J2EE Security with Apache SHIRO
4 likes5,366 views
The document outlines a webinar discussing security in web applications using Apache Shiro, focusing on authentication, authorization, session management, and cryptography. It covers different security frameworks including Java Authentication and Authorization Service (JAAS), Spring Security, and the integration of Shiro with Grails applications. The conclusion highlights Shiro's simplicity in configuration compared to other security mechanisms, along with providing contact information for further inquiries.
J2EE Security with Apache SHIRO
- 1. Webinar J2EE Security with Apache SHIRO 16th April, 2013
- 2. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 3. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 4. What is Authentication, Authorization & Session Mgmt.? Authentication: prove genuineness Authorization: process of granting approval or permission on resources. Session Management: Session management means authenticate once and confirms on every action that the user is the one who provided the original credentials. Key cornerstones in the security of a system. Authentication and authorization are two very related, and yet separate, concepts. Where Authentication deals with identifying a user, the Authorization determines what a user is allowed to do.
- 5. What is Authentication, Authorization & Session Mgmt.? Designers and developers should leverage authorization, authentication and session management capabilities as much as possible.
- 6. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 7. Introduction on market trending security framework Java Authentication and Authorization Service or JAAS Apache Shiro Security Spring Security
- 8. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 9. 1 Javax.security to be imported. Discussion on market trending security framework JAAS Security Configuration Steps: 2 Implement LoginModule Interface 3 Override methods like initialize, login, commit, abort, logout. 4 Implement call back handlers 5 Implement privilege action 6 Configure jaas policy files 7 Implement Filters
- 10. Discussion on market trending security framework Spring Security Configuration Steps: 2 Install spring security libraries 3 Create & Configure spring-security.xml file in class path. 4 Provide @secured annotation above methods based on the privileges Install spring core libraries1
- 11. Discussion on market trending security framework Shiro Security Configuration Steps: 2 Create and configure shiro.ini file in class path 3 Provide roles and privileges in shiro.ini Install shiro libraries and required libraries to project1
- 12. Discussion on market trending security framework Shiro Spring Security JAAS Simplicity Bit Complicated (Not easily fathomable) More complicated. Enterprise session management is supported Not Supported Not supported Better cryptography simplified cryptography Grails plugin available Grails plugin available Grails plugin is not available Work and Gel with every environment Spring is not mandatory Dependent on Spring core libraries Part of Java and can work and get with every environment
- 13. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 14. Grails inbuilt security GORM - SQL escaped to prevent SQL injection attacks The default scaffolding templates HTML escape all data fields when displayed Link creating tags use appropriate escaping mechanisms to prevent code injection Codecs to prevent injection attacks.
- 15. Grails inbuilt security class SecurityFilters { def filters = { loginCheck(controller: '*', action: '*') { before = { if (!session.user && actionName != "login") { redirect(controller: "user", action: "login") return false } } } } }
- 16. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 17. Integrating shiro security with existing application Application Diagram without SHIRO
- 18. Integrating shiro security with existing application
- 19. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 20. Conclusion With shiro it is quite easy to configure security, shiro takes care of most of the issues through its default settings, existing Java security mechanisms like JAAS, Spring security are too confusing, complex etc.
- 21. Agenda Authentication, Authorization, Session Management and Cryptography Introduction on market trending security framework Discussion on market trending security framework Grails inbuilt security Live Demo on integrating shiro security with grails web application Conclusion Q&A
- 23. Write us on info@cygnet-infotech.com to get a free demo Session Free Consultation
- 24. Contact Us Email: info@cygnet-infotech.com Website: www.cygnet-infotech.com Facebook LinkedIn Twitter - @CygnetInfotech Skype – cygnet-infotech-pvt-ltd India Cygnet Infotech Pvt Ltd. 2A, Manikyam, Opp. Samudra Annexe, Nr. Shilp Cross Roads, Off. C. G. Road, Navrangpura, Ahmedabad, Gujarat, India. Tel: +91-79-30487400; Fax: +91-79-30487422 USA Cygnet Infotech LLC. Mack-Cali Centre III, 140 E, Ridgewood Avenue, Suite 415 ST, Paramus, NJ 07652. Tel: +1-201-995-7444; Fax : +1-201-221-8516