GlassFish 3.1, REST, and a Secured Admin User
Thursday, February 17, 2011 |In my last post on using the GlassFish REST interface, a commenter asked about how GlassFish handles security. So far, all of my examples have been using GlassFish 3.1 out of the box, which doesn’t require authentication (as a convenience for developers, as well as system admins evaluating the server). In production, of course, the server will be secured, which means our client code will have to be modified. In this installment, we’ll see how that might be done in Java.
Let’s start with a very simple class that deploys an application to the server:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
public class AuthExample {
protected Client client;
public AuthExample() {
client = Client.create();
}
public boolean deployApp(String fileName) throws URISyntaxException {
FormDataMultiPart form = new FormDataMultiPart();
form.getBodyParts().add(new FileDataBodyPart("id", new File(fileName)));
form.field("name", fileName.substring(0, fileName.indexOf(".")),
MediaType.TEXT_PLAIN_TYPE);
form.field("contextroot", fileName.substring(0, fileName.indexOf(".")),
MediaType.TEXT_PLAIN_TYPE);
form.field("force", "true", MediaType.TEXT_PLAIN_TYPE);
ClientResponse response =
client.resource("http://localhost:4848/management/domain/applications/application/")
.type(MediaType.MULTIPART_FORM_DATA)
.accept(MediaType.APPLICATION_JSON)
.post(ClientResponse.class, form);
return response.getStatus() == 200;
}
public static void main(String... args) {
try {
AuthExample example = new AuthExample();
if (example.deployApp(args[0])) {
System.out.println("Success");
} else {
System.out.println("Failure");
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
If you execute this, passing a WAR as the first and only parameter, you should see "Success" printed to the screen. Now that we’ve verified this works, let’s secure the server:
1
2
3
4
5
6
$ asadmin change-admin-password
Enter admin user name [default: admin]>
Enter admin passwordthe >
Enter new admin password>
Enter new admin password again>
Command change-admin-password executed successfully.
If you rerun the class now, you should see "Failure" printed to the screen, which is what we’d expect to see. To fix this, let’s change the constructor for our test app:
1
2
3
4
public AuthExample() {
client = Client.create();
client.addFilter(new HTTPBasicAuthFilter("admin", "admin"));
}
Change the password, of course, to what you entered, and rerun the app. You should now see "Success".
Pretty simple. Ultimately, this has more to do with the Jersey Client than with GlassFish, but is still something one will need to know if using these two pieces of software together.
For the Maven people in the audience, here’s the POM I used to build this:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.steeplesoft</groupId>
<artifactId>jersey-plus-auth</artifactId>
<packaging>jar</packaging>
<version>0.1-SNAPSHOT</version>
<name>Jersey plus Authentication Example</name>
<dependencies>
<dependency>
<groupId>com.sun.jersey</groupId>
<artifactId>jersey-client</artifactId>
<version>1.5</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>com.sun.jersey.contribs</groupId>
<artifactId>jersey-multipart</artifactId>
<version>1.5</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.6</source>
<target>1.6</target>
<showDeprecation>true</showDeprecation>
</configuration>
</plugin>
</plugins>
</build>
<profiles>
<profile>
<id>run</id>
<build>
<plugins>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
<version>1.2</version>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>java</goal>
</goals>
<configuration>
<mainClass>
com.steeeplesoft.jersey.examples.auth.AuthExample
</mainClass>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>
</project>
I executed the project with this command line:
1
mvn -Prun -Dexec.args="test.war" package
Enjoy!
My name is Jason Lee. I am a software developer living in the middle of Oklahoma. I’ve been a professional developer since 1997,
using a variety of languages, including Java, Javascript, PHP, Python, Delphi, and even a bit of C#. I currently work for Red Hat
on the WildFly/EAP team, where, among other things, I maintain integrations for some MicroProfile specs, OpenTelemetry, Micrometer,
Jakarta Faces, and Bean Validation. (Full resume 