Skip to content

Commit 71d009a

Browse files
ErmiasGErmiasG
authored
[HWORKS-860] hopsworks realm (#1490)
1 parent 654cc2a commit 71d009a

File tree

11 files changed

+703
-5
lines changed

11 files changed

+703
-5
lines changed

‎hopsworks-api/src/main/webapp/WEB-INF/web.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,7 @@
340340
</security-constraint>
341341
<login-config>
342342
<auth-method>BASIC</auth-method>
343-
<realm-name>cauthRealm</realm-name>
343+
<realm-name>hopsworksrealm</realm-name>
344344
</login-config>
345345
<context-param>
346346
<param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>

‎hopsworks-ca/src/main/webapp/WEB-INF/web.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@
7676
</security-constraint>
7777
<login-config>
7878
<auth-method>BASIC</auth-method>
79-
<realm-name>cauthRealm</realm-name>
79+
<realm-name>hopsworksrealm</realm-name>
8080
</login-config>
8181
<context-param>
8282
<param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>

‎hopsworks-realm/README.md

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
## Hopsworks jdbc realm
2+
Hopsworks JDBC realm is a security realm for Payara with a JDBC backend.
3+
4+
Payara's JDBC realm assumes a data model with two tables.
5+
One for user with encoded password and another with pairs of usernames and group names
6+
to define to which groups a user belongs.
7+
8+
Hopsworks JDBC realm accepts two queries one to determine the password of the
9+
user based on the username and one to determine the groups the user belongs to based
10+
on the username. This allows it to handle any data model.
11+
12+
13+
### Build hopsworks JDBC realm
14+
```sh
15+
mvn clean compile assembly:single
16+
```
17+
18+
### Use hopsworks JDBC realm
19+
20+
Copy ```hopsworks-realm-jar-with-dependencies.jar``` to ```[payara home installation]/domains/domain1/lib/hopsworks-realm.jar```
21+
22+
#### Create the realm
23+
24+
```sh
25+
PASSWORD_QUERY="SELECT password FROM hopsworks.users WHERE email = ?"
26+
GROUP_QUERY ="SELECT G.group_name from hopsworks.bbc_group AS G, hopsworks.user_group AS UG, hopsworks.users AS U WHERE U.email=? AND UG.gid = G.gid AND UG.uid = U.uid"
27+
28+
${PAYARA_DIR}/bin/asadmin create-auth-realm \
29+
--login-module=io.hops.hopsworks.realm.jdbc.HopsworksLoginModule \
30+
--classname=io.hops.hopsworks.realm.jdbc.HopsworksJDBCRealm \
31+
--property=jaas-context=hopsworksJdbcRealm:datasource-jndi=jdbc/hopsworks:password-query=${PASSWORD_QUERY}:group-query=${GROUP_QUERY}:digest-algorithm=SHA-256:encoding=Hex \
32+
hopsworksrealm
33+
```
34+
35+
1. _password-query_ query used to determine the password of the user based on the username (login name). default
36+
```"SELECT password FROM hopsworks.users WHERE email = ?"```
37+
2. _group-query_ query used to determine the groups the user belongs to based on the username (login name). default
38+
```"SELECT G.group_name from hopsworks.bbc_group AS G, hopsworks.user_group AS UG, hopsworks.users AS U WHERE U.email=? AND UG.gid = G.gid AND UG.uid = U.uid"```
39+
3. _datasource-jndi_ the datasource used to access the database.

‎hopsworks-realm/pom.xml

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ This file is part of Hopsworks
4+
~ Copyright (C) 2023, Hopsworks AB. All rights reserved
5+
~
6+
~ Hopsworks is free software: you can redistribute it and/or modify it under the terms of
7+
~ the GNU Affero General Public License as published by the Free Software Foundation,
8+
~ either version 3 of the License, or (at your option) any later version.
9+
~
10+
~ Hopsworks is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
11+
~ without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
12+
~ PURPOSE. See the GNU Affero General Public License for more details.
13+
~
14+
~ You should have received a copy of the GNU Affero General Public License along with this program.
15+
~ If not, see <https://www.gnu.org/licenses/>.
16+
-->
17+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
18+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
19+
<modelVersion>4.0.0</modelVersion>
20+
<parent>
21+
<groupId>io.hops</groupId>
22+
<artifactId>hopsworks</artifactId>
23+
<version>3.8.0-SNAPSHOT</version>
24+
<relativePath>../pom.xml</relativePath>
25+
</parent>
26+
27+
<groupId>io.hops.hopsworks</groupId>
28+
<artifactId>hopsworks-realm</artifactId>
29+
<name>Hopsworks - realm</name>
30+
<description>Hopsworks custom realm</description>
31+
32+
<dependencies>
33+
<dependency>
34+
<groupId>org.apache.maven.plugins</groupId>
35+
<artifactId>maven-assembly-plugin</artifactId>
36+
<version>3.6.0</version>
37+
</dependency>
38+
<dependency>
39+
<groupId>fish.payara.extras</groupId>
40+
<artifactId>payara-embedded-web</artifactId>
41+
</dependency>
42+
</dependencies>
43+
<build>
44+
<finalName>hopsworks-realm</finalName>
45+
<plugins>
46+
<plugin>
47+
<groupId>org.apache.maven.plugins</groupId>
48+
<artifactId>maven-compiler-plugin</artifactId>
49+
</plugin>
50+
<plugin>
51+
<groupId>org.apache.maven.plugins</groupId>
52+
<artifactId>maven-assembly-plugin</artifactId>
53+
<version>3.6.0</version>
54+
<configuration>
55+
<descriptorRefs>
56+
<descriptorRef>jar-with-dependencies</descriptorRef>
57+
</descriptorRefs>
58+
</configuration>
59+
<executions>
60+
<execution>
61+
<id>make-assembly</id>
62+
<phase>package</phase>
63+
<goals>
64+
<goal>single</goal>
65+
</goals>
66+
</execution>
67+
</executions>
68+
</plugin>
69+
</plugins>
70+
</build>
71+
</project>

0 commit comments

Comments
 (0)