Java EE Security and JSON Binding are two new APIs in the Java EE 8 release. The security API provides consistencies between containers with a simple annotation-driven model while JSON Binding completes Java EEs JSON APIs and is a real alternative to Jackson and Gson. In this presentation, I will walk through coding examples from both APIs and by the end of the presentation, you will understand how these two new APIs add to the advancement of the Java EE platform.

1. Java EE Security and JSON-Binding

2. Hi!
I AM ALEX THEEDOM
Java EE consultant/trainer
@alextheedom
ReadLearnCode.com

3. Java EE courses
Lynda.com - First month free
RESTful services with JAX-RS
WebSocket programming
Bean validation
JSON processing
CDI 2.0 and Design patterns and architecture

4. Java EE 8: Only What’s New
bit.ly/CodeEuropeConf
Special price $9.95
Includes:
JSON Binding 1.0
Security 1.0
Servlet 4.0
Bean Validation 2.0
CDI 2.0
JAX-RS 2.1
JSF 2.3
JSON Processing 1.1 and JPA 2.2.

5. Security 1.0 API
JSON Binding 1.0 API
Round Up
Q & A
1
2
3
4
1
2
3
4

6. Security 1.0 API
Consistent Security Approach
1

7. Security 1.0 API
Objective
◦ Simplify, standardise and modernise
◦ JACC, JASPIC and proprietary APIs
◦ Security EG to resolve issues

8. Security 1.0 API
Historical issues
• Inconsistent across containers
• Servlets provide
HttpServletRequest.isUserInRole(String role)
• EJBs provide
EJBContext.isCallerInRole(String roleName)
• Existing security mechanisms tricky
• Limited portable authentication
• No standard identity store management
• No support for custom authentication rules

9. Parallel thread
◦ Enable developers
◦ APIs for authentication, identity stores, roles and permissions across containers
◦ Java EE 8 Survey Final Results
◦ 11% security simplications
Source: https://blogs.oracle.com/theaquarium/java-ee-8-survey-final-results

10. Specification focus
◦ Relevant to cloud native applications
◦ An API for Web Authentication Mechanism
◦ A security context API
◦ An identity store API
◦ Simplify, standardise and modernise
◦ Web authentication has been modernised
◦ New security context API standardizes authentication
◦ Identity store abstraction to simplifies the use of identity stores.
@BasicAuthenticationMechanismDefinition
SecurityContext.getCallerPrincipal()
IdentityStore

11. Annotation driven authentication mechanism
◦ Simplified and standardised way to implement security
◦ HttpAuthenticationMechanism interface
◦ @BasicAuthenticationMechanismDefinition
◦ @FormAuthenticationMechanismDefinition
◦ @CustomFormAuthenticationMechanismDefinition
◦ Replicate Servlet 4 (section 13.6) authentication
◦ Developer can implement custom authentication

12. @BasicAuthenticationMechanismDefinition
◦ Triggers HTTP basic authentication (Servlet section 13.6.1)
◦ Optional realm name sent via the WWW-Authenticate header
@BasicAuthenticationMechanismDefinition(realmName = "user-realm")
@WebServlet("/user")
@DeclareRoles({"admin", "user", "demo"})
@ServletSecurity(@HttpConstraint(rolesAllowed = "user"))
public class UserServlet extends HttpServlet {
// Servlet Code
}

13. @FormAuthenticationMechanismDefinition
◦ Triggers form based authentication (Servlet section 13.6.3)
◦ loginToContinue option must be set
◦ Provides “login to continue” functionality
◦ useForwardToLogin = true/false
◦ useForwardToLoginExpression = "${appConfigs.forward}"
@FormAuthenticationMechanismDefinition(
loginToContinue = @LoginToContinue(
loginPage = "/login-servlet",
errorPage = "/login-servlet-fail"
)
)
@ApplicationScoped
public class ApplicationConfig {
// Config Code
}

