- Wicket Security Wasp & Swarm is a framework for adding authentication and authorization to Wicket applications. It provides flexible security models and permission checking. - Swarm builds on Wasp and provides standard authentication and role-based access control. It uses a HiveMind-based policy system for defining permissions. - The document provides examples of setting up a basic secure Wicket application using Swarm, defining principals and policies, and implementing authentication and authorization checks.

1. Wicket Security Wasp & Swarm

2. Introduction Maurice Marrink Topicus Core Healthcare Education Finance Using Wicket since 2004

3. History Wasp Swarm Examples Simple setup Custom actions Secure models Questions? Agenda

4. History

5. Pre Wicket: Jaas 2004 Wicket POC authentication only 2005 Custom Wicket for authorization 2006 Wicket: IAuthorizationStrategy 2006 Wicket-Jaas internal project 2007 Wasp and Swarm

6. WASP

7. Wicket Abstract Security Platform Action based Authentication and Authorization Flexible base Support classes Java 1.4 Wicket 1.3

8. 1 Permission for instantiation or authorization? 2a Authorization permission? 3a Authenticated and or authorized? 3b Custom security checks. 3c Check model. 2b Authorization permission? 4a Authenticated and or authorized? 4b Custom security checks. 3c Wicket Wasp strategy ISecurity Check ISecureModel Security implemen-tation Custom security check 1 2a 2b 3a 3b 4a 4b

9. Implement ISecurePage Instantiation + login redirect Add ISecurityCheck Or add ISecureModel Or use an ISecureComponent Authorization and or Authentication

10. SWARM

11. Standard Wicket Authentication and Rights Management Based on Wasp ACL based Session scope Easy to use with dynamic roles Jaas like security implementation Subjects Principals Permissions Actions Policy files

12. grant principal nl.example.Principal "basic" { permission ${ComponentPermission} "${myPackage}.SomePage", "inherit, render"; };

13. Simple setup Example

14. Extend SwarmWebApplication Create Principal(s) Write policy files

15. public class App extends SwarmWebApplication { public Class<HomePage> getHomePage(){ return HomePage.class; } public Class<LoginPage> getLoginPage(){ return LoginPage.class; } protected Object getHiveKey(){ return getServletContext().getContextPath(); } …

16. protected void setUpHive(){ PolicyFileHiveFactory factory = new PolicyFileHiveFactory(); factory.setAlias(&quot;package&quot;, &quot;nl.example&quot;); try{ factory.addPolicyFile(getServletContext() .getResource(&quot;/WEB-INF/beheer.hive&quot;)); } ... HiveMind. registerHive(getHiveKey(), factory); }

17. public class MyPrincipal implements Principal{ private String name; public MyPrincipal(String name){ this.name = name; } public String getName(){ return name; } public boolean implies(Subject subject){ return false; } … }

18. Design your Pages Implement ISecurePage Add security checks Or add secure models Or use secure component

21. grant principal ${package}.MyPrincipal &quot;instelling.deelnemers&quot; { permission ${ComponentPermission} &quot;${package}.SearchPage&quot;, &quot;inherit, render&quot;; permission ${ComponentPermission} &quot;${package}.SearchPage&quot;, &quot;enable&quot;; permission ${ComponentPermission} &quot;${package}.detailPage&quot;, &quot;inherit, render&quot;; permission ${ComponentPermission} &quot;${package}.detailPage&quot;, &quot;enable&quot;; };

22. Design login page Extend LoginContext Populate Subject with Principals

23. Wicket Security Example: Simple setup

24. public boolean signIn(String username, String password, Domain domain){ LoginContext ctx = new MyLoginContext(username, password, domain); try{ ((WaspSession)Session.get()).login(ctx); return true; } catch (LoginException e){ error(e.getMessage()); } return false; }

25. public Subject login() throws LoginException{ Account accnt = authenticate(username, password, domain); if (accnt != null){ clearFields(); return new MySubject(accnt); } clearFields(); throw new LoginException(“...”); }

26. public class MySubject extends DefaultSubject{ public MySubject(Account account){ for (Role role : account.getRoles()){ for (MyPrincipal principal: role.getPrincipals()) addPrincipal(principal); } setReadOnly(); } }

27. Custom actions Example

28. Should Divide authorization in levels Direct logic of custom security checks Should not Roles User groups

29. 1 Component and render or enable action 2a Same 3a Custom actions? Wicket Wasp strategy ISecurity Check Security implemen-tation 1 2a 3a

30. Create Actions Register Actions Use Actions in security check or secure model

32. register(Teacher.class, “teacher&quot;); register(Counselor.class, “counselor&quot;); register(Location.class, new SomeAction( “ location“, Teacher.class, Counselor.class)); register(School.class, new SomeAction( “ school“, Location.class)); public interface School extends WaspAction { // no explicit implementation required }

33. public boolean isActionAuthorized(WaspAction action){ WaspAction combined = null, additional; ActionFactory factory = getActionFactory(); for (Class< ? extends WaspAction> actionClass : actions){ additional = factory.getAction(actionClass); combined = action.add(additional); if (wrapped.isActionAuthorized(combined)) return verify(additional); } return false; } protected abstract boolean verify(WaspAction action);

34. protected boolean verify(WaspAction action){ if (action.implies(getAction(School.class))) return student.getSchool() .equals(getUser().getSchool()); if (action.implies(getAction(Location.class))) return student.takesClassesAt(getUser() .getLocations()); if(…….) ……… . return false; }

35. Secure models Example

36. Can In ListViews and other Repeaters In DropDownChoices Reuse of security without declaring it on every Component Can NOT As instantiation check

38. public interface ISecureModel extends IModel { public boolean isAuthorized(Component c, WaspAction a); public boolean isAuthenticated(Component c); } public interface SwarmModel extends ISecureModel { public String getSecurityId(Component c); }

39. Implement SwarmModel Add DataPermission to policy file

40. public final String getSecurityId(Component component){ return “foo”; } public boolean isAuthenticated(Component component){ return getStrategy().isModelAuthenticated(this, component); } public boolean isAuthorized(Component component, WaspAction action){ return getStrategy().isModelAuthorized(this, component, action); } protected List<Location> load(){ if (isAuthorized(null, getAction(Instelling.class))){ … } else if (isAuthorized(null, getAction(OrganisatieEenheid.class))){ … } }

41. grant principal ${package}.MyPrincipal “something&quot; { permission ${DataPermission} “foo”, &quot;render, school&quot;; };

42. More information: http://wicketstuff.org/confluence/display/STUFFWIKI/Wicket-Security Questions?