Basics of Authentication and Authorization for GUI GUI Applications
We are programming a 3 tier rich client GUI application using swing and we need to add authentication and authorization controls. I am completely new to this topic, so I did some research online. My first intention was to use JAAS for this function, but as far as I can see JAAS only contains functionality to execute privileged methods / actions, but there doesn't seem to be any function to determine if access is granted for some "actions "for managing the graphical interface. for example hide / disable some menus, etc.
Am I getting this wrong or is my approach wrong? Are there any alternatives to JAAS? Is there any "best practice" for adding authentication and authorization to GUI applications?
Thanks for the help, Eny
source to share
A rich GUI client is no different from a standard website. Both are client side and in control of a potential attacker. Therefore, no matter what security you think, a certain person can violate it. Remember, the whole idea of hiding / disabling buttons in the user interface is for usability, not security.
First, show all the buttons to all users, but make sure that if a normal click on the admin button, the server does not allow it. After correct server side authentication, add shims to hide / disable buttons in UI. To do this, you can write a service that returns the roles / priviliges that the logged in user has.
JAAS is the ideal server side authentication technology. You should be able to find a lot of documentation for securing server resources.
Your users will need to login to the Swing GUI and need to be authenticated by the server. This is the most important step. If you do not authenticate the user with the server, then there is none at all.
After that, every button press, ever the user's action goes to the server, which is authenticated if the user has permission. If it doesn't, throw the exception back to the client. This way, if someone tricks your buttons with something, the server will catch them.
source to share
While @ sri's answer gives some good advice, the advice to "just pass the session / token id" is dangerous because it is too easily spoofed. You need to establish a general context that is verified by a trusted source. Take a look at org.ietf.jgss.GSSContext
for details on this.
To get the GSS context, you come in contact with the Key Distribution Center (KDC) concept , which usually results in Kerberos and a sane server of some kind - sorry, I'm a little vague, but not knowing what you have in place is hard to be specific and even then I only did it with Active Directory.
Once you have all the authentication, you can go back to the original point of protecting certain features.
The authentication process will contain javax.security.auth.Subject
which will contain one or more java.security.Principal
s. These principles can be used with JAAS to create a policy file that uses the principles described here . Typically, you use a principal to represent the roles that a user downloads from a directory server. I used to specialize the login module for this, although there may be a better way.
This is all locked, so the last step is to make it attractive to the user, and here, as far as I know, you yourself. You can simply leave everything on and alert the user if the operation cannot be performed or, since you have an item, do something more complex based on group membership.
source to share
Use JAAS
JAAS is a general framework and will not provide any specific functionality like disable / enable buttons etc. you will have to inject this authorization logic into your application, JAAS provides you with a handle to an authenticated / authorized Principal object that comes in handy in such scenarios.
source to share