HTTPS Server GlassFish Example

# HTTPS Server Example - GlassFish

This example demonstrates how to develop secure RESTful hello world web service with a Servlet 2.5 container.

## Contents

The example consists of just one Java class:

`com.sun.jersey.samples.helloworldwebapp.resources.HelloWorldResource`
  A resource class that produces a textual response to an HTTP GET.

The mapping of the URI path space is presented in the following table:

URI path | Resource class | HTTP methods
--- | --- | ---
/helloworld | HelloWorldResource | GET

## Running the Example

Run the example as follows:

create war package

> `mvn clean package`

setup GlassFish 3.1 (installed at `AS_HOME=<install_dir>/glassfish`):

- Add new security realm called "`myRealm`"

- Start GlassFish using asadmin `$AS_HOME/bin/asadmin start-domain`
- Access Admin console, assuming the use of default admin port, here http://localhost:4848
- Navigate in Admin console to: `Configurations -> server-config -> Security -> Realms`, click on "`New...`"

Name | `myRealm`
Class Name | `com.sun.enterprise.security.auth.realm.file.FileRealm`
JAAS context | `fileRealm`
Key File | `${com.sun.aas.instanceRoot}/config/myRealm-keyfile`

- Create user and set password for user `myUser` (click on "`myRealm`", "`Manage Users`", "`New...`");
  - Ensure "`User ID:`" set to "`myUser`" and "`Group List:`" set to "`Users`"
  - Enter password `myPass` in "`New Password:`" and "`Confirm New Password:`" text fields
- Add one other user name `joeUser` (click on "`myRealm`", "`Manage Users`", "`New...`");
  - Ensure "`User ID:`" set to "`joeUser`" and "`Group List:`" set to "`Users`"
  - Enter password `joePass` in "`New Password:`" and "`Confirm New Password:`" text fields

- Check `web.xml` and `sun-web.xml` to understand how role mappings are configured. This blog is also helpful to clarify role mappings http://blogs.oracle.com/bobby/entry/simplified_security_role_mapping
- Deploy `httpsBasicAuth-webapp.war` as a Web Application

- Admin console: select `Applications`, click on "`Deploy...`". Select file `./target/httpsBasicAuth-webapp.war`
- or you can use command line: `$AS_HOME/bin/asadmin deploy ./target/httpsBasicAuth-webapp.war`

From a web browser, visit:

> `https://localhost:8181/httpsBasicAuth-webapp/helloworld` (you have to add security exception for GlassFish server certificate / ignore all warnings about security)

- Enter either Username `myUser` and Password `myPass` or, Username `joeUser` and Password `joePass`
- If entered Username `myUser` and Password `myPass`, verify that expected output: `Sending "Hello World" to user "myUser"` was displayed
- If entered Username `joeUser` and Password `joePass`, verify that expected output: `Sending "Hello World" to user "joeUser"` was displayed

## Running the Negative Example

Run the example as follows:

create war package

> `mvn clean package`

setup GlassFish 3.1 (installed at `AS_HOME=<install_dir>/glassfish`):

- Follow the steps described in the "setup GlassFish 3.1" section from the previous chapter "Running the Example" but instead of adding the user "`joeUser`" to the "`Group List:`" of "`Users`" set "`Group List:`" for this user to "`OtherUsers`"

From a web browser, visit:

> `https://localhost:8181/httpsBasicAuth-webapp/helloworld` (you have to add security exception for GlassFish server certificate / ignore all warnings about security)

- Enter Username `joeUser` and Password `joePass`, verify that expected output looks like: `HTTP Status 403 - Access to the requested resource has been denied`