Mule : Mule Security
This page last changed on Oct 02, 2006 by marie.rizzo.
Mule allows you to authenticate requests via endpoints using transport specific or generic authentication methods. It also allows you to control method-level authorisation on your UMO Components. To enable security you need to do two things-
Once you've read this page the following my also be of interest for people wanting to secure Mule - Security Managerthe Security Manager responsible for Authenticating requests based on one or more Security Providers configured on the security Manager. A Security Provider can authenticate against a variety of repositories such as Ldap, JAAS, database (dao) and third-party security frameworks such as CAS (Yale Central Authentication Service). ConfigurationThe following describes how to configure a single Security provider on Mule, in this case an in-memory DAO. <mule-configuration> <security-manager> <security-provider name="memory-dao" className="org.mule.extras.acegi.AcegiProviderAdapter"> <properties> <container-property name="delegate" reference="daoAuthenticationProvider"/> </properties> </security-provider> </security-manager> .... </mule-configuration> Note that the 'delegate' property is a container property meaning we need a container to get it from. Here we configure a Spring Container Context to load our Security Providers from. you can set multiple security-provider elements. <container-context className="org.mule.extras.spring.SpringContainerContext"> <properties> <property name="configFile" value="securityContext.xml"/> </properties> </container-context> The Spring Acegi configuration is where the real Security Provider configuration occurs. <beans> <bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider"> <property name="authenticationDao"> <ref bean="inMemoryDaoImpl"/> </property> </bean> <bean id="inMemoryDaoImpl" class="net.sf.acegisecurity.providers.dao.memory.InMemoryDaoImpl"> <property name="userMap"> <value> ross=ross,ROLE_ADMIN anon=anon,ROLE_ANONYMOUS </value> </property> </bean> </beans> Here we have a static DAO Security Provider that allows user credentials to be set in memory with two users; ross and anon. Encryption strategiesThe Security Manager can be configured with one or more Encryption strategies that can then be used by encryption transformers, Security filters or secure Transport providers such as ssl or https. These Encryption strategies can greatly simplify configuration for secure messaging as they can be shared across components. <security-manager> <encryption-strategy name="PBE" className="org.mule.impl.security.PasswordBasedEncryptionStrategy"> <properties> <property name="password" value="mule"/> </properties> </encryption-strategy> </security-manager> This strategy can then be referenced by other components in the system such as filters or transformers. <transformers> <transformer name="EncryptedToByteArray" className="org.mule.transformers.encryption.DecryptionTransformer"> <properties> <property name="strategyName" value="PBE"/> </properties> </transformer> </transformers> Security FiltersSecurity filters can be configured on an object to either authenticate inbound requests or attach credentials to outbound requests. Endpoint Security FilterAs the name suggests, these types of filters are configured on endpoints. To configure a Http Basic Auth filter on a http endpoint use the following - <endpoint address="http://localhost:4567"> <security-filter className="org.mule.extras.acegi.filters.http.HttpBasicAuthenticationFilter"> <properties> <property name="realm" value="mule-realm"/> </properties> </security-filter> </endpoint> When a request is received the Authentication header will be read from the request and authenticated against all Security Providers on the Security Manager. If you only want to validate on certain ones you can supply a comma-separated list of Security Provider names. <endpoint address="http://localhost:4567"> <security-filter useProviders="default,another" className="org.mule.extras.acegi.filters.http.HttpBasicAuthenticationFilter"/> </endpoint> Securing UMO ComponentsTo secure MethodInvocations, developers need to add a properly configured MethodSecurityInterceptor into the application context. The beans requiring security are chained into the interceptor. This chaining is accomplished using Spring's ProxyFactoryBean or BeanNameAutoProxyCreator. Alternatively, Acegi Security provides a MethodDefinitionSourceAdvisor which may be used with Spring's DefaultAdvisorAutoProxyCreator to automatically chain the security interceptor in front of any beans defined against the MethodSecurityInterceptor. Apart from the daoAuthenticationProvider and inMemoryDaoImpl beans configured above, the following beans must be configured:
The MethodSecurityInterceptorThe MethodSecurityInterceptor is configured with a reference to an:
The following is a Security Interceptor for intercepting calls made to the methods of a component called myComponent. myComponent has an interface (myComponentIfc) that defines two methods: delete and writeSomething. Roles are set on these methods as seen below in the property objectDefinitionSource. <bean id="myComponentSecurity" class='org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor'> <property name="authenticationManager"> <ref bean="authenticationManager"/> </property> <property name="accessDecisionManager"> <ref bean="accessDecisionManager"/> </property> <property name="objectDefinitionSource"> <value> com.foo.myComponentIfc.delete=ROLE_ADMIN com.foo.myComponentIfc.writeSomething=ROLE_ANONYMOUS </value> </property> </bean> The AuthenticationManagerAn AuthenticationManager is responsible for passing requests through a chain of AuthenticationProviders. <bean id="authenticationManager" class='org.acegisecurity.providers.ProviderManager'> <property name= "providers"> <list> <ref local="daoAuthenticationProvider"/> </list> </property> </bean> The AccessDecisionManagerThis bean specifies that a user can access the protected methods if they have any one of the roles specified in the objectDefinitionSource. <bean id="accessDecisionManager" class='org.acegisecurity.vote.AffirmativeBased'> <property name="decisionVoters"> <list> <ref bean="roleVoter"/> </list> </property> </bean> The AutoProxyCreatorThis bean defines a proxy for the protected bean. When an application asks Spring for a myComponent bean it will get this proxy instead. <bean id="autoProxyCreator" class='org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator'> <property name='interceptorNames'> <list> <value>myComponentSecurity</value> </list> </property> <property name='beanNames'> <list> <value>myComponent</value> </list> </property> <property name='proxyTargetClass' value="true"/> </bean> When using BeanNameAutoProxyCreator to create the required proxy for security, the configuration must contain the property proxyTargetClass set to true. Otherwise, the method passed to MethodSecurityInterceptor.invoke is the proxy's caller, not the proxy's target. The RoleVoterThe RoleVoter class will vote if any ConfigAttribute begins with ROLE_. The RoleVoter is case sensitive on comparisons as well as the ROLE_ prefix.
<bean id="roleVoter" class="org.acegisecurity.vote.RoleVoter"/>
Setting Security Properties on the Security ProviderWe can put any additional properties we may wish to add to the Security Provider in the securityProperties map. For instance this map can be used to change Acegi's default security strategy into one of the following... MODE_THREADLOCAL which allows the authentication to be set on the current thread (this is the defualt strategy used by Acegi). Securing Components in Asynchronous SystemsThe use of Acegi's security strategies is particularly useful when using an asynchronous system since we have to add a property on the Security Provider in order for the authentication to be set on more than one thread. In this case we would use the MODE_GLOBAL as seen in the example below. <security-provider name="memory-dao" className="org.mule.extras.acegi.AcegiProviderAdapter"> <properties> <container-property name="delegate" reference="daoAuthenticationProvider"/> <map name="securityProperties"> <property name="securityMode" value="MODE_GLOBAL"/> </map> </properties> </security-provider> |
![]() |
Document generated by Confluence on Oct 03, 2006 09:23 |