How to Use Apache Shiro and OAuth 2.0 to Build a Secure Application – DZone Java | xxxHow to Use Apache Shiro and OAuth 2.0 to Build a Secure Application – DZone Java – xxx
菜单






How to Use Apache Shiro and OAuth 2.0 to Build a Secure Application – DZone Java

六月 20, 2020 - MorningStar

Over a million developers have joined DZone.

  • How to Use Apache Shiro and OAuth 2.0 to Build a Secure Application - DZone Java

    {{node.title}}

    {{node.type}} · {{ node.urlSource.name }} by

    Download {{node.downloads}}

    • {{totalResults}} search results

{{announcement.body}}

{{announcement.title}}

Let’s be friends:

= 1024)” dc-slot=”ads.sl1.slot(articles[0], 0)” tags=”ads.sl1.tags(articles[0], 0)” size=”ads.sl1.size(articles[0], 0)” style=”border:0;”>
1 && !articles[0].partner.isSponsoringArticle && (width >= 1024)” dc-slot=”ads.sb2.slot(articles[0], 0)” tags=”ads.sb2.tags(articles[0], 0)” size=”ads.sb2.size(articles[0], 0)”>

How to Use Apache Shiro and OAuth 2.0 to Build a Secure Application

DZone ‘s Guide to

How to Use Apache Shiro and OAuth 2.0 to Build a Secure Application

This article demonstrates how to use Apache Shiro and OAuth 2.0 to create a secure Maven-based account with Okta.

Jul. 29, 20 · Java Zone ·

Free Resource

Join the DZone community and get the full member experience.

Join For Free

For those unfamiliar, Apache Shiro—a Java Security framework—performs authorization, authentication, and session management (along with many other functions) to help build more secure applications.

This post will show you how to use JAX-RS to build a simple Java REST application. JAX-RS is a set of interfaces so you’ll need to pick your implementation. In this post, we’ll be using Jersey—but you can use whatever implementation you prefer and none of these APIs are Jersey specific. 

In OAuth 2.0, REST services are usually resource servers. In simple terms, they authenticate using an access token sent in the Authorization HTTP header, formatted as Authorization: Bearer <access-token>.

For this tutorial you will need:

Create a New JAX-RS project

There are a few ways to create a new Maven-based project. I usually use my IDE, but you can also generate one on the command line. Whichever way you decide, start with a pom.xml file that looks like this:

XML

 

x

19

 

1

<?xml version="1.0" encoding="UTF-8"?>

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

3

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

4

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

5

    <modelVersion>4.0.0</modelVersion>

6

7

    <groupId>com.okta.example</groupId>

8

    <artifactId>okta-shiro-jaxrs-example</artifactId>

9

    <version>1.0-SNAPSHOT</version>

10

    <packaging>war</packaging>

11

<project xmlns="http://maven.apache.org/POM/4.0.0"

0

12

<project xmlns="http://maven.apache.org/POM/4.0.0"

1

13

<project xmlns="http://maven.apache.org/POM/4.0.0"

2

14

<project xmlns="http://maven.apache.org/POM/4.0.0"

3

15

<project xmlns="http://maven.apache.org/POM/4.0.0"

4

16

<project xmlns="http://maven.apache.org/POM/4.0.0"

5

17

<project xmlns="http://maven.apache.org/POM/4.0.0"

6

18

<project xmlns="http://maven.apache.org/POM/4.0.0"

7

19

<project xmlns="http://maven.apache.org/POM/4.0.0"

8

Next, add the dependencies:

Java

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

9

1

57

 