14. @CustomFormAuthenticationMechanismDefinition
◦ provides options for configuring a custom login form
@CustomFormAuthenticationMechanismDefinition(
loginToContinue = @LoginToContinue(
loginPage = "/login.do"
errorPage = "/error.do"
)
)
Backing bean
<form jsf:id="form">
Username <input jsf:id="username" type="text" jsf:value="#{loginBean.username}"/>
Password <input jsf:id="password" type="password" jsf:value="#{loginBean.password}"/>
<input type="submit" value="Login" jsf:action="#{loginBean.login}"/>
</form>
@FacesConfig(version = JSF_2_3)
@Named
@RequestScoped
public class LoginBean {
public void login() {
// login logic
}
}
◦ Only option configured
Login JSF

15. Custom HttpAuthentictionMechanism
◦ Develop your own implementation
◦ Must be implemented as CDI bean with @ApplicationScope
◦ validateRequest() authenticates an HTTP request from a caller
◦ secureResponse() secures the HTTP response message
◦ cleanSubject() clears the subject of provided principals and credentials
◦ HttpServletRequest, HttpServletResponse, and
HttpMessageContext

16. Custom HttpAuthentictionMechanism
◦ Example implementation
@ApplicationScoped
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {
@Inject
private IdentityStoreHandler idStoreHandler;
@Override
public AuthenticationStatus validateRequest(
HttpServletRequest req,
HttpServletResponse res,
HttpMessageContext msg) {
String username = ...get username from HttpRequest...
String password = ...get password from HttpRequest...
CredentialValidationResult result = idStoreHandler.validate(
new UsernamePasswordCredential(username, password));
return msg.notifyContainerAboutLogin(result);
}
}

17. Remember Me Feature
◦ Class level @RememberMe annotation
@RememberMe(
cookieMaxAgeSeconds = 3600
)
◦ cookieMaxAgeSeconds: Life of the remember me cookie
◦ cookieMaxAgeSecondsExpression: EL version of cookieMaxAgeSeconds
◦ cookieSecureOnly: accessed cookie via secure means
◦ cookieSecureOnlyExpression: EL version of cookieSecureOnly
◦ cookieHttpOnly: sent with HTTP requests only
◦ cookieHttpOnlyExpression: EL version cookieHttpOnly
◦ cookieName: The cookie’s name
◦ isRememberMe: Switches “remember me” on or off
◦ isRememberMeExpression: EL version of isRememberMe

18. Identity store abstraction
◦ IdentityStore interacts with identity stores to retrieve group memberships
◦ Intended use with HttpAuthenticationMechanism implementations
◦ Containers are not tiered to the IdentityStore
◦ Instances of the IdentityStore are handled via the
IdentityStoreHandler
◦ validate() method invokes IdentityStore methods and aggregates
result
◦ Create your own identity store by implementing the IdentityStore
@Inject
private IdentityStoreHandler idStoreHandler;
public interface IdentityStoreHandler {
CredentialValidationResult validate(Credential credential);
}

19. Default identity store implementation
◦ Default implementation of IdentityStoreHandler should suffice
◦ Authenticate against multiple identity stores
◦ Aggregate result as a CredentialValidationResult

20. Built-in identity stores
◦ Comes with two built-in IdentityStore implementations for LDAP and
RDBMS

21. @DataBaseIdentityStoreDefinition
◦ RDBMS identity store configured by @DataBaseIdentityStoreDefinition
◦ Configurations are fairly self-explanatory, with 9 config options
◦ NOTE: priority specifies order in case of multiple identity stores
@DatabaseIdentityStoreDefinition(
dataSourceLookup = "${'java:global/permissions_db'}",
callerQuery = "#{'select password from caller where name = ?'}",
groupsQuery =
"select group_name from caller_groups where caller_name = ?",
hashAlgorithm = PasswordHash.class,
priority = 10
)
@ApplicationScoped
@Named
public class ApplicationConfig { }

22. @LdapIdentityStoreDefinition
◦ LDAP identity store configured by @LdapIdentityStoreDefinition
◦ Configurations are fairly self-explanatory, 24 config options
◦ NOTE: priority specifies order in case of multiple identity stores
@LdapIdentityStoreDefinition(
url = "ldap://localhost:33389/",
callerBaseDn = "ou=caller,dc=jsr375,dc=net",
groupSearchBase = "ou=group,dc=jsr375,dc=net" ,
priority = 20
)
@DeclareRoles({"admin", "user", "demo"})
@WebServlet("/admin")
public class AdminServlet extends HttpServlet { }

