Jetty has moved!
Jetty is a project at the Eclipse Foundation.
Homepage:http://www.eclipse.org/jetty
Downloads: http://download.eclipse.org/jetty/
Documentation:http://www.eclipse.org/jetty/documentation/current/
About:http://www.eclipse.org/jetty/about.php
Jetty Powered:http://www.eclipse.org/jetty/powered/
Contact the core Jetty developers at www.webtide.com
private support for your internal/customer projects ... custom extensions and distributions ... versioned snapshots for indefinite support ... scalability guidance for your apps and Ajax/Comet projects ... development services from 1 day to full product delivery
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

How to Configure Security with Embedded Jetty

This example shows you how to setup web application security programmatically. Firstly, we'll look at how to do it if you use a web.xml file to declare your <security-constraint>s on urls within your webapp. Then, we'll show you how to do it in code instead, so that you don't even need to have a web.xml file.

For both of these examples, we need to configure jetty with a Realm. A Realm represents the runtime security environment - the users, their credentials and their roles. Jetty has a number of different Realm implementations:

For these examples, we'll be using the org.mortbay.jetty.security.HashUserRealm. There is an example of a properties file for this Realm type in $jetty.home/etc/realm.properties.

We'll be using BASIC authentication for this example, but you can also set up FORM authentication in a similar way.

Using a web.xml file for security-constraints

If you're able to use a WEB-INF/web.xml file, you should configure it to use BASIC authentication, and to specify some urls that have security constraints. Here's an example:

It is important to note the <realm-name>MyRealm</realm-name>. This is the linkage to the jetty Realm (a HashUserRealm in this instance). You'll specify this same name when you set up the Realm. Here's the code you need:

Programmatic security constraints (no web.xml)

If you don't wish to use a web.xml file, you can specify your <security-constraint>s in code instead. Here's how we'd code the same security constraints for the web.xml file above:

Running

Assuming you deployed a webapp at the context path /mywebapp by running your application, then surfing to:

will cause a dialog box to pop up prompting you for your username and password. This is how BASIC authentication obtains your authentication information.

The example properties file in $jetty.home/etc/realm.properties defines the following users and their roles:

  • user jetty with role user
  • user admin with roles server-administrator,content-administrator,admin

Our security constraint only allows users in these roles to access it:

  • admin
  • user
  • moderator

Therefore, using the default $jetty.home/etc/realm.properties, only the users:

  • jetty
  • admin

would be able to access any of the pages protected by the <security-constraint> in the webapp.

Therefore, you would log in as either the user jetty or the user admin (with passwords jetty and admin respectively) to be able to access the webapp.

  • No labels
Contact the core Jetty developers at www.webtide.com
private support for your internal/customer projects ... custom extensions and distributions ... versioned snapshots for indefinite support ... scalability guidance for your apps and Ajax/Comet projects ... development services from 1 day to full product delivery