1

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

0

2

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

1

3

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

2

4

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

3

5

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

4

6

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

5

7

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

6

8

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

7

9

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

8

10

         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

9

11

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

0

12

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

1

13

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

2

14

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

3

15

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

4

16

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

5

17

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

6

18

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

7

19

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

8

20

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

9

21

    <modelVersion>4.0.0</modelVersion>

0

22

    <modelVersion>4.0.0</modelVersion>

1

23

    <modelVersion>4.0.0</modelVersion>

2

24

    <modelVersion>4.0.0</modelVersion>

3

25

    <modelVersion>4.0.0</modelVersion>

4

26

    <modelVersion>4.0.0</modelVersion>

5

27

    <modelVersion>4.0.0</modelVersion>

6

28

    <modelVersion>4.0.0</modelVersion>

7

29

    <modelVersion>4.0.0</modelVersion>

8

30

    <modelVersion>4.0.0</modelVersion>

9

31

0

32

1

33

2

34

3

35

4

36

5

37

6

38

7

39

8

40

9

41

    <groupId>com.okta.example</groupId>

0

42

    <groupId>com.okta.example</groupId>

1

43

    <groupId>com.okta.example</groupId>

2

44

    <groupId>com.okta.example</groupId>

3

45

    <groupId>com.okta.example</groupId>

4

46

    <groupId>com.okta.example</groupId>

5

47

    <groupId>com.okta.example</groupId>

6

48

    <groupId>com.okta.example</groupId>

7

49

    <groupId>com.okta.example</groupId>

8

50

    <groupId>com.okta.example</groupId>

9

51

    <artifactId>okta-shiro-jaxrs-example</artifactId>

0

52

    <artifactId>okta-shiro-jaxrs-example</artifactId>

1

53

    <artifactId>okta-shiro-jaxrs-example</artifactId>

2

54

    <artifactId>okta-shiro-jaxrs-example</artifactId>

3

55

    <artifactId>okta-shiro-jaxrs-example</artifactId>

4

56

    <artifactId>okta-shiro-jaxrs-example</artifactId>

5

57

    <artifactId>okta-shiro-jaxrs-example</artifactId>

6

To make running the WAR file easy, we can add the Jetty Maven Plugin to the pom file:

XML

 

    <artifactId>okta-shiro-jaxrs-example</artifactId>

7

1

14

 

1

    <artifactId>okta-shiro-jaxrs-example</artifactId>

8

2

    <artifactId>okta-shiro-jaxrs-example</artifactId>

9

3

    <version>1.0-SNAPSHOT</version>

0

4

    <version>1.0-SNAPSHOT</version>

1

5

    <version>1.0-SNAPSHOT</version>

2

6

    <version>1.0-SNAPSHOT</version>

3

7

    <version>1.0-SNAPSHOT</version>

4

8

    <version>1.0-SNAPSHOT</version>

5

9

    <version>1.0-SNAPSHOT</version>

6

10

    <version>1.0-SNAPSHOT</version>

7

11

    <version>1.0-SNAPSHOT</version>

8

12

    <version>1.0-SNAPSHOT</version>

9

13

    <packaging>war</packaging>

0

14

    <packaging>war</packaging>

1

Create a JAX-RS Endpoint

A JAX-RS application contains at least two parts: the REST resources/endpoints, to serve the requests, and the Application class to hold them all together. The resources are simply Java objects that have annotations mapping an HTTP request to a method.

Create a simple resource that displays the current user’s email address in src/main/java/com/okta/example/shiro/SecureEndpoint.java

Java

 

    <packaging>war</packaging>

2

1

20

 

1

    <packaging>war</packaging>

3

2

    <packaging>war</packaging>

4

3

    <packaging>war</packaging>

5

4

    <packaging>war</packaging>

6

5

    <packaging>war</packaging>

7

6

    <packaging>war</packaging>

8

7

    <packaging>war</packaging>

9

8

<project xmlns="http://maven.apache.org/POM/4.0.0"

00

9

<project xmlns="http://maven.apache.org/POM/4.0.0"

01

10

<project xmlns="http://maven.apache.org/POM/4.0.0"

02

11

<project xmlns="http://maven.apache.org/POM/4.0.0"

03

12

<project xmlns="http://maven.apache.org/POM/4.0.0"

04

13

<project xmlns="http://maven.apache.org/POM/4.0.0"