23. IdentityStore interface
◦ Custom identity store implement IdentityStore interface
◦ Four methods
◦ CredentialValidationResult validate(Credential)
◦ Set<String> getCallerGroups(CredentialValidationResult)
◦ Set<ValidationType> validationTypes() returns set of VALIDATE
and/or PROVIDE_GROUPS
◦ int priority()
◦ All methods have default implementations

24. Multiple identity store interface
◦ Multiple IdentityStore implementations are handled by
the IdentityStoreHandler
◦ Identity stores called in accordance with declared capabilities and priority
◦ Two phase interation: 1st validates user 2nd gather group membership
◦ Caller validated by one IdentityStore and group membership list built from
another
1st iteration 2nd iteration

25. Security Context
◦ Consistent approach to security across the servlet and EJB containers
◦ Entry point for programmatic security and is injectable
◦ getCallerPrincipal() container-specific principal
◦ getPrincipalsByType() returns all Principals of the specified type
◦ isCallerInRole() determines if the caller is included in the role
◦ hasAccessToWebResource() determines caller access to the given recourse
◦ authenticate() triggers start/continuation of HTTP authentication with
caller. Requires valid servlet context

26. Security Context
boolean role = securityContext.isCallerInRole("admin");
name = securityContext.getCallerPrincipal().getName();
Set<CustomPrincipal> customPrincipals =
securityContext.getPrincipalsByType(CustomPrincipal.class);
for (CustomPrincipal customPrincipal : customPrincipals) {
response.getWriter().write((customPrincipal.getName()));
}
@Inject
private SecurityContext securityContext;
◦ Inject the SecuirtyContext
◦ Test user’s role membership
◦ Retrieve the caller principle
◦ Retrieve all CustomPrinciple

27. Security Context
@DeclareRoles({"admin", "user", "demo"})
@WebServlet("/hasAccessServlet")
public class HasAccessServlet extends HttpServlet {
@Inject
private SecurityContext securityContext;
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException {
boolean hasAccess =
securityContext.hasAccessToWebResource("/secretServlet", "GET");
if (hasAccess) {
req.getRequestDispatcher("/secretServlet").forward(req, res);
} else {
req.getRequestDispatcher("/logout").forward(req, res);
}
}
}

28. Security Context
@FacesConfig(version = JSF_2_3)
@Named
@RequestScoped
public class LoginBean {
@Inject private SecurityContext securityContext;
@Inject private FacesContext facesContext;
private String username, password;
public void login() {
Credential credential = new UsernamePasswordCredential(username, new Password(password));
AuthenticationStatus status = securityContext.authenticate(
getRequestFrom(facesContext),
getResponseFrom(facesContext),
withParams().credential(credential));
if (status.equals(SEND_CONTINUE)) {
facesContext.responseComplete();
} else if (status.equals(SEND_FAILURE)) {
addError(facesContext, "Authentication failed");
}
}

29. JSON Binding API
JSON serialiser and deserialiser
2

30. JSON Binding 1.0
JSON Binding (JSON-B) 1.0
◦ Strengthens JSON support
◦ Codifies industry practice
◦ Reasonable defaults and customisations
◦ Adapters and de/serializers
◦ Compile-time annotations
◦ Runtime configuration builder

31. JSON Binding 1.0
Headline Features
◦ Binding support
◦ Two entry interfaces
◦ Jsonb
◦ JsonbBuilder

32. JSON serialiser and deserialiser
◦ Instance of Jsonb jsonb = JsonbBuilder.create()
◦ toJson() pass it the Java instance
Book book = new Book("SHDUJ-4532", "Fun with Java", "Alex Theedom");
String bookJson = JsonbBuilder.create().toJson(book);
◦ fromJson() pass it the JSON doc and Java class
String json = "{"author":"Alex Theedom"," +
""id":"SHDUJ-4532"," +
""title":"Fun with Java"}";
Book book = JsonbBuilder.create().fromJson(json, Book.class);

33. JSON Binding customisation
◦ Default mapping for simple scenarios
◦ Annotation model
◦ Runtime configuration
◦ Advanced customisation
◦ Adapters and custom serializers/deserializers
@JsonbNumberFormat("#0.00")
private Float price;
JsonbBuilder.create(new JsonbConfig().withNullValues(true));

