# Basic Authentication Sample

This sample demonstrates how to configure Tyrus client to connect on access protected server endpoint over HTTPS.

Please note that we were able to run this sample only on Firefox (v27.01). Safari (v7.0.5) do not apply the exception to use unverified SSL certificate to WebSocket connection, which results in immediate end with reported error similar to "Invalid certificate chain". Chrome (v37) for some reason does not pass credentials (acquired from initial request) to new websocket connection, so it ends up with "401" HTTP response code without any way how the user can provide authentication info.

## Contents

The application utilizes access protected endpoint `org.glassfish.tyrus.sample.echo.auth.BasicAuthEchoEndpoint` to receive messages, add the text and send it back. Server endpoint is configured in web.xml to be under access protected resource and Authentication scheme is set to Basic. Transport guarantee is set to CONFIDENTIAL, which basically means over HTTPS.

Configuration of client is quite simple, have a look at `org.glassfish.tyrus.sample.echo.auth.SampleBasicAuthTest`. If you use Basic or Digest Authentication scheme only `ClientProperties.CREDENTIALS` property must be set on client and that's it. Hint: It might be useful to deploy some static content into protected area with your server endpoint. If your client does not work at the first attempt you can simply test server configuration in web browser.

## Running the Example with Glassfish

Run the example as follows:

- Create war package

  > `mvn clean package`

- Setup GlassFish 4.0 (installed at `AS_HOME=<install_dir>/glassfish4`):

  - Add new security realm called "`ws-realm`"
    - Start GlassFish using asadmin `$AS_HOME/bin/asadmin start-domain`
    - Access Admin console, assuming the use of default admin port, at http://localhost:4848
    - Navigate in Admin console to: `Configurations -> server-config -> Security -> Realms`, click on "`New...`"

      Name | `ws-realm`
      Class Name | `com.sun.enterprise.security.auth.realm.file.FileRealm`
      JAAS context | `ws-realm`
      Key File | `${com.sun.aas.instanceRoot}/config/ws-realm-keyfile`

    - Create user and set password for user `ws_user` (click on "`ws-realm`" -> "`Manage Users`" -> "`New...`");
      - Ensure "`User ID:`" set to "`ws_user`" and "`Group List:`" set to "`ws_users`"
      - Enter password `password` in "`New Password:`" and "`Confirm New Password:`" text fields
  - Check `web.xml` and `glassfish-web.xml` to understand how role mappings are configured. This blog is also helpful in helping to clarify role mappings.
  - deploy:

    > `$AS_MAIN/bin/asadmin start-domain`

    > `$AS_MAIN/bin/asadmin deploy ./target/*war`

  - Run tests in echo-basic-auth module:

    > `mvn clean test -Djavax.net.ssl.trustStore=$AS_MAIN/domains/domain1/config/cacerts.jks -Djavax.net.ssl.trustStorePassword=changeit -Dtyrus.test.host=localhost -DskipTests=false -Dtyrus.test.port=8181 -Djavax.net.debug=all`

  - From a web browser, visit:

    > `https://localhost:8181/sample-echo-basic-auth`

    - Enter either Username `ws_user` and Password `password`