72 lines
4.7 KiB
Text
Executable file
72 lines
4.7 KiB
Text
Executable file
|
|
[[_fuse_adapter]]
|
|
=== JBoss Fuse Adapter
|
|
|
|
NOTE: JBoss Fuse is a Technology Preview feature and is not fully supported
|
|
|
|
Currently {{book.project.name}} supports securing your web applications running inside http://www.jboss.org/products/fuse/overview/[JBoss Fuse] .
|
|
It leverages <<fake/../jetty8-adapter.adoc#_jetty8_adapter,Jetty 8 adapter>> as both JBoss Fuse 6.2 are bundled with http://eclipse.org/jetty/[Jetty 8.1 server]
|
|
under the covers and Jetty is used for running various kinds of web applications.
|
|
|
|
What is supported for Fuse is:
|
|
|
|
* Security for classic WAR applications deployed on Fuse with https://ops4j1.jira.com/wiki/display/ops4j/Pax+Web+Extender+-+War[Pax Web War Extender].
|
|
* Security for servlets deployed on Fuse as OSGI services with https://ops4j1.jira.com/wiki/display/ops4j/Pax+Web+Extender+-+Whiteboard[Pax Web Whiteboard Extender].
|
|
* Security for http://camel.apache.org/[Apache Camel] Jetty endpoints running with http://camel.apache.org/jetty.html[Camel Jetty] component.
|
|
* Security for http://cxf.apache.org/[Apache CXF] endpoints running on their own separate http://cxf.apache.org/docs/jetty-configuration.html[Jetty engine].
|
|
* Security for http://cxf.apache.org/[Apache CXF] endpoints running on default engine provided by CXF servlet.
|
|
* Security for SSH and JMX admin access.
|
|
|
|
==== How to secure your web applications inside Fuse
|
|
|
|
Basically all mentioned web applications require to inject {{book.project.name}} Jetty authenticator into underlying Jetty server . The steps to achieve it are bit different
|
|
according to application type. The details are described in individual sub-chapters.
|
|
|
|
<<<<<<< HEAD
|
|
===== Builtin CXF web applications
|
|
|
|
Some services automatically come with deployed servlets on startup. One of such examples is CXF servlet running on
|
|
http://localhost:8181/cxf context. Securing such endpoints is quite tricky. The approach, which Keycloak is currently using,
|
|
is providing ServletReregistrationService, which undeploys builtin servlet at startup, so you are able to re-deploy it again on context secured by Keycloak.
|
|
You can see the `OSGI-INF/blueprint/blueprint.xml` inside `cxf-jaxrs` example, which adds JAX-RS `customerservice` endpoint and more importantly, it secures whole `/cxf` context.
|
|
|
|
As a side effect, all other CXF services running on default CXF HTTP destination will be secured too. Once you uninstall feature `keycloak-fuse-6.2-example`, the
|
|
original unsecured servlet on `/cxf` context is deployed back and hence context will become unsecured again.
|
|
|
|
It's recommended to use your own Jetty engine for your apps (similarly like `cxf-jaxws` application is doing).
|
|
|
|
|
|
==== How to secure Fuse admin services
|
|
|
|
===== SSH authentication to Fuse terminal with Keycloak credentials
|
|
|
|
Keycloak mainly addresses usecases for authentication of web applications, however if your admin services (like fuse admin console) are protected
|
|
with Keycloak, it may be good to protect non-web services like SSH with Keycloak credentials too. It's possible to do it by using JAAS login module, which
|
|
allows to remotely connect to Keycloak and verify credentials based on
|
|
|
|
// <<_direct_access_grants,Direct Access Grants>> .
|
|
|
|
Example steps for enable SSH authentication require changing the configuration of `sshRealm` in `$FUSE_HOME/etc/org.apache.karaf.shell.cfg`, then adding
|
|
file `$FUSE_HOME/etc/keycloak-direct-access.json` (this is default location, which can be changed) and install the needed feature `keycloak-jaas`. It's described in details
|
|
in the README file of Fuse example, which in example distribution is inside `fuse/fuse-admin/README.md` .
|
|
|
|
|
|
===== JMX authentication with Keycloak credentials
|
|
|
|
This may be needed in case if you really want to use jconsole or other external tool to perform remote connection to JMX through RMI. Otherwise it may
|
|
be better to use just hawt.io/jolokia as jolokia agent is installed in http://hawt.io by default.
|
|
|
|
You need to configure `jmxRealm` in `$FUSE_HOME/etc/org.apache.karaf.management.cfg`, then adding file `$FUSE_HOME/etc/keycloak-direct-access.json`
|
|
(this is default location, which can be changed) and install the needed feature `keycloak-jaas`.
|
|
It's described in details in the README file of Fuse example, which in example distribution is inside `fuse/fuse-admin/README.md` .
|
|
|
|
|
|
===== Secure Fuse admin console
|
|
|
|
Fuse admin console is Hawt.io. See http://hawt.io/configuration/index.html[Hawt.io documentation] for more info about how to secure it with Keycloak.
|
|
=======
|
|
{% if book.community %}
|
|
The best place to start is look at Fuse demo bundled as part of {{book.project.name}} examples in directory `fuse` . Most of the steps should be understandable from testing and
|
|
understanding the demo.
|
|
{% endif %}
|
|
>>>>>>> 163974a212546af0df02970a57466a056b83ba5a
|