WebORB for PHP 1.3 (now with Flex security)
WebORB for PHP v.1.3 is now generally available. The most important feature in the release is the support for the RemoteObject.setCredentials API. WebORB includes a reference implementation of a basic security manager so in a nutshell you get a complete solution. Before I delve into the details of how Flex security works with WebORB, a few words about our security model:
WebORB provides an extensible mechanism for restricting access to programming resources (remote classes and their methods). The product supports two security modes: open and closed. The open mode enables access to ALL classes deployed in the server. Access to specific classes can be restricted using weborb configuration file (/Weborb/weborb-config.xml). The closed mode disables access to ALL classes except for the ones with explicit access grants in the configuration file.
WebORB delegates authentication and authorization handling to handlers. The diagram below provides an overview of how WebORB handles authentication and authorization.
Upon receipts of an authentication request, WebORB delegates to the preconfigured authentication handler to check user credentials and establish their validity. The box represented as the "Security Domain" can be any store with information about user credentials (a database, ACL configuration file, remote single sign-on service, etc). If the credentials are valid a record is made in the session. Subsequent invocations for the secured services must be passed by a preconfigured authorization handler. The handler checks if the logged on user is authorized to access the service. If the check passes, the invocation proceeds, otherwise an error is generated.
The default implementation of authentication and authorization handlers in WebORB is rather basic. It is based on a collection of user names, passwords and assigned roles captured in the
<acl>
<user>
<name>admin</name>
<password>changeme</password>
<role>administrator</role>
</user>
</acl>
Now that the "administrator" role name is assigned to a user with the admin/changeme credentials, a service can be secured using one of the following two approaches:
- Using Flex's remoting-config.xml
\Weborb\WEB-INF\flex\remoting-config.xml contains a list of destinations (PHP classes) exposed to Flex clients. In order to secure a destination use the format shown below:
<destination id="SecureTest">
<properties>
<source>HelloWorld</source>
</properties>
<security>
<security-constraint>
<auth-method>Custom</auth-method>
<roles>
<role>administrator</role>
</roles>
</security-constraint>
</security>
</destination>
When WebORB receives an invocation request for the HelloWorld class, it will delegate to AuthorizationHandler to make sure the currently logged in user has the "administrator" role. - Using weborb configuration file - \Weborb\weborb-config.xml:
Securing a class in WebORB config is a 2 step process:
1. An access constraint is defined as shown below:
<access-constraint action="grant">
<name>OnlyAdmin</name>
<role>administrator</role>
</access-constraint>
2. The constraint is applied to a class (or a method) to restrict access as shown below:
<secure-resource>
<resource>HelloWorld</resource>
<constraint-name>OnlyAdmin</constraint-name>
</secure-resource>
This will produce the same result as restricting access to HelloWorld using the first approach.
var ro:RemoteObject = new RemoteObject( "SecureTest" );
ro.setCredentials( "admin", "changeme" );
Any invocation at this point will require authorization of the user identified by the provided credentials.
WebORB for PHP 1.3 includes an example demonstrating security in action. Just run the example at http://localhost/Examples/FlexRemoting/main.html and click on the "Run Secure Invocation" button.
Subscribe to this blog
