Demonstrate GENERIC authentication
This sample defines one security realm with two new login modules:
- org.apache.geronimo.security.realm.providers.GenericHttpHeaderPropertiesFileLoginModule
- org.apache.geronimo.security.realm.providers.GenericHttpHeaderSqlLoginmodule
There is another new login module for LDAP authentication: org.apache.geronimo.security.realm.providers.GenericHttpHeaderLdapLoginModule. It requires some additional LDAP configuration, and not be able to demonstrate in this sample. But you can refer to comment-out section of the sample's geronimo deployment plan for details.
Follow these steps to run this sample:
- Configure Apache HTTP web server to proxy HTTP request for Geronimo server.
Add these lines to APACHE_HOME/conf/httpd.conf:
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
<IfModule mod_proxy.c>
ProxyPass /generic-auth http://localhost:8080/generic-auth
ProxyPassReverse / http://localhost:8080/
</IfModule>
- Mimic SiteMinder behavior via mod_headers module.
Add these lines to APACHE_HOME/conf/httpd.conf:
LoadModule headers_module modules/mod_headers.so
<IfModule mod_headers.c>
<Location /generic-auth>
RequestHeader add SM_USER USERNAME
</Location>
</IfModule>
The USERNAME could be replaced with these users one by one: izumi, tom, alan, nobody
izumi is a valid user defined in file property "var/security/demo_groups.properties" with manager role.
tom is a valid user defined in SQL login module with manager role.
alan is a valid user defined in SQL login module without manager role.
nobody is not a valid user in any security login module.
-
Change the username field as above, restart Apache HTTP server, then visit this link.
You should see these expected results:
- izumi -- should see the hello world page with HTTP 200 status
- tom -- should see the hello world page with HTTP 200 status
- alan -- should not see the hello world page with HTTP 403 status
- nobody -- should not see the hello world page with HTTP 401 status