One of the nice things about the .NET web environment is the dead easy way to implement Single Sign On in your web apps through Active Directory authentication. In the Java world there are multiple alternatives to use Windows’ Single Sign On with Java based web apps. One of those alternatives is Waffle. Waffle allows your Java web app to authenticate against Active Directory groups (and users). The only caveat is that your web server needs to be running in Windows, which kind of makes sense.
In this article, you will learn the steps required to have your OpenXava web application use Waffle to authenticate your Windows users.
The first step is to download Waffle from their site and then copy the JAR files outlined in https://github.com/dblock/waffle/blob/master/Docs/tomcat/TomcatSingleSignOnValve.md to the OpenXava’s tomcat server.
In your OpenXava project, create servlets.xml in the Web-inf, containing the following:
<!-- the role name (the domain gorup) must be entered EXACTLY as it appears in AD. It is case sensitive -->
<security-role>
<role-name>YOURDOMAIN\YourADGroup</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>
Demo Application
</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>YOURDOMAIN\YourADGroup</role-name>
</auth-constraint>
</security-constraint>
Add a new file called filters.xml to Web-inf:
<filter>
<filter-name>SecurityFilter</filter-name>
<filter-class>waffle.servlet.NegotiateSecurityFilter</filter-class>
<init-param>
<param-name>allowGuestLogin</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>waffle.servlet.spi.NegotiateSecurityFilterProvider/protocols</param-name>
<param-value>
Negotiate
NTLM
</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>SecurityFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
After creating the filters.xml file, create the a context.xml file in the META-INF folder (not Web-inf):
<Context>
<Valve className="waffle.apache.NegotiateAuthenticator" />
<Realm className="waffle.apache.WindowsRealm" />
</Context>
That’s it! that will limit access to members of YOURDOMAIN\YourADGroup and the users that visit the site will have their Windows credential pass-thorugh their browser. Please consult OpenXava and Waffle on how to get the current username in order to handle custom logic based on the current user’s Active Directory groups.
Comments