Security: Store Users in MongoDB

[skyHu666]

Hello, how can I use basic authentication or jwt authentication when storing my user data such as user name and password in mongodb? thank you

[predic8]

Hi,
Membrane does not come with an adapter for MongoDB. But you can easily extend Membrane with these steps:

Step 1

Implement an MongoDBDataProvider

public interface UserDataProvider {

	void init(Router router);

	/**
	 * @throws NoSuchElementException
	 *             to display an error message as a response
	 * @return a hash map containing the user's attributes (used for the token
	 *         generator or to pass on HTTP headers)
	 */
	Map<String, String> verify(Map<String, String> postData);
}

Have a look at FileUserDataProvider as an example.

Step 2

Use annotations to make Membrane recognize your extension.

@MCElement(name="fileUserDataProvider")
public class FileUserDataProvider implements UserDataProvider {

That way you can use the provider in the proxis XML:

<basicAuthentication>
				<mongoUserDataProvider host="..." collections="users"/>
</basicAuthentication;>

Step 3

Compile your extension into a maven artifact. Generate a jar and place it into the libs folder of membrane.

Step

Setup a configuration using your extension.

Please ask if you have any questions left.

Cheers
Thomas

[predic8]

Hi @huxiaofei658,
I got a mail with a question about step 3 from you. But I cannot find it here, suppose you figured it out yourself :-)
Thomas

[skyHu666]

Hello @predic8 I wrote a MongoUserDataProvider, and then how to use it specifically is not clear?

@mcelement(name = "mongoUserDataProvider")

public class MongoUserDataProvider implements UserDataProvider {

private static final Logger log = LoggerFactory.getLogger(MongoUserDataProvider.class.getName());

private MongoClient mongoClient;

private MongoDatabase database;

private String collectionName;

private String userColumnName;

private String passwordColumnName;

private Router router;

...

[predic8]

Could you build it and do you have a JAR?

[skyHu666]

Could you build it and do you have a JAR?
I mean will mongoUserDataProvider. Java source code to build into the jar and then in the third said libs here can use custom extensions? But I can't find the libs folder, do I just need this one java source file to build the jar package or do I need to build the jar with other files? Also, my mongodb address is written dead in the source file, how can I modify it to be dynamically configurable? That's all. Thank you.

[predic8]

Hi @huxiaofei658,
to write the DataProvider you can have a look at the source code. In the core module you'll find the class ApiKeyFileStore. You have to implement the same and build Membrane or you can create a Java Project and use Membrane core as a dependency. Then you build with maven. Then you can copy the Jar into the MEMBRANE_HOME/libs folder.
But I have good news. A college is also implementing a MondoDBDataProvider. It will be shipped soon probably in version 6.1.0.