You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by Christopher Golden <go...@auburn.edu> on 2004/05/25 16:25:49 UTC
Re: J2EE security? [was: Re: New Wishlist feature [WAS: Re:
Invalidating a session (log out)]]
This was from a few weeks ago but I just looked it over and it looks
close to what I need. The problem is that Spindle complains about having
multiple Tapestry servlets in the "web.xml" file. In addition to this
after looking at the Servlet 2.4 spec I'm not sure how I can make my
Login page use the format specified for "FORM" authentication. This
requires that the Action be "j_security_check" and the text fields be
"j_username" and "j_password" respectively.
I have tried to put the login.application file in a login directory
under WEB-INF since something like that was mentioned in the developer
guide but this made no visible change. What do I need to do to have the
application use my login page for authentication and then use my
application when authenticated?
--
Christopher M. Golden
IT Specialist
Auburn University Environmental Institute
>>> erik@ehatchersolutions.com 5/11/2004 7:07:30 PM >>>
On May 11, 2004, at 6:08 PM, Richard Lewis-Shell wrote:
> Hi Erik,
>
> Are you able to share any more details on how you use J2EE security
> with
> Tapestry?
Sure. Here's the heart of it, web.xml:
<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web
Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>WordNet</display-name>
<filter>
<filter-name>redirect</filter-name>
<filter-class>org.apache.tapestry.RedirectFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>redirect</filter-name>
<url-pattern>/</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>WordNet</servlet-name>
<servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet>
<servlet-name>login</servlet-name>
<servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>WordNet</servlet-name>
<url-pattern>/app</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>login</servlet-name>
<url-pattern>/login</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>120</session-timeout>
</session-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>Secured</web-resource-name>
<description></description>
<url-pattern>/app/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description></description>
<role-name>tomcat</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login</form-login-page>
<form-error-page>/login</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>tomcat</role-name>
</security-role>
</web-app>
So I have a login.application and WordNet.application.
login.application is this:
<?xml version="1.0"?>
<!DOCTYPE application PUBLIC
"-//Apache Software Foundation//Tapestry Specification 3.0//EN"
"http://jakarta.apache.org/tapestry/dtd/Tapestry_3_0.dtd">
<application name="Login">
<page name="Home" specification-path="Login.page"/>
<library id="contrib"
specification-path="/org/apache/tapestry/contrib/Contrib.library"/>
</application>
And WordNet.application has nothing special in it for security. That's
it, really. And then, of course, you can add the logout piece that
folks have posted recently.
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
Re: J2EE security? [was: Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]]
Posted by Erik Hatcher <er...@ehatchersolutions.com>.
On May 25, 2004, at 10:25 AM, Christopher Golden wrote:
> This was from a few weeks ago but I just looked it over and it looks
> close to what I need. The problem is that Spindle complains about
> having
> multiple Tapestry servlets in the "web.xml" file.
All I can say here is that I use IntelliJ :)
> In addition to this
> after looking at the Servlet 2.4 spec I'm not sure how I can make my
> Login page use the format specified for "FORM" authentication. This
> requires that the Action be "j_security_check" and the text fields be
> "j_username" and "j_password" respectively.
My Login.html uses the standard J2EE j_security_check stuff - nothing
out of the ordinary there. The *only* reason I use a Tapestry page for
the login page is to have our custom Border work with it. If you don't
have look-and-feel issues to worry about, just use a login.jsp page for
the login page - it is irrelevant what type of page it is.
> I have tried to put the login.application file in a login directory
> under WEB-INF since something like that was mentioned in the developer
> guide but this made no visible change.
My login.application file is directly under WEB-INF, not a
subdirectory. Maybe this is the problem?
> What do I need to do to have the
> application use my login page for authentication and then use my
> application when authenticated?
Nothing more than you see below other than a Login.html page, or switch
to using a login.jsp if that makes life a bit easier.
Erik
>
>
> --
> Christopher M. Golden
> IT Specialist
> Auburn University Environmental Institute
>
>>>> erik@ehatchersolutions.com 5/11/2004 7:07:30 PM >>>
>
> On May 11, 2004, at 6:08 PM, Richard Lewis-Shell wrote:
>
>> Hi Erik,
>>
>> Are you able to share any more details on how you use J2EE security
>> with
>> Tapestry?
>
> Sure. Here's the heart of it, web.xml:
>
> <?xml version="1.0"?>
> <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web
> Application 2.3//EN"
> "http://java.sun.com/dtd/web-app_2_3.dtd">
> <web-app>
> <display-name>WordNet</display-name>
>
> <filter>
> <filter-name>redirect</filter-name>
> <filter-class>org.apache.tapestry.RedirectFilter</filter-class>
> </filter>
>
> <filter-mapping>
> <filter-name>redirect</filter-name>
> <url-pattern>/</url-pattern>
> </filter-mapping>
>
> <servlet>
> <servlet-name>WordNet</servlet-name>
>
> <servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
> <load-on-startup>0</load-on-startup>
> </servlet>
>
> <servlet>
> <servlet-name>login</servlet-name>
>
> <servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
> <load-on-startup>0</load-on-startup>
> </servlet>
>
> <servlet-mapping>
> <servlet-name>WordNet</servlet-name>
> <url-pattern>/app</url-pattern>
> </servlet-mapping>
>
> <servlet-mapping>
> <servlet-name>login</servlet-name>
> <url-pattern>/login</url-pattern>
> </servlet-mapping>
>
> <session-config>
> <session-timeout>120</session-timeout>
> </session-config>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>Secured</web-resource-name>
> <description></description>
> <url-pattern>/app/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <description></description>
> <role-name>tomcat</role-name>
> </auth-constraint>
> </security-constraint>
>
> <login-config>
> <auth-method>FORM</auth-method>
> <form-login-config>
> <form-login-page>/login</form-login-page>
> <form-error-page>/login</form-error-page>
> </form-login-config>
> </login-config>
>
> <security-role>
> <role-name>tomcat</role-name>
> </security-role>
>
>
> </web-app>
>
> So I have a login.application and WordNet.application.
> login.application is this:
>
> <?xml version="1.0"?>
> <!DOCTYPE application PUBLIC
> "-//Apache Software Foundation//Tapestry Specification 3.0//EN"
> "http://jakarta.apache.org/tapestry/dtd/Tapestry_3_0.dtd">
>
> <application name="Login">
>
> <page name="Home" specification-path="Login.page"/>
>
> <library id="contrib"
> specification-path="/org/apache/tapestry/contrib/Contrib.library"/>
> </application>
>
> And WordNet.application has nothing special in it for security. That's
>
> it, really. And then, of course, you can add the logout piece that
> folks have posted recently.
>
> Erik
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org