Group items matching

in title, tags, annotations or url

Step 2 securing some content

create a database that will hold the list of the authorized users along with their password

Create a new directory “auth” and add a new JSP under it, let’s call it “BackOffice.jsp“

enable Shiro into our project by adding a ServletFilter into our Web.xml

 <filter-class>05            org.apache.shiro.web.servlet.IniShiroFilter06        </filter-class>

10    <filter-mapping>11         <filter-name>ShiroFilter</filter-name>12         <url-pattern>/*</url-pattern>13    </filter-mapping>

classpath:shiro.ini

shiro-core

shiro-web

create shiro.ini under resource dir

07ds.jdbcUrl=jdbc:derby://localhost:1527/shiro_schema08ds.username = APP09ds.password = APP

15/auth/** = authcBasic16/** = anon

jdbcRealm.authenticationQuery

jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm

setup the jdbc realm, this is where Shiro will find the authorized users

map the URLs to be protected, all the url under /auth should be authenticated with basic HTTP authentication

All the other URLs should be accessed without authentication

Add a new directory under src let’s call it production we will create a new shiro configuration file compatible with MySQL

06ds.serverName = localhost07ds.user = ADM08ds.password = secret12309ds.databaseName = shiro_schema

jdbcRealm which use a MySQL driver

added the appropriate dependency to maven pom.xml

mysql-connector-java

environment.type

staging

13                <jdbc.user>APP</jdbc.user>14                <jdbc.passwd>APP</jdbc.passwd>15                <jdbc.url>jdbc:derby://localhost:1527/shiro_schema</jdbc.url>16                <jdbc.driver>org.apache.derby.jdbc.ClientDriver</jdbc.driver>

src/main/resources

derbyclient

production

environment.type

45                <jdbc.user>ADM</jdbc.user>46                <jdbc.passwd>secret123</jdbc.passwd>47                <jdbc.ds>com.mysql.jdbc.jdbc2.optional.MysqlDataSource</jdbc.ds>48                <jdbc.serverName>localhost</jdbc.serverName>49                <jdbc.databaseName>shiro_schema</jdbc.databaseName>

src/production/resources

To build and run for staging

To build for production

-Denvironment.type=prod

that users can access

that users can access

that users can view and edit, you can set your

define a

, and create

sharing rules

Object-Level Security

bean-validation JPA, Bean Validation Shows how to use Arquillian to test Bean Validation

ejb-security Security, EJB Shows how to use Java EE Declarative Security to Control Access to EJB 3

payment-cdi-event CDI Demonstrates how to use CDI 1.0 Events

richfaces-validation RichFaces Demonstrates RichFaces and bean validation

ejb-in-war JSF, WAR, EJB Packages an EJB JAR in a WAR

greeter EJB, JPA, JSF, JTA, CDI Demonstrates the use of CDI 1.0, JPA 2.0, JTA 1.1, EJB 3.1 and JSF 2.0

helloworld-mdb EJB, MDB, JMS Demonstrates the use of JMS 1.1 and EJB 3.1 Message-Driven Bean

helloworld-rs JAX-RS, CDI Demonstrates the use of CDI 1.0 and JAX-RS

kitchensink BV, EJB, JAX-RS, JPA, JPA, JSF, CDI

servlet-async CDI, EJB, Servlet Demonstrates CDI, plus asynchronous Servlets and EJBs

servlet-security Security, Servlet Demonstrates how to use Java EE declarative security to control access to Servlet 3

shopping-cart EJB Demonstrates a stateful session bean

tasks Arquillian, JPA Demonstrates testing JPA using Arquillian