Web Console Security Provider :: Apache Felix Home Subprojects Dependency Manager Event Admin File Install Framework Gogo Shell Health Checks Inventory Log Logback Maven bundle plugin Maven SCR plugin Metatype Service Preferences Service Remote Shell Script console plugin Lightweight shell Shell TUI Web Console Downloads Documentation Documentation Downloads Getting Started News Community Apache Felix Project Info Contributing Projects Using Felix Development Coding Standards DEPENDENCIES file template Provisional OSGi API Policy Release Management Site How To Using the OSGi Compliance Tests FAQS Apache Felix Bundle Plugin Frequently Asked Questions Apache Felix SCR Plugin Frequently Asked Questions Subprojects Apache Felix Dependency Manager Guides Apache Felix Dependency Manager - Migrating from earlier versions Dependency Manager - Annotations Dependency Manager - Background Dependency Manager - Bundles and Dependencies Dependency Manager - Design Patterns Dependency Manager - Development Dependency Manager - History Dependency Manager - JavaDocs Dependency Manager - Migrating from other solutions. Dependency Manager - Performance Tuning Dependency Manager - Resource adapters Dependency Manager - What’s new in version 4? Dependency Manager Lambda What’s New in R15 Reference Dependency Manager - Adapter Dependency Manager - Aspect Dependency Manager - Bundle Adapter Dependency Manager - Bundle Dependency Dependency Manager - Components Dependency Manager - Configuration Dependency Dependency Manager - Dependencies Dependency Manager - External Links Dependency Manager - Factory Configuration Adapter Service Dependency Manager - Resource Adapter Dependency Manager - Resource Dependency Dependency Manager - Service Dependency Dependency Manager - Service Scopes Dependency Manager - Singleton Component Dependency Manager - Thread Model Dependency Manager Annotations Tutorials Dependency Manager - Annotations Dependency Manager - Getting Started Dependency Manager - Leveraging the shell Dependency Manager sample projects Apache Felix Event Admin Apache Felix File Install Apache Felix Framework Apache Felix Framework Bundle Cache Apache Felix Framework Configuration Properties Apache Felix Framework Frequently Asked Questions Apache Felix Framework Launching and Embedding Apache Felix Framework Usage Documentation Apache Felix Framework Security Apache Felix Gogo RFC 147 Overview Apache Felix Health Checks Apache Felix Inventory Printer Apache Felix Log Apache Felix Logback Apache Felix Maven Bundle Plugin (BND) Apache Felix Metatype Service Apache Felix OSGi Bundle Repository (OBR) Apache Felix Preferences Service Apache Felix Remote Shell Apache Felix Shell Apache Felix Shell TUI Apache Felix Web Console Extending the Apache Felix Web Console Web Console RESTful API Web Console Security Provider Extensions Branding the Web Console Providing Resources Providing Web Console Plugins Web Console Logging Web Console Output Templating Tutorials Apache Felix Application Demonstration Apache Felix OSGi Tutorial OSGi Frequently Asked Questions OSGI Tutorial Apache Felix Tutorial Example 1 - Service Event Listener Bundle Apache Felix Tutorial Example 2 Apache Felix Tutorial Example 2b Apache Felix Tutorial Example 3 Apache Felix Tutorial Example 4 Apache Felix Tutorial Example 5 Example 6 - Spell Checker Service Bundle Example 7 - Spell Checker Client Bundle Example 8 - Spell Checker Service using Service Binder Example 9 - Spell Checker Service using Declarative Services Apache License 2.0 Site map Documentation master Documentation master Documentation Subprojects Apache Felix Web Console Web Console Security Provider Edit this Page Web Console Security Provider This documentation refers to the older version 4.x of the Apache Felix Web Console. For the latest version checkout this documentation. As of Apache Felix Web Console 3.1.0 security of the Web Console can be extended by providing a WebConsoleSecurityProvicer service. An extension to this service has been introduced with the WebConsoleSecurityProvider2 service in Apache Felix Web Console 3.1.4. As of Web Console 4.3.16 it is now possible to require a WebConsoleSecurityProvider service to be present in order for the Web Console to become active. This can be used to prevent bypassing the security provider if this is provided asynchronously. To do this, the WebConsoleSecurityProvider service needs to be registered with a Service Registration property to identify itself: "webconsole.security.provider.id" = "my.security.provider" Then the Web Console can be informed about the security providers it needs to operate by setting the following OSGi Framework property: "felix.webconsole.security.providers" = "my.security.provider" With this property specified, the Web Console will not activate until the service with the specified property is present. Local login as typically done with admin/password is disabled when this property is specified. WebConsoleSecurityProvider The WebConsoleSecurityProvider service provides two methods: {code:java} /** Authenticates the user with the given user name and password. * @param username The name of the user presented by the client @param password The password presented by the client @return Some object representing the authenticated user indicating general access to be granted to the web console. If the user cannot be authenticated (e.g. unknown user name or wrong password) or the user must not be allowed access to the web console at all null must be returned from this method. */ public Object authenticate( String username, String password ); /** Checks whether bthe authenticated user has the given role permission. * @param user The object referring to the authenticated user. This is the object returned from the {@link #authenticate(String, String)} method and will never be null. @param role The requested role @return true if the user is given permission for the given role. */ public boolean authorize( Object user, String role ); {note} Use of the {{authorize}} method is not currently implemented, though. Mainly this is because it is not readily clear, what exactly the {{role}} means. One possible interpretation could be that this is the label of the plugin whose access is checked. Or it might be a combination of the plugin called and the request method used. {note} The drawback of the {{WebConsoleSecurityProvider}} interface is that it just provides a mechanism to check for a user name and password using HTTP BASIC authentication. If other authenication mechanisms should be used the {{WebConsoleSecurityProvider2}} interface introduced in Apache Felix Web Console 3.1.4 can be used. h2. WebConsoleSecurityProvider2 The {{WebConsoleSecurityProvider2}} interface extends the {{WebConsoleSecurityProvider}} by a single method: {code:java} /** * The name of the request attribute providing the object representing the * authenticated user. This object is used to call the * {@link WebConsoleSecurityProvider#authorize(Object, String)} to * authorize access for certain roles. */ String USER_ATTRIBUTE = "org.apache.felix.webconsole.user"; /** * Authenticates the given request or asks the client for credentials. * <p> * Implementations of this method are expected to respect and implement * the semantics of the <code>HttpContext.handleSecurity</code> method * as specified in the OSGi HTTP Service specification. * <p> * If this method returns <code>true</code> it is assumed the request * provided valid credentials identifying the user as accepted to access * the web console. In addition, the {@link #USER_ATTRIBUTE} request * attribute must be set to a non-<code>null</code> object reference * identifying the authenticated user. * <p> * If this method returns <code>false</code> the request to the web console * is terminated without any more response sent back to the client. That is * the implementation is expected to have informed the client in case of * non-granted access. * * @param request The request object * @param response The response object * @return <code>true</code> If the request provided valid credentials. */ public boolean authenticate( HttpServletRequest request, HttpServletResponse response ); This method is in full control of authentication and thus has to extract the user credentials from the request and can also fail the request. Sample A sample of a WebConsoleSecurityProvider service is the Apache Sling implementation SlingWebConsoleSecurityProvider. This implementation uses a JCR implementation to login to the repository and thus validate the credentials. Content licensed under AL2. UI licensed under MPL-2.0 with extensions licensed under AL2