{"id":225,"date":"2015-08-11T17:44:20","date_gmt":"2015-08-11T17:44:20","guid":{"rendered":"http:\/\/ldapcon.org\/2015\/?page_id=225"},"modified":"2015-10-16T16:55:01","modified_gmt":"2015-10-16T16:55:01","slug":"tutorial-applying-end-to-end-security-across-a-java-web-environment-using-ldap-and-apache-fortress","status":"publish","type":"page","link":"https:\/\/ldapcon.org\/2015\/tutorials\/tutorial-applying-end-to-end-security-across-a-java-web-environment-using-ldap-and-apache-fortress\/","title":{"rendered":"Tutorial: Applying End-to-End Security Across a Java Web Environment Using LDAP and Apache Fortress"},"content":{"rendered":"

Tutorial: Applying End-to-End Security Across a Java Web Environment Using LDAP and Apache Fortress<\/h1>\n

Shawn McKinney<\/p>\n

Summary<\/h2>\n

This tutorial covers how to apply an end-to-end application security architecture featuring Apache
\nFortress and OpenLDAP. It will be divided into four 30 minute segments:<\/p>\n

    \n
  1. Install security infrastructure: OpenLDAP and Apache Fortress.<\/li>\n
  2. Deploy a simple Java Web app into Apache Tomcat. Get authentication and coarse-grained authorization enabled to control page access.<\/li>\n
  3. Add fine-grained authorization to Web application controls (buttons, list boxes, …) and database functions (create, read, update, delete).<\/li>\n
  4. Generate keys and certs, enable TLS to HTTP, LDAP and JDBC connections.<\/li>\n<\/ol>\n

    The student will leave with understanding to apply proper security techniques to Web apps. A number of relevant standards including Java EE Security, Role-Based Access Controls (ANSI INCITS 359), Transport Level Security (TLS), and X.509 are followed. The sample code uses Java, but the techniques may be applied across many different platforms.<\/p>\n

    Prerequisites<\/h2>\n