<!DOCTYPE html>
<html lang="en">

<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Apache TomEE</title>
	<meta name="description"
		  content="Apache TomEE is a lightweight, yet powerful, JavaEE Application server with feature rich tooling." />
	<meta name="keywords" content="tomee,asf,apache,javaee,jee,shade,embedded,test,junit,applicationcomposer,maven,arquillian" />
	<meta name="author" content="Luka Cvetinovic for Codrops" />
	<link rel="icon" href="../../favicon.ico">
	<link rel="icon"  type="image/png" href="../../favicon.png">
	<meta name="msapplication-TileColor" content="#80287a">
	<meta name="theme-color" content="#80287a">
	<link rel="stylesheet" type="text/css" href="../../css/normalize.css">
	<link rel="stylesheet" type="text/css" href="../../css/bootstrap.css">
	<link rel="stylesheet" type="text/css" href="../../css/owl.css">
	<link rel="stylesheet" type="text/css" href="../../css/animate.css">
	<link rel="stylesheet" type="text/css" href="../../fonts/font-awesome-4.1.0/css/font-awesome.min.css">
	<link rel="stylesheet" type="text/css" href="../../fonts/eleganticons/et-icons.css">
	<link rel="stylesheet" type="text/css" href="../../css/jqtree.css">
	<link rel="stylesheet" type="text/css" href="../../css/idea.css">
	<link rel="stylesheet" type="text/css" href="../../css/cardio.css">

	<script type="text/javascript">
		<!-- Matomo -->
		var _paq = window._paq = window._paq || [];
		/* tracker methods like "setCustomDimension" should be called before "trackPageView" */
		/* We explicitly disable cookie tracking to avoid privacy issues */
		_paq.push(['disableCookies']);
		_paq.push(['trackPageView']);
		_paq.push(['enableLinkTracking']);
		(function () {
			var u = "//matomo.privacy.apache.org/";
			_paq.push(['setTrackerUrl', u + 'matomo.php']);
			_paq.push(['setSiteId', '5']);
			var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0];
			g.async = true;
			g.src = u + 'matomo.js';
			s.parentNode.insertBefore(g, s);
		})();
		<!-- End Matomo Code -->
    </script>
</head>

<body>
    <div class="preloader">
		<img src="../../img/loader.gif" alt="Preloader image">
	</div>
	    <nav class="navbar">
		<div class="container">
		  <div class="row">          <div class="col-md-12">

			<!-- Brand and toggle get grouped for better mobile display -->
			<div class="navbar-header">
				<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1">
					<span class="sr-only">Toggle navigation</span>
					<span class="icon-bar"></span>
					<span class="icon-bar"></span>
					<span class="icon-bar"></span>
				</button>
				<a class="navbar-brand" href="/" title="Apache TomEE">
				    <span>

				    
                        <img 
							src="../../img/apache_tomee-logo.svg"
							onerror="this.src='../../img/apache_tomee-logo.jpg'"
							height="50"
							>
                    

                    </span>
                </a>
			</div>
			<!-- Collect the nav links, forms, and other content for toggling -->
			<div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
				<ul class="nav navbar-nav navbar-right main-nav">
					<li><a href="../../docs.html">Documentation</a></li>
					<li><a href="../../community/index.html">Community</a></li>
					<li><a href="../../security/security.html">Security</a></li>
					<li><a class="btn btn-accent accent-orange no-shadow" href="../../download.html">Downloads</a></li>
				</ul>
			</div>
			<!-- /.navbar-collapse -->
		   </div></div>
		</div>
		<!-- /.container-fluid -->
	</nav>


    <div id="main-block" class="container main-block">
        <div class="row title">
          <div class="col-md-12">
            <div class='page-header'>
              
              <h1>Testing Security 3</h1>
            </div>
          </div>
        </div>
        <div class="row">
            
            <div class="col-md-12">
                <div id="preamble">
<div class="sectionbody">
<div class="paragraph">
<p>Theses is a simple example to show how to use the login possibilities. We show what is the result behaviors from login fail, success and errors.</p>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_movie">Movie</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">package org.superbiz.injection.secure;

import javax.persistence.Entity;

@Entity
public class Movie {

    private String director;
    private String title;
    private int year;

    public Movie() {
    }

    public Movie(String director, String title, int year) {
        this.director = director;
        this.title = title;
        this.year = year;
    }

    public String getDirector() {
        return director;
    }

    public void setDirector(String director) {
        this.director = director;
    }

    public String getTitle() {
        return title;
    }

    public void setTitle(String title) {
        this.title = title;
    }

    public int getYear() {
        return year;
    }

    public void setYear(int year) {
        this.year = year;
    }

}</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_movies">Movies</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">package org.superbiz.injection.secure;

