Getting started with security in Liberty

We can use the <quickStartSecurity> element to quickly enable a simple (one user) security setup for Liberty.

We can set up a secured Liberty server and web application by following some basic configuration steps. Configuration actions within Liberty are dynamic, which means the configuration updates take effect without having to restart the server.

1. Create and start the server.
   systems:

   server.bat create MyNewServer 
   server.bat start MyNewServer

   systems:

   server create MyNewServer 
   server start MyNewServer

2. Include the appSecurity-2.0 and servlet-3.0 features in the server.xml file.

   The server.xml file is in the server directory of myNewServer, for example, wlp\usr\servers\myNewServer\server.xml.

   <featureManager>
        <feature>appSecurity-2.0</feature>
        <feature>servlet-3.0</feature>
   </featureManager>

3. Define the user name and password that is to be granted the Administrator role for server management activities.

   <quickStartSecurity userName="Bob" userPassword="bobpwd" />

   Note: Choose a user name and password that are meaningful to you. Never use the name and password in the example for the applications.

4. Configure the deployment descriptor with relevant security constraints to protect web resource. For example, use <auth-constraint> and <role-name> elements to define a role that can access web resource. The following example web.xml file shows that access to all the URIs in the application is protected by the testing role.

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
         "http://java.sun.com/dtd/web-app_2_3.dtd">
   
   <web-app id="myWebApp">
   
    <!-- SERVLET DEFINITIONS -->
    <servlet id="Default">
       <servlet-name>myWebApp</servlet-name>
       <servlet-class>com.web.app.MyWebAppServlet</servlet-class>
       <load-on-startup/>
    </servlet>
   
    <!-- SERVLET MAPPINGS -->        
    <servlet-mapping id="ServletMapping_Default">
       <servlet-name>myWebApp</servlet-name>
       <url-pattern>/*</url-pattern>
    </servlet-mapping>
   
    <!-- SECURITY ROLES -->
    <security-role>
       <role-name>testing</role-name>
    </security-role>
   
    <!-- SECURITY CONSTRAINTS -->
    <security-constraint>
       <web-resource-collection>
         <url-pattern>/*</url-pattern>
       </web-resource-collection>
       <auth-constraint>
         <role-name>testing</role-name>
       </auth-constraint>
    </security-constraint>
   
    <!-- AUTHENTICATION METHOD: Basic authentication -->
    <login-config>
       <auth-method>BASIC</auth-method>
    </login-config> 
   
   </web-app>

5. Configure the application in the server.xml file. In the following example, the user Bob is mapped to the testing role of the application:

    <application type="war" id="myWebApp" name="myWebApp" 
         location="${server.config.dir}/apps/myWebApp.war">
        <application-bnd>
    <security-role name="testing">
         <user name="Bob" />
    </security-role>
        </application-bnd>
    </application>

6. Access the application and log in with the user name Bob. The default URL for the myWebApp application is http://localhost:9080/myWebApp