05

14

<project xmlns="http://maven.apache.org/POM/4.0.0"

06

15

<project xmlns="http://maven.apache.org/POM/4.0.0"

07

16

<project xmlns="http://maven.apache.org/POM/4.0.0"

08

17

<project xmlns="http://maven.apache.org/POM/4.0.0"

09

18

<project xmlns="http://maven.apache.org/POM/4.0.0"

10

19

<project xmlns="http://maven.apache.org/POM/4.0.0"

11

20

<project xmlns="http://maven.apache.org/POM/4.0.0"

12

  1. The base path for all methods in this class
  2. Keep things simple in this post and just return plain text
  3. This method will handle HTTP GET requestsRequire Authentication!
  4. Inject the current user’s security context
  5. Get the name from the Java Principal

If you need to get other information out of the access token, cast the user principal to an OktaJwtPrincipal and use the getClaim() method:

Java

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

13

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

14

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

15

Create a JAX-RS Application

A JAX-RS Application class defines the metadata and components associated with an application. Most JAX-RS implementations provide helper classes that scan your resources automatically but, because this example works with any implementation, you’ll configure them directly.

Create a class that extends from Application in src/main/java/com/okta/example/shiro/RestApplication.java:

Java

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

16

1

19

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

17

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

18

3

<project xmlns="http://maven.apache.org/POM/4.0.0"

19

4

<project xmlns="http://maven.apache.org/POM/4.0.0"

20

5

<project xmlns="http://maven.apache.org/POM/4.0.0"

21

6

<project xmlns="http://maven.apache.org/POM/4.0.0"

22

7

<project xmlns="http://maven.apache.org/POM/4.0.0"

23

8

<project xmlns="http://maven.apache.org/POM/4.0.0"

24

9

<project xmlns="http://maven.apache.org/POM/4.0.0"

25

10

<project xmlns="http://maven.apache.org/POM/4.0.0"

26

11

<project xmlns="http://maven.apache.org/POM/4.0.0"

27

12

<project xmlns="http://maven.apache.org/POM/4.0.0"

28

13

<project xmlns="http://maven.apache.org/POM/4.0.0"

29

14

<project xmlns="http://maven.apache.org/POM/4.0.0"

30

15

<project xmlns="http://maven.apache.org/POM/4.0.0"

31

16

<project xmlns="http://maven.apache.org/POM/4.0.0"

32

17

<project xmlns="http://maven.apache.org/POM/4.0.0"

33

18

<project xmlns="http://maven.apache.org/POM/4.0.0"

34

19

<project xmlns="http://maven.apache.org/POM/4.0.0"

35

  1. This application is mounted to /, all resource paths are relative to this one
  2. Register Apache Shiro’s JAX-RS feature
  3. Add the SecureResource we created in the previous step

Configure Apache Shiro to Use OAuth 2.0

Apache Shiro can be configured in a few different ways: programmatically, using dependency injection with Spring and Guice, or using an "ini" file. To keep things focused, I’ll use a simple shiro.ini file located in src/main/resources:

Java

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

36

1

10

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

37

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

38

3

<project xmlns="http://maven.apache.org/POM/4.0.0"

39

4

<project xmlns="http://maven.apache.org/POM/4.0.0"

40

5

<project xmlns="http://maven.apache.org/POM/4.0.0"

41

6

<project xmlns="http://maven.apache.org/POM/4.0.0"

42

7

<project xmlns="http://maven.apache.org/POM/4.0.0"

43

8

<project xmlns="http://maven.apache.org/POM/4.0.0"

44

9

<project xmlns="http://maven.apache.org/POM/4.0.0"

45

10

<project xmlns="http://maven.apache.org/POM/4.0.0"

46

If you have resources that require anonymous access, use authcBearer[permissive]—just make sure all of your endpoints are annotated correctly!

Add a web.xml

You might be asking yourself, "really, a web.xml file?" Technically you don’t need one—you could instead configure the Maven War Plugin to not require a web.xml.

