J2EE security? [was: Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]]

[Richard Lewis-Shell <rl...@mac.com>]

Hi Erik,

Are you able to share any more details on how you use J2EE security with
Tapestry?

Richard

----- Original Message ----- 
From: "Erik Hatcher" <er...@ehatchersolutions.com>
To: "Tapestry users" <ta...@jakarta.apache.org>
Sent: Wednesday, May 12, 2004 2:05 AM
Subject: Re: New Wishlist feature [WAS: Re: Invalidating a session (log
out)]


> On May 11, 2004, at 9:46 AM, Vjeran Marcinko wrote:
> > I tried, and no good also.
> > It works in VLib example because Home page isn't secured page.
> > I have quite common case I think :
> > - *whole* application is secured, that means even Home page has
> > pageValidate() method implemented in such way that it redirects to
> > Login
> > page if Visit doesn't contain user specific data (user isn't logged in)
>
>
> Securing the *whole* application is not possible, unless your login
> page is unsecured.
>
> We 'hack' around this by having an unsecured login.application (again,
> J2EE security at work here), and then the real .application.  So we
> have two Tapestry servlet mappings in web.xml (Spindle doesn't like
> this - but it is perfectly legal), one is secured to a particular role.
>
> Erik
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org

Re: J2EE security? [was: Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]]

[Erik Hatcher <er...@ehatchersolutions.com>]

On May 11, 2004, at 6:08 PM, Richard Lewis-Shell wrote:

> Hi Erik,
>
> Are you able to share any more details on how you use J2EE security 
> with
> Tapestry?

Sure.  Here's the heart of it, web.xml:

<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web 
Application 2.3//EN"
  "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
   <display-name>WordNet</display-name>

   <filter>
     <filter-name>redirect</filter-name>
     <filter-class>org.apache.tapestry.RedirectFilter</filter-class>
   </filter>

   <filter-mapping>
     <filter-name>redirect</filter-name>
     <url-pattern>/</url-pattern>
   </filter-mapping>

   <servlet>
     <servlet-name>WordNet</servlet-name>
     
<servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
     <load-on-startup>0</load-on-startup>
   </servlet>

   <servlet>
     <servlet-name>login</servlet-name>
     
<servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
     <load-on-startup>0</load-on-startup>
   </servlet>

   <servlet-mapping>
     <servlet-name>WordNet</servlet-name>
     <url-pattern>/app</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
     <servlet-name>login</servlet-name>
     <url-pattern>/login</url-pattern>
   </servlet-mapping>

   <session-config>
     <session-timeout>120</session-timeout>
   </session-config>

   <security-constraint>
     <web-resource-collection>
       <web-resource-name>Secured</web-resource-name>
       <description></description>
       <url-pattern>/app/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
       <description></description>
       <role-name>tomcat</role-name>
     </auth-constraint>
   </security-constraint>

   <login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
       <form-login-page>/login</form-login-page>
       <form-error-page>/login</form-error-page>
     </form-login-config>
   </login-config>

   <security-role>
     <role-name>tomcat</role-name>
   </security-role>


</web-app>

So I have a login.application and WordNet.application.  
login.application is this:

<?xml version="1.0"?>
<!DOCTYPE application PUBLIC
   "-//Apache Software Foundation//Tapestry Specification 3.0//EN"
   "http://jakarta.apache.org/tapestry/dtd/Tapestry_3_0.dtd">

<application name="Login">

   <page name="Home" specification-path="Login.page"/>

   <library id="contrib" 
specification-path="/org/apache/tapestry/contrib/Contrib.library"/>
</application>

And WordNet.application has nothing special in it for security.  That's 
it, really.  And then, of course, you can add the logout piece that 
folks have posted recently.

	Erik



---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org