Skip to content

security-properties.adoc

Latest commit

 

History

History
167 lines (130 loc) · 6.38 KB

security-properties.adoc

File metadata and controls

167 lines (130 loc) · 6.38 KB

Using Security with .properties File

_attributes.adoc :categories: security :summary: This guide demonstrates how your Quarkus application can use a .properties file to store your user identities. :topics: security,identity-providers :extensions: io.quarkus:quarkus-elytron-security-properties-file

Quarkus provides support for properties file-based authentication intended for development and testing purposes. It is not recommended to use this authentication in production as, at present, only plain-text and MD5 hashed passwords are used, and properties files are generally too limited.

Add the following to your build file:

pom.xml
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-elytron-security-properties-file</artifactId>
</dependency>
build.gradle
implementation("io.quarkus:quarkus-elytron-security-properties-file")

Configuration

The elytron-security-properties-file extension currently supports two different realms for storing authentication and authorization information. Both support storage of this information in properties files.

The following sections detail the specific configuration properties.

Note

Basic authentication must be explicitly enabled with quarkus.http.auth.basic=true, if more than one authentication mechanism is used.

Properties Files Realm Configuration

The properties files realm supports the mapping of users to passwords and users to roles with a combination of properties files. They are configured with properties starting with quarkus.security.users.file.

Example of the application.properties file section for property files realm
quarkus.security.users.file.enabled=true
quarkus.security.users.file.users=test-users.properties
quarkus.security.users.file.roles=test-roles.properties
quarkus.security.users.file.realm-name=MyRealm
quarkus.security.users.file.plain-text=true

Users.properties

The quarkus.security.users.file.users configuration property specifies a classpath resource which is a properties file with a user-to-password mapping, one per line.

The following Example of test-users.properties illustrates the format:

Example of test-users.properties
scott=jb0ss (1)
jdoe=p4ssw0rd (2)
stuart=test
noadmin=n0Adm1n

  1. User scott has password defined as jb0ss

  2. User jdoe has password defined as p4ssw0rd

This file has usernames and passwords stored in plain text, which is not recommended. If plain text is set to false (or omitted) in the config, then passwords must be stored in the form MD5 ( username : realm : password ). This can be generated for the first example above by running the command echo -n scott:MyRealm:jb0ss | md5 from the command line.

Roles.properties

Example of test-roles.properties
scott=Admin,admin,Tester,user (1)
jdoe=NoRolesUser (2)
stuart=admin,user (3)
noadmin=user

  1. User scott has been assigned the roles Admin, admin, Tester and user

  2. User jdoe has been assigned the role NoRolesUser

  3. User stuart has been assigned the roles admin and user.

Embedded Realm Configuration

The embedded realm also supports the mapping of users to passwords and users to roles. It uses the main application.properties Quarkus configuration file to embed this information. They are configured with properties starting with quarkus.security.users.embedded.

The following is an example application.properties file section illustrating the embedded realm configuration:

Example of the application.properties file section for embedded realm
quarkus.security.users.embedded.enabled=true
quarkus.security.users.embedded.plain-text=true
quarkus.security.users.embedded.users.scott=jb0ss
quarkus.security.users.embedded.users.stuart=test
quarkus.security.users.embedded.users.jdoe=p4ssw0rd
quarkus.security.users.embedded.users.noadmin=n0Adm1n
quarkus.security.users.embedded.roles.scott=Admin,admin,Tester,user
quarkus.security.users.embedded.roles.stuart=admin,user
quarkus.security.users.embedded.roles.jdoe=NoRolesUser
quarkus.security.users.embedded.roles.noadmin=user

As with the first example, this file has usernames and passwords stored in plain text, which is not recommended. If plain text is set to false (or omitted) in the config, then passwords must be stored in the form MD5 ( username : realm : password ). This can be generated for the first example above by running the command echo -n scott:MyRealm:jb0ss | md5 from the command line.

Embedded Users

The user to password mappings are specified in the application.properties file by properties keys of the form quarkus.security.users.embedded.users.<user>=<password>. The following Example of passwords illustrates the syntax with 4 user-to-password mappings:

Example of passwords
quarkus.security.users.embedded.users.scott=jb0ss # (1)
quarkus.security.users.embedded.users.stuart=test # (2)
quarkus.security.users.embedded.users.jdoe=p4ssw0rd
quarkus.security.users.embedded.users.noadmin=n0Adm1n

  1. User scott has password jb0ss

  2. User stuart has password test

Embedded Roles

The user to role mappings are specified in the application.properties file by properties keys of the form quarkus.security.users.embedded.roles.<user>=role1[,role2[,role3[,…​]]]. The following Example of roles illustrates the syntax with 4 user-to-role mappings:

Example of roles
quarkus.security.users.embedded.roles.scott=Admin,admin,Tester,user # (1)
quarkus.security.users.embedded.roles.stuart=admin,user # (2)
quarkus.security.users.embedded.roles.jdoe=NoRolesUser
quarkus.security.users.embedded.roles.noadmin=user

  1. User scott has roles Admin, admin, Tester, and user

  2. User stuart has roles admin and user