Or, just add an empty web.xml to src/main/webapp:

XML

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

47

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

48

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

49

3

<project xmlns="http://maven.apache.org/POM/4.0.0"

50

4

<project xmlns="http://maven.apache.org/POM/4.0.0"

51

5

<project xmlns="http://maven.apache.org/POM/4.0.0"

52

6

<project xmlns="http://maven.apache.org/POM/4.0.0"

53

Run the Secure REST Application

You could build the project with ./mvnw package. Simply grab the war file from the target directory, copy it to your favorite container, and start it up. Instead, we’re going to use the Jetty Maven Plugin. From the project directory, run:

Shell

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

54

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

55

This command starts a server running on port 8000. Make a request using curl:

Shell

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

56

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

57

Java

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

58

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

59

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

60

3

<project xmlns="http://maven.apache.org/POM/4.0.0"

61

4

<project xmlns="http://maven.apache.org/POM/4.0.0"

62

5

<project xmlns="http://maven.apache.org/POM/4.0.0"

63

The server returned a 401 status code because we did not provide an access token. There are a few ways to get an access token; which option is right for you depends on where and how you access your REST application. Usually, the application that is invoking your REST API already has an access token. For example, a SPA mobile app, or another web app likely already has an authenticated user. For testing purposes, we will set up the OIDC Debugger.

Create an OAuth 2.0 Application

Login in to your Okta admin console. If you just created a new Okta account and have not logged in yet, follow the activation link in your inbox.

Make a note of the Org URL on the top right; I’ll refer to this as {yourOktaDomain} in the next section.

Once you are logged in, select Applications → Add Application from the top menu. Then, select Web → Next.

Give your application a name, something clever like: "Shiro JAX-RS Example."

Set the Login redirect URIs to https://oidcdebugger.com/debug

Check Implicit (Hybrid)

Click Done

How to Use Apache Shiro and OAuth 2.0 to Build a Secure Application - DZone JavaMake note of the Client ID, you will need this for the next step.

Get a Token with the OIDC Debugger

Head over to https://oidcdebugger.com/ and populate the form with the following values:

  • Authorize URI – {yourOktaDomain}/oauth2/default/v1/authorize

  • Client ID – {yourClientID} from the previous step

  • State – this is a test (this can be any value)

  • Response type – select token

  • Use defaults for all other fields

Press the Send Request button.

If you are using an incognito/private browser, this may prompt you to login again. Once the Success page loads, copy the Access token and create an environment variable:

Shell

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

64

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

65

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

66

Now that you have a token, you can make another request to your JAX-RS server:

Shell

 

<project xmlns="http://maven.apache.org/POM/4.0.0"

67

1

 

1

<project xmlns="http://maven.apache.org/POM/4.0.0"

68

2

<project xmlns="http://maven.apache.org/POM/4.0.0"

69

And just like that, you have made an authenticated request to your JAX-RS application!

Learn More About Secure Applications

In this tutorial, I’ve shown you how to secure a simple JAX-RS application with Apache Shiro and Okta. This same resource server technique can be used with other servlet based web applications too.

Check out these related blog posts to learn more about building secure web applications.

If you like this blog post and want to see more like it, follow @oktadev on Twitter, subscribe to our YouTube channel, or follow us on LinkedIn. As always, please leave a comment below if you have any questions.

Like This Article? Read More From DZone

Topics:
apache maven, apache shiro, java, jax rs, jersey, oauth 2

Published at DZone with permission of Brian Demers , DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

Java Partner Resources

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.linkDescription }}

{{ parent.urlSource.name }}

by

CORE

· {{ parent.articleDate | date:’MMM. dd, yyyy’ }} {{ parent.linkDate | date:’MMM. dd, yyyy’ }}








Notice: Undefined variable: canUpdate in /var/www/html/wordpress/wp-content/plugins/wp-autopost-pro/wp-autopost-function.php on line 51