import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.SQLException;

import javax.annotation.PostConstruct;
import javax.annotation.PreDestroy;
import javax.annotation.Resource;
import javax.annotation.sql.DataSourceDefinition;
import javax.ejb.Singleton;
import javax.ejb.Startup;
import javax.sql.DataSource;

@Singleton
@Startup
public class DatabaseSetup {

    // The default datasource that is bundled with GlassFish is used to store // credentials.
    @Resource(lookup="java:comp/DefaultDataSource")
    private DataSource dataSource;

    @PostConstruct
    public void init() {

        // ...
        executeUpdate(dataSource, "INSERT INTO caller VALUES('Joe', '" + passwordHash.generate("secret1".toCharArray()) + "')");
        // ...
        executeUpdate(dataSource, "INSERT INTO caller_groups VALUES('Joe', 'foo')");
        executeUpdate(dataSource, "INSERT INTO caller_groups VALUES('Joe', 'bar')");
        // ...
    }

    @PreDestroy
    public void destroy() {
    	// ...
    }

    private void executeUpdate(DataSource dataSource, String query) {
        // ...
    }
}

// Database Definition for built-in DatabaseIdentityStore
@DatabaseIdentityStoreDefinition(
    callerQuery = "#{'select password from caller where name = ?'}",
    groupsQuery = "select group_name from caller_groups where caller_name = ?",
    hashAlgorithm = Pbkdf2PasswordHash.class,
    priorityExpression = "#{100}",
    hashAlgorithmParameters = {
        "Pbkdf2PasswordHash.Iterations=3072",
        "${applicationConfig.dyna}"
    }
)

@ApplicationScoped
@Named
public class ApplicationConfig {

  public String[] getDyna() {
       return new String[]{"Pbkdf2PasswordHash.Algorithm=PBKDF2WithHmacSHA512", "Pbkdf2PasswordHash.SaltSizeBytes=64"};
   }

}

@BasicAuthenticationMechanismDefinition(
        realmName = "file"
)

@WebServlet("/servlet")
@DeclareRoles({ "foo", "bar", "kaz" })
@ServletSecurity(@HttpConstraint(rolesAllowed = "foo"))
public class Servlet extends HttpServlet {

    private static final long serialVersionUID = 1L;

    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        String webName = null;
        if (request.getUserPrincipal() != null) {
            webName = request.getUserPrincipal().getName();
        }

        response.getWriter().write("web username: " + webName + "\n");

        response.getWriter().write("web user has role \"foo\": " + request.isUserInRole("foo") + "\n");
        response.getWriter().write("web user has role \"bar\": " + request.isUserInRole("bar") + "\n");
        response.getWriter().write("web user has role \"kaz\": " + request.isUserInRole("kaz") + "\n");
    }

}

1. If you have not already done so, start the default database. This is necessary because we are using the DefaultDataSource bundled with GlassFish for DatabaseIdentityStore. See Starting and Stopping Apache Derby.

2. If you have not already done so, start the GlassFish server. See Starting and Stopping GlassFish Server.

3. From the File menu, choose Open Project.

4. In the Open Project dialog box, navigate to:

   tut-install/examples/security/security-api

5. Select the built-in-db-identity-store folder.

6. Click Open Project.

7. In the Projects tab, right-click the built-in-db-identity-store project and select Build.

   This command builds and deploys the example application to your GlassFish Server instance.

1. If you have not already done so, start the default database. This is necessary because we are using the DefaultDataSource bundled with GlassFish for DatabaseIdentityStore. See Starting and Stopping Apache Derby.

2. If you have not already done so, start the GlassFish server. See Starting and Stopping GlassFish Server.

3. In a terminal window, go to:

   tut-install/examples/security/security-api/built-in-db-identity-store

4. Enter the following command:

   This command builds and packages the application into a WAR file, built-in-db-identity-store.war, that is located in the target directory, then deploys the WAR file.

1. Make a request to the deployed application by entering the following request URL in your web browser:

   Request URL:

   http://localhost:8080/built-in-db-identity-store/servlet

   Because BASIC authentication is being used here, the container responds back prompting for username and password.

2. Enter the username Joe, and the password secret1 at the prompt.

   Once you provide the credentials, the following process occurs:

   • The client presents the request to the container with base64 encoded string and with the Authorization header using the value in the format expected for basic authentication.

   • With the username and password available to the container, validation is performed against DatabaseIdentityStore.

   • The corresponding UsernamePasswordCredential object is passed as a parameter to the DatabaseIdentityStore#validate() method.

   • The password is fetched from the database for user Joe.

   • The password stored in the database is hashed using the PBKDF2 algorithm and verified by the built-in Pbkdf2PasswordHash implementation.

   • On successful verification, the request gets delegated to the servlet in question and the following response is returned to the end user.

     Response:

     web username: Joe
     web user has role "foo": true
     web user has role "bar": true
     web user has role "kaz": false

3. Test the authentication using invalid credentials. Make a request to the deployed application by entering the following request URL in your web browser:

   Request URL:

   http://localhost:8080/built-in-db-identity-store/servlet

   Again, because BASIC authentication is being used here, the container responds back prompting for username and password.

4. Enter an invalid username and password. You are promted to enter the credentials again, but you are not authenticated.

   When you click Cancel in the Authentication required window, the following response is returned:

   HTTP Status 401 - Unauthorized
   
   type Status report
   
   message Unauthorized
   
   description This request requires HTTP authentication.
   
   GlassFish Server Open Source Edition 5