| | |
|
|
|
Extending security
Project Zero security leverages the flexible event-based system to make it easy to add your own security implementations. With this enhanced flexibility, you can implement your own request processing event handler for secure and authorize events.
For more information on the secure and authorize events, see the Application life cycle events section of the Event processing article. The following sections of this article provide more information about how you can extend security:
Secure event processing
The following table summarizes the sub-events, in order, run by Project Zero during security processing of the secure event:
Extending authentication
To implement authentication, use the following steps:
- Choose a name for your authentication scheme to be specified in the security rules as
authType.
- Implement a handler for the event name <authType>Secure.
- Register the event name in the configuration file of your library or application as a handler for that event.
For example, if your authType is digest, you would implement a handler with the method onDigestSecure and add the following stanza to the configuration file:
/config/handlers += [{
"events" : "digestSecure",
"handler" : "com.myimpl.DigestSecurityHandler.class"
}]
This event is run by the global security handler after performing the requireSSL check. It allows you to use your handler with the standard security rules.
Extending authorization
To implement a custom authorization handler, create a handler with a method name of onAuthorize then define the appropriate application handler stanza. Note that whereas the <authType>Secure event can only be associated with one handler, the authorization handler allows multiple handlers to be registered in addition to the default authorization handler that is provided as part of Project Zero security. Depending on the rules that are matched for the request, one or more handlers could be run for the authorize event. Once a handler sets the value isAuthorized to true in the event zone, processing of additional handlers is terminated.
Defining a custom authorization handler
In the following example, the custom authorization handler checks to ensure that the custom event handler data myCustomSetOfRules matches ADMIN and is authorized to view this resource:
/config/handlers += [{
"events" : "authorize",
"handler" : "zero.core.security.auth.CustomAuthorizationHandler.class",
"conditions" : "/request/path =~ /formauth/subject(/.*)?",
"instanceData" : {
"myCustomSetOfRoles" : "ADMIN"
}
}]
Because there are no explicit definitions of user, group or role in the security constraint, the default authorization handler does not authorize this user.
|
|
r16 - 29 Jan 2008 - 18:13:24 - todkap
|
|
|
| | |
