Authentication Setup

With the Exhibitor standalone version you can configure authentication/security. The standalone version uses the Jetty web server and thus the authentication configuration is based on Jetty specifications.

Authentication is specified via two command line arguments: --security and --realm.

--security

The argument is a path to a web.xml file with security information (all other tags are ignored). See http://docs.oracle.com/javaee/6/tutorial/doc/gkbaa.html for details. Here’s an example file:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
	http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	version="2.5">
<security-constraint>
	<web-resource-collection>
		<web-resource-name>A Protected Page</web-resource-name>
		<url-pattern>/*</url-pattern>
	</web-resource-collection>
	<auth-constraint>
		<role-name>admin</role-name>
	</auth-constraint>
</security-constraint>

<security-role>
	<role-name>admin</role-name>
</security-role>

<login-config>
	<auth-method>BASIC</auth-method>
	<realm-name>myRealm</realm-name>
	</login-config>
</web-app>

--realm

The argument specifies the realm as [realm name]:[path/url]. The realm name denotes which realm to use from the file. The path/url must point to a realm properties file as described here (see HashUserRealm): http://docs.codehaus.org/display/JETTY/Realms. Here’s an example file:

admin: admin-password,role
user: user-password,role
moderator: manager-password,role

Client Setup

IMPORTANT: When authentication/security is enabled in Exhibitor (any of its versions) you must configure remote client authentication as well. See the related wiki: Remote Client Authorization.