//START SNIPPET: code

import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.ejb.Stateful;
import javax.ejb.TransactionAttribute;
import javax.ejb.TransactionAttributeType;
import javax.persistence.EntityManager;
import javax.persistence.PersistenceContext;
import javax.persistence.PersistenceContextType;
import javax.persistence.Query;
import java.util.List;

@Stateful
public class Movies {

    @PersistenceContext(unitName = "movie-unit", type = PersistenceContextType.EXTENDED)
    private EntityManager entityManager;

    @RolesAllowed({"Employee", "Manager"})
    public void addMovie(Movie movie) throws Exception {
        entityManager.persist(movie);
    }

    @RolesAllowed({"Manager"})
    public void deleteMovie(Movie movie) throws Exception {
        entityManager.remove(movie);
    }

    @PermitAll
    @TransactionAttribute(TransactionAttributeType.SUPPORTS)
    public List&lt;Movie&gt; getMovies() throws Exception {
        Query query = entityManager.createQuery("SELECT m from Movie as m");
        return query.getResultList();
    }
}</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_myloginprovider">MyLoginProvider</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">package org.superbiz.injection.secure;

import org.apache.openejb.core.security.jaas.LoginProvider;

import javax.security.auth.login.FailedLoginException;
import java.util.Arrays;
import java.util.List;

public class MyLoginProvider implements LoginProvider {


    @Override
    public List&lt;String&gt; authenticate(String user, String password) throws FailedLoginException {
        if ("paul".equals(user) &amp;&amp; "michelle".equals(password)) {
            return Arrays.asList("Manager", "rockstar", "beatle");
        }

        if ("eddie".equals(user) &amp;&amp; "jump".equals(password)) {
            return Arrays.asList("Employee", "rockstar", "vanhalen");
        }

        throw new FailedLoginException("Bad user or password!");
    }
}</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_org_apache_openejb_core_security_jaas_loginprovider">org.apache.openejb.core.security.jaas.LoginProvider</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">org.superbiz.injection.secure.MyLoginProvider</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_persistence_xml">persistence.xml</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-xml" data-lang="xml">&lt;persistence xmlns="http://java.sun.com/xml/ns/persistence" version="1.0"&gt;

  &lt;persistence-unit name="movie-unit"&gt;
    &lt;jta-data-source&gt;movieDatabase&lt;/jta-data-source&gt;
    &lt;non-jta-data-source&gt;movieDatabaseUnmanaged&lt;/non-jta-data-source&gt;
    &lt;class&gt;org.superbiz.injection.secure.Movie&lt;/class&gt;

    &lt;properties&gt;
      &lt;property name="openjpa.jdbc.SynchronizeMappings" value="buildSchema(ForeignKeys=true)"/&gt;
    &lt;/properties&gt;
  &lt;/persistence-unit&gt;
&lt;/persistence&gt;</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_movietest">MovieTest</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">package org.superbiz.injection.secure;

import junit.framework.TestCase;

import javax.ejb.EJB;
import javax.ejb.EJBAccessException;
import javax.ejb.embeddable.EJBContainer;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import java.util.List;
import java.util.Properties;

public class MovieTest extends TestCase {

    @EJB
    private Movies movies;

    private Context getContext(String user, String pass) throws NamingException {
        Properties p = new Properties();
        p.put(Context.INITIAL_CONTEXT_FACTORY, "org.apache.openejb.core.LocalInitialContextFactory");
        p.setProperty("openejb.authentication.realmName", "ServiceProviderLogin");
        p.put(Context.SECURITY_PRINCIPAL, user);
        p.put(Context.SECURITY_CREDENTIALS, pass);

        return new InitialContext(p);
    }

    protected void setUp() throws Exception {
        Properties p = new Properties();
        p.put("movieDatabase", "new://Resource?type=DataSource");
        p.put("movieDatabase.JdbcDriver", "org.hsqldb.jdbcDriver");
        p.put("movieDatabase.JdbcUrl", "jdbc:hsqldb:mem:moviedb");

