Enable Authentication & Authorization in an IHTSDO tools application

This page describe all the steps to enable Atlassian Crowd based authorization and authentication to an IHTSDO tools application using Identity Management Service.

Step-by-step guide

Login to crowd interface
In order to create application user group, user should have crowd admin role.
Define a application user group(s)
1. Create application specific group. For example WRP admin can be ihtsdo-wrp-admin. A normal WRP user can be categorize under ihtsdo-wrp-users
  This step can be skipped if application want to use default user group - ihtsdo-users for an application for authorization
Add newly created group to ihtsdo-tools application as shown in image

Enable back end security using spring security.

In order to enable spring based security, application should use dependency of ihtsdo-crowd-resources and ihtsdo-crowd-bridge modules in its maven build. An example of these is given as below.

Authorization is specific to individual application under IHTSDO tools and application should decide how to enforce authorization to available roles to application.

Maven Dependency

        <dependency>
		  <groupId>org.ihtsdo.otf</groupId>
		  <artifactId>ihtsdo-crowd-resources</artifactId>
		  <version>x.x.x</version>
      	  <classifier>resources</classifier>
          <type>zip</type>
          <scope>provided</scope>		  
		</dependency>
		
		<dependency>
		  <groupId>org.ihtsdo.otf</groupId>
		  <artifactId>ihtsdo-crowd-bridge</artifactId>
		  <version>x.x.x</version>
		</dependency>

Load crowd spring bean resources application-im-common-security-config.xml and applicationContext-CrowdClient.xml. Loading can be done using both xml or java annotation way. Example is

Crowd Spring Beans

Xml Config
<import resource="classpath:applicationContext-CrowdClient.xml" />, <import resource="classpath:application-im-common-security-config.xml" /> 
or 
Java annotation
@ImportResource({"classpath:applicationContext-CrowdClient.xml","classpath:application-im-common-security-config.xml"})

Bundle above crowd spring bean resource files in war.

Maven Crowd Resources Loading

        <resources>
          <resource>
            <directory>${basedir}/src/main/resources</directory>
          </resource>
          <resource>
            <directory>${project.build.directory}/generated-resources</directory>
            <filtering>true</filtering>
          </resource>
        </resources>   


			<plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-dependency-plugin</artifactId>
               <version>2.10</version>
               <executions>
                 <execution>
                    <id>unpack-crowd-resources</id>
                       <goals>
                     <goal>unpack-dependencies</goal>
                       </goals>
                       <phase>generate-resources</phase>
                       <configuration>
                       <outputDirectory>${project.build.directory}/generated-resources</outputDirectory>
                       <includeGroupIds>${project.groupId}</includeGroupIds>
                       <includeArtifacIds>ihtsdo-crowd-resources</includeArtifacIds>
                       <excludeArtifactIds>*</excludeArtifactIds>
                       <excludeTransitive>true</excludeTransitive>
                       <scope>provided</scope>
             
                      <includes>crowd.properties,
                          application-im-common-security-config.xml,
                          applicationContext-CrowdClient.xml,
                          crowd-ehcache.xml
                        </includes>
                       </configuration>
                 </execution>
               </executions>
             </plugin>

Enable method level security using spring security annotation or xml config.
Method Security Configuration
```
<sec:global-method-security pre-post-annotations="enabled"/>
```
Use Method annotation or resource annotation to enforce authorization to desired role. See example in Identity Service module or Refset service module.

Page tree

Step-by-step guide

Related articles

7 Comments

Rory Davidson

Kai Kewley

Adam Flinton

Adam Flinton

Tuan Nguyen

Tuan Nguyen

Tuan Nguyen