34. JSON Binding customisation
◦ Annotation model
◦ Runtime configuration
@JsonbNillable
@JsonbPropertyOrder(PropertyOrderStrategy.REVERSE)
public class Book {
@JsonbProperty("cost")
@JsonbNumberFormat("#0.00")
private Float price;
}
JsonbConfig jsonbConfig = new JsonbConfig()
.withPropertyNamingStrategy(
PropertyNamingStrategy.LOWER_CASE_WITH_DASHES)
.withNullValues(true)
.withFormatting(true);
Jsonb jsonb = JsonbBuilder.create(jsonbConfig);

35. Customize object creation
◦ No argument public constructors
public class Magazine {
private String title;
private Author authorName;
@JsonbCreator
public Magazine(@JsonbProperty("bookTitle") String title,
@JsonbProperty("firstName") String firstName,
@JsonbProperty("surname") String lastName) {
this.title = title;
this.authorName = new Author(firstName, lastName);
}
}
{
"firstName": "Alex",
"surname": "Theedom",
"bookTitle": "Fun with JSON-B"
}

36. JSON Binding adapters
◦ Custom object creation with JsonbAdapter
public class BookletAdapter implements JsonbAdapter<Booklet, JsonObject> {
@Override
public JsonObject adaptToJson(Booklet booklet) {
return Json.createObjectBuilder()
.add("title", booklet.getTitle())
.add("firstName", booklet.getAuthor().getFirstName())
.add("lastName", booklet.getAuthor().getLastName())
.build();
}
@Override
public Booklet adaptFromJson(JsonObject json) {
Booklet booklet = new Booklet(json.getString("title"),
new Author(json.getString("firstName"),
json.getString("lastName")));
return booklet;
}
}
JsonbConfig config = new JsonbConfig()
.withAdapters(new BookletAdapter());

37. JSON Binding adapters
◦ Mark with @JsonbTypeAdapter
public class Author {
@JsonbTypeAdapter(FirstNameAdapter.class)
private String firstName;
}
public class FirstNameAdapter implements JsonbAdapter<String, JsonValue> {
@Override
public JsonValue adaptToJson(String fullName) {
return Json.createValue(fullName.subSequence(0, 1).toString());
}
@Override
public String adaptFromJson(JsonValue json) {
return json.toString();
}
}

38. JSON Binding custom serializers and deserializers
◦ Lowest level of customisation
public class BookSerializer implements JsonbSerializer<Book> {
@Override
public void serialize(Book book,
JsonGenerator generator, SerializationContext ctx) {
generator.writeStartObject();
generator.write("id", "QWE-123-RTS");
generator.write("title", book.getTitle());
generator.write("firstName", book.getAuthor().split(" ")[0]);
generator.write("lastName", book.getAuthor().split(" ")[1]);
generator.writeEnd();
}
}

39. JSON Binding custom serializers and deserializers
public class BookDeserializer implements JsonbDeserializer<String> {
@Override
public String deserialize(JsonParser parser,
DeserializationContext ctx, Type rtType) {
while (parser.hasNext()) {
JsonParser.Event event = parser.next();
if (event == JsonParser.Event.KEY_NAME) {
String keyName = parser.getString();
if (keyName.equals("id")) {
return ctx.deserialize(String.class, parser);
}
}
parser.next();
}
return "";
}
}
JsonbConfig config = new JsonbConfig()
.withDeserializers(new BookDeserializer())
.withSerializers(new BookSerializer());
@JsonbTypeDeserializer(BookDeserializer.class)
public class Booklet{}

40. Round-up3

41. Round-up
◦ Security has a consistence approach
◦ Highly customisable with sensible defaults
◦ Developer is empowered
◦ JSON Processing is now up to date
◦ JSON-B’s standardizes the transformation of Java and JSON
◦ Two customisation models with advanced customisation

42. Questions and Answers4
Presentation template by SlidesCarnival

43. Java EE 8: Only What’s New
bit.ly/CodeEuropeConf
Special price $9.95
Includes:
JSON Binding 1.0
Security 1.0
Servlet 4.0
Bean Validation 2.0
CDI 2.0
JAX-RS 2.1
JSF 2.3
JSON Processing 1.1 and JPA 2.2.