        EJBContainer.createEJBContainer(p).getContext().bind("inject", this);
    }

    public void testAsManager() throws Exception {
        final Context context = getContext("paul", "michelle");

        try {
            movies.addMovie(new Movie("Quentin Tarantino", "Reservoir Dogs", 1992));
            movies.addMovie(new Movie("Joel Coen", "Fargo", 1996));
            movies.addMovie(new Movie("Joel Coen", "The Big Lebowski", 1998));

            List&lt;Movie&gt; list = movies.getMovies();
            assertEquals("List.size()", 3, list.size());

            for (Movie movie : list) {
                movies.deleteMovie(movie);
            }

            assertEquals("Movies.getMovies()", 0, movies.getMovies().size());
        } finally {
            context.close();
        }
    }

    public void testAsEmployee() throws Exception {
        final Context context = getContext("eddie", "jump");

        try {
            movies.addMovie(new Movie("Quentin Tarantino", "Reservoir Dogs", 1992));
            movies.addMovie(new Movie("Joel Coen", "Fargo", 1996));
            movies.addMovie(new Movie("Joel Coen", "The Big Lebowski", 1998));

            List&lt;Movie&gt; list = movies.getMovies();
            assertEquals("List.size()", 3, list.size());

            for (Movie movie : list) {
                try {
                    movies.deleteMovie(movie);
                    fail("Employees should not be allowed to delete");
                } catch (EJBAccessException e) {
                    // Good, Employees cannot delete things
                }
            }

            // The list should still be three movies long
            assertEquals("Movies.getMovies()", 3, movies.getMovies().size());
        } finally {
            context.close();
        }
    }

    public void testUnauthenticated() throws Exception {
        try {
            movies.addMovie(new Movie("Quentin Tarantino", "Reservoir Dogs", 1992));
            fail("Unauthenticated users should not be able to add movies");
        } catch (EJBAccessException e) {
            // Good, guests cannot add things
        }

        try {
            movies.deleteMovie(null);
            fail("Unauthenticated users should not be allowed to delete");
        } catch (EJBAccessException e) {
            // Good, Unauthenticated users cannot delete things
        }

        try {
            // Read access should be allowed

            List&lt;Movie&gt; list = movies.getMovies();

        } catch (EJBAccessException e) {
            fail("Read access should be allowed");
        }

    }

    public void testLoginFailure() throws NamingException {
        try {
            getContext("eddie", "panama");
            fail("supposed to have a login failure here");
        } catch (javax.naming.AuthenticationException e) {
            //expected
        }

