Protecting resources on WebSphere Application Server or WebSphere Application Server Liberty

cacheSize

(Optional) Maximum number of tokens allowed. The default is 500.

id

(Mandatory) Defines a unique id of OAuthTAI.

securityConstraint

(Mandatory) The value of securityConstraint must be a number 1 to n.

securedURLs

(Mandatory) If multiple URLs are specified in securedURLs, separate each URL by a space. The following types of URLs are supported:

• Exact match URL. For example,/context-root/a/xyz
• Path match URL. For example, /context-root/*
• Wild card match URL. For example,/context-root/*/xyz

httpMethods

(Optional) Default value: ALL. The httpMethods attribute is case insensitive. Its value can be one or more of the following strings: ALL, DELETE, GET, POST,PUT,HEAD,OPTIONS,TRACE, or CONNECT. If multiple methods are specified, separate the methods by a space.

scope

(Optional) If scope is not specified, the only checking that is done is to make sure that the mandatory scopes are not expired.

The following is an example:

<?xml version="1.0" encoding="UTF-8"?>
   <OAuthTAI>
       <securityConstraint httpMethods="GET POST" securedURLs="/mfp-oauth-java-tests/*" 
          scope="Realm1 Realm2"/>
       <securityConstraint httpMethods="DELETE" securedURLs="/another-context-root/*"/>
   </OAuthTAI>

To specify the TAIUserRole in the web.xml file, define TAIUserRole in the security-role element, and then use this role to secure the web resource in the security-constraint element. For example:

<security-constraint>
   <web-resource-collection>
      <web-resource-name>BaseServlet</web-resource-name>
      <url-pattern>/Test/devices</url-pattern>
   </web-resource-collection>
      <auth-constraint>
         <role-name>TAIUserRole</role-name>
      </auth-constraint>
</security-constraint>
<security-role id="SecurityRole_TAIUserRole" >
   <description>This is the role that MobileFirst OAuthTAI uses to protect the resource. It must be mapped to 'All Authenticated in Application' in WAS and to 'ALL_AUTHENTICATED_USERS' in Liberty.</description> 
   <role-name>TAIUserRole</role-name>
</security-role>

To specify TAIUserRole with an annotation:

@WebServlet("/Test/devices")
@ServletSecurity(@HttpConstraint(rolesAllowed={"TAIUserRole"}))
public class BaseServlet extends HttpServlet {
    // servlet code ...
  }

1. Copy the file product_install_dir/WorklightServer/external-server-libraries/com.ibm.worklight.oauth.tai_1.0.0.jar to usr/extension/lib.

   where

   product_install_dir

   is the installation directory for MobileFirst Server.

   usr

   is the user directory for theWebSphere Application Server Liberty profile (default name usr).

2. Copy the file OAuthTai-1.0.mf from the directory WorklightServer/external-server-libraries to the directory usr/extension/lib/features.
3. Edit the server.xml file to add the OAuthTAI -1.0 feature. For example:

   <featureManager>
      <feature>appSecurity-2.0</feature>
      <feature>usr:OAuthTai-1.0</feature>
      <!--other necessary features-->
   </featureManager>

4. Edit the server.xml file to add the OAuthTAI feature. Note that the security role TAIUserRole is mapped to a special subject named ALL_AUTHENTICATED_USERS. For example:

   <usr_OAuthTAI id="myOAuthTAI">
      <securityConstraint httpMethods="GET POST" securedURLs="/worklight-oauth-java-tests/*"
          scope="Realm1 Realm2"/>
      <securityConstraint httpMethods="DELETE" securedURLs="/another-context-root/*"/>
   </usr_OAuthTAI>
       
       <basicRegistry id="basic" realm="BasicRealm" />
       
       <application type="war" id="basicauth" name="basicauth" location="${server.config.dir}/apps/basicauth.war">
       <application-bnd>
   			 <security-role name="TAIUserRole">
   				 <special-subject type="ALL_AUTHENTICATED_USERS" />
   		   </security-role>
   	   </application-bnd>
      </application>

5. Add the URL to the authorization server into the environment variables of your deployment. One way of doing so is to add the entry into the server.env file, which is located in the same directory as the server.xml file. Add the following, where

    publicKeyServerUrl=URL_to_authorization_server.

   URL_to_authorization_server is the URL to the MobileFirst authorization server.

Add the following line to the authorization header of your request:

Authorization: Bearer  Access_token ID_token

Bearer

(Mandatory) Is the required string for the token type, as defined in the OAuth 2.0 specification.

Access_token

(Mandatory) Encapsulates all of the security checks that the client has passed in the authorization phase.

ID_token

(Optional) Contains information about the user and device identity of the client.

When the application attempts to access resources protected by OAuth TAI, the following validation checks occur:

Subject: securityContext.get("imf.sub");

The subject is a string which uniquely identifies the application installation on a device and the authenticated user.

User Identity: (Optional)securityContext.get("imf.user");

The user identity is a JSON object which contains information about the authenticated user. For anonymous tokens, the user identity is null. The user identity contains the following properties:

• "id": (Mandatory) The user identity of the authenticated user identity realm.
• "authBy": (Mandatory):The name of the authenticated user identity realm.
• "displayName": (Optional) The user's display name as set when authenticating the user identity realm. This property may be null.
• "attributes" : (Optional) Additional data that can be set when authenticating the user identity realm. This property may be null.

Application information:securityContext.get("imf.application");

Application information, including"id", "environment", and "version". For example:

 {"id":"com.MobileFirst.TestApp","environment":"Android","version":"1.0"}

Device information:securityContext.get("imf.device");

Device information, including "id", "platform", "model" and "osVersion". For example:

{"id":"E7D426A2-214C-834C-87FF-D8E9DF93655D","platform":"Android","model":"Nexus 5","osVersion":"5.0"}

  JSONObject securityContext = callerWLCredential.getSecurityContext();
  String subject = securityContext.get("imf.sub");
  JSONObject imfUser = securityContext.get("imf.user");
  JSONObject imfDevice = securityContext.get("imf.device");
  JSONObject imfApplication = securityContext.get("imf.application");

The WSCredential and WLCredential APIs provide credential functionality.

com.ibm.websphere.security.cred.WSCredential

The WSCredential interface defines a credential that represents an authenticated principal to WebSphere Application Server or WebSphere Application Server Liberty. For example:

Subject callerSubject = WSSubject.getCallerSubject();
  WSCredential callerCredential = callerSubject.getPublicCredentials
     (WSCredential.class).iterator().next();

For more information about WSCredential, see the WSCredential documentation for your version of WebSphere Application Server or WebSphere Application Server Liberty. For example, see WSCredential for WebSphere Application Server Network Deployment 8.5.

com.worklight.oauth.tai.WLCredential

The WLCredential interface provides APIs to get the MobileFirst specific principal details.

    WLCredential callerWLCredential = callerSubject.getPublicCredentials
          (WLCredential.class).iterator().next();

The MobileFirst Operational Analytics server is protected by basic authentication. When you installed this server, you configured the data entry point and basic authentication credentials. To configure the Resource Server, you must provide the Analytics credentials through JNDI properties, specifically the URL to the data entry point, the user name, and password. These properties are set with the following property names:

• imf.analytics.url
• imf.analytics.username
• imf.analytics.password

If your Resource Server is running on WebSphere Application Server Liberty, you must configure these properties by using JNDI by adding entries to your server.xml file. For example:

<jndiEntry jndiName="imf.analytics.username" value="admin"/>