A/AES-CTR-256 (SPI) Records: 39.97/ms => 62.6% slower BC (Default) Records: 30.71/ms => 71.3% slower


### Kerberos Modules

The `invesdwin-context-security-kerberos` module provides some utilities to generate krb5.conf and keytab files while also defining some Kerberos client configuration. The following **LDAP Modules** section goes deeper into the Kerberos integration and also shows an embedded LDAP+Kerberos server module. The client configuration uses the same properties as the server configuration explained there.

### LDAP Modules

These modules provide integration for LDAP clients using [spring-ldap](http://projects.spring.io/spring-ldap/). The following tools are available:

- **ALdapDao**: this is a DAO implementation for LDAP similarly to the ADao available for JPA in [invesdwin-context-persistence-jpa](https://github.com/subes/invesdwin-context-persistence/). Just extend it for each Entry (this is an Entity in LDAP speak) and write your queries in there. `@Transactional` and QueryDSL support is provided out of the box by this module. Configuration is done by the following properties:
```properties
de.invesdwin.context.security.ldap.LdapProperties.LDAP_CONTEXT_URI=ldap://localhost:10389
de.invesdwin.context.security.ldap.LdapProperties.LDAP_CONTEXT_BASE=dc=invesdwin,dc=de
de.invesdwin.context.security.ldap.LdapProperties.LDAP_CONTEXT_USERNAME=uid=admin,ou=system
de.invesdwin.context.security.ldap.LdapProperties.LDAP_CONTEXT_PASSWORD=invesdwin

you can give a path to a keytab resoure here alternatively to setting the passphrase; being empty, a default keytab will be generated with principal/passphrase given

de.invesdwin.context.security.kerberos.KerberosProperties.KERBEROS_KEYTAB_RESOURCE=

instead of generating a new krb5conf according to settings provided here, you can specify a resource to one here; being empty, a default krb5.conf will be generated with the above information

de.invesdwin.context.security.kerberos.KerberosProperties.KERBEROS_KRB5CONF_RESOURCE=

### Web Modules

The `invesdwin-context-security-web-*` modules provide integration of security solutions for web applications:

- **Kerberos**: the `invesdwin-context-security-web-kerberos` module allows your web application to use single sign on via [SPNEGO](https://en.wikipedia.org/wiki/SPNEGO) over Kerberos. It reuses the existing configuration of the `invesdwin-context-security-kerberos` module and just adds the spring context configuration to make use of it in the servlet context. This module was successfully tested against [OpenLDAP](http://www.openldap.org/) and ApacheDS (which is available as an embedded server as explained above).
- **SAML**: the `invesdwin-context-security-web-saml` module provides support for single sign on via [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language). This module was successfully tested against the [SSOCircle](http://www.ssocircle.com) server. The following configuration options are available:
```properties
de.invesdwin.context.security.web.saml.SamlProperties.ENTITY_ID=urn:de:invesdwin:serviceprovider
# you can specify web paths (http: or https: prefix) filesystem paths (no prefix) or classpath paths (classpath: prefix)
de.invesdwin.context.security.web.saml.SamlProperties.IDP_METADATA_RESOURCE=http://idp.ssocircle.com/idp-meta.xml
# you should change this to the external url when using a reverse proxy configuration
de.invesdwin.context.security.web.saml.SamlProperties.ENTITY_BASE_URL=${de.invesdwin.context.integration.IntegrationProperties.WEBSERVER_BIND_URI}
de.invesdwin.context.security.web.saml.SamlProperties.KEYSTORE_RESOURCE=classpath:/META-INF/SamlKeystore.jks
de.invesdwin.context.security.web.saml.SamlProperties.KEYSTORE_ALIAS=invesdwin
de.invesdwin.context.security.web.saml.SamlProperties.KEYSTORE_KEYPASS=invesdwin
de.invesdwin.context.security.web.saml.SamlProperties.KEYSTORE_STOREPASS=${de.invesdwin.context.security.web.saml.SamlProperties.KEYSTORE_KEYPASS}

Further modules for e.g. OpenID or OAuth might come in the future to allow single sign on with Google or Facebook. If you want to use single sign on with Active Directory you can already use Kerberos directly or SAML with the Active Directory Federation Services using the appropriate modules above.

See the code of the invesdwin-context-integration-ws module to see a simpler example of securing your web applications via the spring-security namespace configuration.

For examples of using the single sign on modules with wicket, you can have a look at the invesdwin-context-client-wicket-examples module of invesdwin-context-client. The project also provides wicket integration modules for some of the technologies discussed here.

Support

If you need further assistance or have some ideas for improvements and don't want to create an issue here on github, feel free to start a discussion in our invesdwin-platform mailing list.