JAAS security in sequence diagram

[Mike Degteariov]

Hello ranchers,

Each use case in my assignment begins with the step of logging in the user.

I decided to go with JAAS-based security model.
After initial setup (configuring security realm, setting up login module, configuring users and roles) the process of authentication and authorization is transparent and independent of application logic.

Although I can trace the sequence of successful authentication and authorization as
GET protected_resource.xhtml -> JAAS security module -> forward to login.xhtml -> POST j_security_check ->JAAS security module -> container login module -> FacesServlet -> render protected_resource.xhtml
, I am not sure whether it should be the part of sequence diagrams, or documenting of my security implementation choices in assumptions would suffice.

Also, neither Cade / Sheil nor Amritendu De books include any authentication logic in their sequence diagrams, although user authentication is necessary in scenarios in both books.

I initially included container-based security logic in my sequence diagram, but it looks a little awkward, and I am inclined to remove it, but I'd rather ask what the community thinks about it.

[Antonio Rafael Rodrigues]

Hi Mike.

For the time being, I'm not going to put it. I think it'd pollute the diagram. I don't think we need to explain how the framework works, even the 'faces servlet' that is transparent to us. Maybe we should make an assumption that the programmers know a specific technology.
In my point of view, If we have to explain this kind of thing, we should also make diagrams about how the ejb pool works for example.
I didn't see it as a issue at my first look, but now I also would like to read some experienced person in this exam talking about that.

[pin guan wang]

To make your sequence diagrams cleaner, you can use the "reference" UML notation. Just create a sequence diagram for your JAAS login and "reference" to this JAAS login diagram from the other sequence diagrams.

There is no harm to put in more detail if you are not sure if it is redundant.

[Mike Degteariov]

Hi Pin,

I use references in my sequence diagrams already, but the point was to find out whether container-based authentication should be included into sequence diagrams at all.

But, thank you so much anyway.

[Antonio Rafael Rodrigues]

I think that the observation made by Pin is that since we don't mess up our diagrams, there is no problem in putting not required information.

[pin guan wang]

Antonio Rafael Rodrigues wrote:I think that the observation made by Pin is that since we don't mess up our diagrams, there is no problem in putting not required information.

Yes, that is what i was trying to say.
As long as what you are going to document is accurate and it is not too tedious to do so, I think it is worth to include it into your sequence diagram.

Thanks

[Mike Degteariov]

The question is - from where to reference JAAS sequence.

It is understood that container-based security kicks in with each and every request to protected resource.
That is, to be accurate, JAAS "ref" box should be placed over every message to FacesServlet. We do not want to do that.
On the other hand, placing the JAAS security ref box only in the upper left corner of the sequence diagram (where sequence starts) would not be accurate.
This is because container based security is orthogonal to application logic, and is not part of it.

I think that maybe I should create just a separate top-level sequence diagram for JAAS security, with two or three gates (one incoming request, one forward if success, one forward if failure).
But now I wonder if it would be OK to provide such a diagram, since it would not be referenced from any other diagram, but only from the main html document.
Or, maybe container-based security should be part of a deployment diagram - after all, login module and underlying security system, like Kerberos, is an integral part of infrastructure.

[Antonio Rafael Rodrigues]

Yes. I agree with Mike. Represent the JAAS's role properly would be hard. Any diagram made by me wouldn't be accurate (if so, it would be tedious).
Then, following Pin's advice maybe we shouldn't put it.
The point about don't represent it in the other diagrams is really strong. If we have to put every class used in sequence diagram into class diagram, we have to put JAAS's classes as well.

Another point I would like to add is that any sequence diagram made by me would be a copy, or at least very close to a diagram that is already somewhere.

Like this one: http://www.onjava.com/pub/a/onjava/excerpt/weblogic_chap17/index1.html?page=4 (scroll to the page's bottom) that explains the login proccess

Or this one: https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/pdf/Security_Guide/JBoss_Enterprise_Application_Platform-6.2-Security_Guide-en-US.pdf (page 272) figure 18.1

Another one: http://www.devarticles.com/c/a/Java/JAAS-Securing-EJB/1/

I mean, it sounds like explain something that is public domain, while we should focus on explain the specific solution that is in our mind and not elsewhere.

[Amritendu De]

Does the use case mention about the security context to be implemented? If the use case does not mention the security context, I would rather not include in my sequence diagram.

[Antonio Rafael Rodrigues]

In my system it does include one step for authentication in every UC.

[Amritendu De]

If the use case mentions security, you should include it like a reference. The sequence diagram is a one to one mapping for every use case unlike the class diagram which talks about the entire system.

[Antonio Rafael Rodrigues]

I agree. But my doubt is more about what kind of reference? A aside note? Any other UML commentary or symbol?
Because the discution until now was about drawing a sequence diagram dedicated to the JAAS actuation and refer it on the others.

[Amritendu De]

I had used it sometime back. You can create a reference diagram and use it as a reference in other diagrams.

[Antonio Rafael Rodrigues]

Yes, that is the possibility that we were discussing if we have to follow. Please, have a look in the entries 7 and 8 of this thread.

[Amritendu De]

My idea is if the use case has security you will have to find a way to show it in the sequence diagram. I do not agree that you would need to show those JAAS classes in the class diagram. Since the class diagram would already be pretty huge do not include those JAAS classes unnecessarily. But remember to include all application methods and classes used in the sequence diagram.

[Mike Degteariov]

Hello Amritendu,

First off, many thanks for taking part in this discussion.

Then, it is not a question that JAAS stuff should or should not be part of class diagram. I think we all agree that it should not.

The question is, how we should fit JAAS into sequence diagram.

JAAS in particular, or container-managed stuff in general, is a cross-cut concept, like aspects or interceptors, and is independent from application or business logic.

We cannot place "ref" boxes over each and every call to FacesServlet.

[Amritendu De]

I do not think showing it will be as complicated as you are thinking it to be. Why cannot we have just one call shown to the ref diagram at the beginning and ignore the other calls. This is just to show you have considered security given in the use case.

[Mike Degteariov]

Yes, that might work.

And, I guess that leads me to the technical question - where should we put "ref" diagrams in our submission package.

The assignment says

When you have completed your solution, you should have an “index.html” that has your name,
testing ID, a link to the class, component, deployment diagrams, risk list, this instruction file, and a
link to each of the sequence/collaboration diagrams.

So do we know if ref diagrams should be embedded to the pages of diagrams where they are used, and paced, say, behind main diagrams ?

OR, should they be accessible from index.html main document, in addition to all other diagrams that are part of assignment ?

[Amritendu De]

I would have kept it in index.html in addition to other diagrams and given it a name easy to understand that it is a reference and security diagram.

[Antonio Rafael Rodrigues]

Yes. I like the idea of put a reference only for representation purposes, but I think that it's necessary make a note, showing that we are aware that this reference doesn't represents the entire process.
But I still have doubt about what to show in this "ref" diagram. Would it show the JAAS flow more or less like those I put the links here?

[Amritendu De]

I do not know the problem you are solving. Hence it would be advisable for you to take a call what should be in the ref diagram.

[Antonio Rafael Rodrigues]

Hi Amritendu De. First of all, thaks you so much for your thoughts.
I'm really sorry, but I didn't get the idea.
The JAAS's login process is generic for any application, I don't understand why the ref diagram depends on my problem.
Maybe I could build some generic and coarse grained representation of JAAS's login process.