The Anatomy of a Secure Web Application Using Java EE, Spring Security and Apache Fortress

85 Pages·2017·2.42 MB·English

by  Windows User

The Anatomy of a Secure Web App
Using JavaEE, Spring Security and
Apache Fortress
May 18, 2017
ApacheCon NA, Miami
Objective

• Think about how a web app would behave, if
we spared no expense for security.
ApacheCon NA, Miami 2017 2
@play
Introductions
Shawn McKinney

@work

• Software Architect

• PMC Apache Directory Project

• Engineering Team
ApacheCon NA, Miami 2017 3
Agenda
Look at two examples…

1. Apache Fortress Demo + Java EE + Spring Security
– https://github.com/shawnmckinney/apache-fortress-demo

2. Fortress SAML Demo + Spring Security SP
– https://github.com/shawnmckinney/fortress-saml-demo

ApacheCon NA, Miami 2017 4
Themes Covered
1. Simplicity
2. Common Sense
3. Household Analogies to explain
‘Why’
ApacheCon NA, Miami 2017 5
With a few caveats…
• Not cloud native
• Not microservices
• Not big data
N ot a problem, same rules apply
ApacheCon NA, Miami 2017 6
And a couple of recommendations
• Listen, don’t take notes. These
slides are published and have all
the details you need.
• Save questions for the end (we’ve
got a lot of ground to cover).

ApacheCon NA, Miami 2017 7
Example #1
Apache
Fortress
Demo
https://github.com/shawnmckinney/apache-fortress-demo
ApacheCon NA, Miami 2017 8
The Five Security Layers of Java Web Apps
1.Java Secure Socket
Extension (JSSE)
2.Java EE Security
3.Spring Security
4.Web App Framework
5.Database Functions
ApacheCon NA, Miami 2017 9
Rationale for Each
1.JSSE ---------------------------- private conversations
2.Java EE Security
---------- deadbolt on front door
3.Spring Security
------------ locks on room doors
4.Web App Framework - locks on equipment in rooms
5.Database Functions
---- content filtering
ApacheCon NA, Miami 2017 10