JBoss.orgCommunity Documentation

Chapter 8. Custom Security

8.1. Login Modules
8.1.1. Built-in LoginModules
8.1.2. Custom LoginModules
8.2. Custom Authorization

The Teiid system provides a range of built-in and extensible security features to enable the secure access of data.  For details about how to configure the available security features check out Admin Guide.

LoginModules are an essential part of the JAAS security framework and provide Teiid customizable user authentication and the ability to reuse existing LoginModules defined for JBossAS. Refer to the JBoss Application Server security documentation for information about configuring security in JBoss Application Server, http://docs.jboss.org/jbossas/admindevel326/html/ch8.chapter.html.

In situations where Teiid's built-in role mechanism is not sufficient, a org.teiid.PolicyDecider can be installed via JBoss module. Extend the org.teiid.PolicyDecider interface and build a custom java class. If you are using maven as your build process, you can use following dependencies



   <dependencies>
      <dependency>
         <groupId>org.jboss.teiid</groupId>
         <artifactId>teiid-api</artifactId>
         <scope>provided</scope>
      </dependency>
      <dependency>
         <groupId>org.jboss.teiid</groupId>
         <artifactId>teiid-common-core</artifactId>
         <scope>provided</scope>
      </dependency>
   </dependencies>
    

For adding Teiid API dependencies, add MANIFEST.MF file in the MATA-INF directory, and the following line. Dependencies: org.jboss.teiid.common-core,org.jboss.teiid.api,javax.api. PoilcyDecider is loaded by the Teiid using the Java's standard service loader mechanism. For this add the following named file META-INF/services/org.teiid.PolicyDecider with full name of your PolicyDecider as the contents. Now package all these files into a jar file and build JBoss module in >jboss-as</modules directory. If your PolicyDecider has any third party dependencies those jar files can also be added to the same module. Make sure you list all the files in the module.xml file.

After the module has been added then configuration needs to be changed before the changes can take effect. Edit either standalone-teiid.xml or domain-teiid.xml file, and in the "teiid" subsystem xml fragment add the following xml with the module name created.

<!-- XML : generated by JHighlight v1.0 (http://jhighlight.dev.java.net) -->
<span class="xml_plain"></span><br />
<span class="xml_plain">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span class="xml_tag_symbols">&lt;</span><span class="xml_tag_name">policy-decider</span><span class="xml_plain">&nbsp;</span><span class="xml_attribute_name">module</span><span class="xml_tag_symbols">=</span><span class="xml_attribute_value">&quot;module-name&quot;</span><span class="xml_tag_symbols">/&gt;</span><span class="xml_plain"></span><br />
<span class="xml_plain">&nbsp;&nbsp;&nbsp;&nbsp;</span><br />

then restart the system. A PolicyDecider may be consulted many times for a single user command, but it is only called to make decisions based upon resources that appear in user queries. Any further access of resources through views or stored procedures, just as with data roles, is not checked against a PolicyDecider.