Digested Passwords and the server/lib/catalina.jar file

[Kevin HaleBoyes <kz...@yahoo.com>]

I am using JDBC Realms in my application with digested passwords.
Specifically the MD5 digest.  I need to programatically digest
passwords entered into the application for storage in the users
table (when a new user is created or password changed).

In the Digested Passwords section of the Realm HOWTO (Tomcat 4.1.10)
there is a description of using the static Digest().  In order to use
this method then I must, and I quote

   "To use either of the above techniques, the
    $CATALINA_HOME/server/lib/catalina.jar file will need to be
    on your class path to make the RealmBase class available."

There are a few ways to do this.  I could copy the catalina.jar file
to my web application WEB-INF/lib directory.  Or, I could copy the
catalina.jar file to $CATALINA_HOME/common/lib.

I don't like the first method as it is error prone when I move to
the next version of Tomcat (and forget to replace the cataline.jar
file).  So I'll probably go with the second method and copy the
.jar file to the common/lib directory.

Should I move the file instead of copying it?
Could I create a symbolic link instead of copying?
Is there a better way to do this?

Thanks,
Kevin.


__________________________________________________
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
http://finance.yahoo.com

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: Digested Passwords and the server/lib/catalina.jar file

[da...@yahoo.com]

It's error prone either way-- .../common/lib or
.../WEB-INF/lib-- upon upgrade.  Without understanding
the full scope of your project I would tend to lean
towards the first solution (.../WEB-INF/lib) unless
the .jar file needs to be available to all web
applications.  The "common" directory according to
Jakarta-Tomcat is:

"Common - This class loader contains additional
classes that are made visible to both Tomcat internal
classes and to all web applications...."

Moving a Tomcat server .jar file does not seem like a
comfortable option-- it is like moving system
libraries the OS depends on to a shareable area
because you do not like them where they currently are
located-- but if it works and you feel comfortable
with it then use it.  I hope this helps.

Thanks.

--- Kevin HaleBoyes <kz...@yahoo.com> wrote:
> I am using JDBC Realms in my application with
> digested passwords.
> Specifically the MD5 digest.  I need to
> programatically digest
> passwords entered into the application for storage
> in the users
> table (when a new user is created or password
> changed).
> 
> In the Digested Passwords section of the Realm HOWTO
> (Tomcat 4.1.10)
> there is a description of using the static Digest().
>  In order to use
> this method then I must, and I quote
> 
>    "To use either of the above techniques, the
>     $CATALINA_HOME/server/lib/catalina.jar file will
> need to be
>     on your class path to make the RealmBase class
> available."
> 
> There are a few ways to do this.  I could copy the
> catalina.jar file
> to my web application WEB-INF/lib directory.  Or, I
> could copy the
> catalina.jar file to $CATALINA_HOME/common/lib.
> 
> I don't like the first method as it is error prone
> when I move to
> the next version of Tomcat (and forget to replace
> the cataline.jar
> file).  So I'll probably go with the second method
> and copy the
> .jar file to the common/lib directory.
> 
> Should I move the file instead of copying it?
> Could I create a symbolic link instead of copying?
> Is there a better way to do this?
> 
> Thanks,
> Kevin.
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Finance - Get real-time stock quotes
> http://finance.yahoo.com
> 
> --
> To unsubscribe, e-mail:  
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
> 


__________________________________________________
Yahoo! - We Remember
9-11: A tribute to the more than 3,000 lives lost
http://dir.remember.yahoo.com/tribute

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>