        try {
            getContext("jimmy", "foxylady");
            fail("supposed to have a login failure here");
        } catch (javax.naming.AuthenticationException e) {
            //expected
        }
    }
}</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_running">Running</h2>
<div class="sectionbody">
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-console" data-lang="console">-------------------------------------------------------
 T E S T S
-------------------------------------------------------
Running org.superbiz.injection.secure.MovieTest
INFO - ********************************************************************************
INFO - OpenEJB http://tomee.apache.org/
INFO - Startup: Fri Jul 20 08:42:53 EDT 2012
INFO - Copyright 1999-2012 (C) Apache OpenEJB Project, All Rights Reserved.
INFO - Version: 4.1.0
INFO - Build date: 20120720
INFO - Build time: 08:33
INFO - ********************************************************************************
INFO - openejb.home = /home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3
INFO - openejb.base = /home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3
INFO - Created new singletonService org.apache.openejb.cdi.ThreadSingletonServiceImpl@38ee6681
INFO - Succeeded in installing singleton service
INFO - Using 'javax.ejb.embeddable.EJBContainer=true'
INFO - Cannot find the configuration file [conf/openejb.xml].  Will attempt to create one for the beans deployed.
INFO - Configuring Service(id=Default Security Service, type=SecurityService, provider-id=Default Security Service)
INFO - Configuring Service(id=Default Transaction Manager, type=TransactionManager, provider-id=Default Transaction Manager)
INFO - Configuring Service(id=movieDatabase, type=Resource, provider-id=Default JDBC Database)
INFO - Creating TransactionManager(id=Default Transaction Manager)
INFO - Creating SecurityService(id=Default Security Service)
INFO - Creating Resource(id=movieDatabase)
INFO - Beginning load: /home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3/target/classes
INFO - Configuring enterprise application: /home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3
INFO - Auto-deploying ejb Movies: EjbDeployment(deployment-id=Movies)
INFO - Configuring Service(id=Default Stateful Container, type=Container, provider-id=Default Stateful Container)
INFO - Auto-creating a container for bean Movies: Container(type=STATEFUL, id=Default Stateful Container)
INFO - Creating Container(id=Default Stateful Container)
INFO - Using directory /tmp for stateful session passivation
INFO - Configuring Service(id=Default Managed Container, type=Container, provider-id=Default Managed Container)
INFO - Auto-creating a container for bean org.superbiz.injection.secure.MovieTest: Container(type=MANAGED, id=Default Managed Container)
INFO - Creating Container(id=Default Managed Container)
INFO - Using directory /tmp for stateful session passivation
INFO - Configuring PersistenceUnit(name=movie-unit)
INFO - Auto-creating a Resource with id 'movieDatabaseNonJta' of type 'DataSource for 'movie-unit'.
INFO - Configuring Service(id=movieDatabaseNonJta, type=Resource, provider-id=movieDatabase)
INFO - Creating Resource(id=movieDatabaseNonJta)
INFO - Adjusting PersistenceUnit movie-unit &lt;non-jta-data-source&gt; to Resource ID 'movieDatabaseNonJta' from 'movieDatabaseUnmanaged'
INFO - Enterprise application "/home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3" loaded.
INFO - Assembling app: /home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3
SEVERE - JAVA AGENT NOT INSTALLED. The JPA Persistence Provider requested installation of a ClassFileTransformer which requires a JavaAgent.  See http://tomee.apache.org/3.0/javaagent.html
INFO - PersistenceUnit(name=movie-unit, provider=org.apache.openjpa.persistence.PersistenceProviderImpl) - provider time 268ms
INFO - Jndi(name="java:global/testing-security-3/Movies!org.superbiz.injection.secure.Movies")
INFO - Jndi(name="java:global/testing-security-3/Movies")
INFO - Existing thread singleton service in SystemInstance() org.apache.openejb.cdi.ThreadSingletonServiceImpl@38ee6681
INFO - OpenWebBeans Container is starting...
INFO - Adding OpenWebBeansPlugin : [CdiPlugin]
INFO - All injection points are validated successfully.
INFO - OpenWebBeans Container has started, it took 170 ms.
INFO - Created Ejb(deployment-id=Movies, ejb-name=Movies, container=Default Stateful Container)
INFO - Started Ejb(deployment-id=Movies, ejb-name=Movies, container=Default Stateful Container)
INFO - Deployed Application(path=/home/boto/dev/ws/openejb_trunk/openejb/examples/testing-security-3)
20-Jul-2012 8:42:55 AM null openjpa.Runtime
INFO: Starting OpenJPA 2.2.0
20-Jul-2012 8:42:56 AM null openjpa.jdbc.JDBC
INFO: Using dictionary class "org.apache.openjpa.jdbc.sql.HSQLDictionary" (HSQL Database Engine 2.2.8 ,HSQL Database Engine Driver 2.2.8).
20-Jul-2012 8:42:57 AM null openjpa.Enhance
INFO: Creating subclass and redefining methods for "[class org.superbiz.injection.secure.Movie]". This means that your application will be less efficient than it would if you ran the OpenJPA enhancer.
INFO - Logging in
INFO - Logging out
INFO - EJBContainer already initialized.  Call ejbContainer.close() to allow reinitialization
INFO - Logging in
INFO - Logging out
INFO - EJBContainer already initialized.  Call ejbContainer.close() to allow reinitialization
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 6.069 sec

Results :

Tests run: 3, Failures: 0, Errors: 0, Skipped: 0</code></pre>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_apis_used">APIs Used</h2>
<div class="sectionbody">
<div class="ulist">
<ul>
<li>
<p><a href="../../tomee-8.0/javadoc/org/apache/openejb/core/security/jaas/LoginProvider.html">org.apache.openejb.core.security.jaas.LoginProvider</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/annotation/security/PermitAll.html">javax.annotation.security.PermitAll</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/annotation/security/RolesAllowed.html">javax.annotation.security.RolesAllowed</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/persistence/Entity.html">javax.persistence.Entity</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/persistence/EntityManager.html">javax.persistence.EntityManager</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/persistence/PersistenceContext.html">javax.persistence.PersistenceContext</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/persistence/PersistenceContextType.html">javax.persistence.PersistenceContextType</a></p>
</li>
<li>
<p><a href="../../jakartaee-8.0/javadoc/javax/persistence/Query.html">javax.persistence.Query</a></p>
</li>
</ul>
</div>
</div>
</div>
            </div>
            
        </div>
    </div>
<div style="margin-bottom: 30px;"></div>
<footer>
		<div class="container">
			<div class="row">
				<div class="col-sm-6 text-center-mobile">
					<h3 class="white">Be simple.  Be certified. Be Tomcat.</h3>
					<h5 class="light regular light-white">"A good application in a good server"</h5>
					<ul class="social-footer">
						<li><a href="https://www.facebook.com/ApacheTomEE/"><i class="fa fa-facebook"></i></a></li>
						<li><a href="https://twitter.com/apachetomee"><i class="fa fa-twitter"></i></a></li>
					</ul>
					<h5 class="light regular light-white">
						<a href="../../privacy-policy.html" class="white">Privacy Policy</a>
					</h5>
				</div>
				<div class="col-sm-6 text-center-mobile">
					<div class="row opening-hours">
						<div class="col-sm-3 text-center-mobile">
							<h5><a href="../../latest/docs/" class="white">Documentation</a></h5>
							<ul class="list-unstyled">
								<li><a href="../../latest/docs/admin/configuration/index.html" class="regular light-white">How to configure</a></li>
								<li><a href="../../latest/docs/admin/file-layout.html" class="regular light-white">Dir. Structure</a></li>
								<li><a href="../../latest/docs/developer/testing/index.html" class="regular light-white">Testing</a></li>
								<li><a href="../../latest/docs/admin/cluster/index.html" class="regular light-white">Clustering</a></li>
							</ul>
						</div>
						<div class="col-sm-3 text-center-mobile">
							<h5><a href="../../latest/examples/" class="white">Examples</a></h5>
							<ul class="list-unstyled">
								<li><a href="../../latest/examples/simple-cdi-interceptor.html" class="regular light-white">CDI Interceptor</a></li>
								<li><a href="../../latest/examples/rest-cdi.html" class="regular light-white">REST with CDI</a></li>
								<li><a href="../../latest/examples/ejb-examples.html" class="regular light-white">EJB</a></li>
								<li><a href="../../latest/examples/jsf-managedBean-and-ejb.html" class="regular light-white">JSF</a></li>
							</ul>
						</div>
						<div class="col-sm-3 text-center-mobile">
							<h5><a href="../../community/index.html" class="white">Community</a></h5>
							<ul class="list-unstyled">
								<li><a href="../../community/contributors.html" class="regular light-white">Contributors</a></li>
								<li><a href="../../community/social.html" class="regular light-white">Social</a></li>
								<li><a href="../../community/sources.html" class="regular light-white">Sources</a></li>
							</ul>
						</div>
						<div class="col-sm-3 text-center-mobile">
							<h5><a href="../../security/index.html" class="white">Security</a></h5>
							<ul class="list-unstyled">
								<li><a href="https://apache.org/security" target="_blank" class="regular light-white">Apache Security</a></li>
								<li><a href="https://apache.org/security/projects.html" target="_blank" class="regular light-white">Security Projects</a></li>
								<li><a href="https://cve.mitre.org" target="_blank" class="regular light-white">CVE</a></li>
							</ul>
						</div>
					</div>
				</div>
			</div>
			<div class="row bottom-footer text-center-mobile">
				<div class="col-sm-12 light-white">
					<p>Copyright &copy; 1999-2022 The Apache Software Foundation, Licensed under the Apache License, Version 2.0. Apache TomEE, TomEE, Apache, the Apache feather logo, and the Apache TomEE project logo are trademarks of The Apache Software Foundation. All other marks mentioned may be trademarks or registered trademarks of their respective owners.</p>
				</div>
			</div>
		</div>
	</footer>
	<!-- Holder for mobile navigation -->
	<div class="mobile-nav">
        <ul>
          <li><a hef="../../latest/docs/admin/index.html">Administrators</a>
          <li><a hef="../../latest/docs/developer/index.html">Developers</a>
          <li><a hef="../../latest/docs/advanced/index.html">Advanced</a>
          <li><a hef="../../community/index.html">Community</a>
        </ul>
		<a href="#" class="close-link"><i class="arrow_up"></i></a>
	</div>
	<!-- Scripts -->
	<script src="../../js/jquery-1.11.1.min.js"></script>
	<script src="../../js/owl.carousel.min.js"></script>
	<script src="../../js/bootstrap.min.js"></script>
	<script src="../../js/wow.min.js"></script>
	<script src="../../js/typewriter.js"></script>
	<script src="../../js/jquery.onepagenav.js"></script>
	<script src="../../js/tree.jquery.js"></script>
	<script src="../../js/highlight.pack.js"></script>
    <script src="../../js/main.js"></script>
		</body>

</html>