Problem with applet in jar file accessed from JSP page in area protected with a security constraint.

[Jim Solderitsch <jj...@bellatlantic.net>]

The problem occurs under my test environment which is a Mac Powerbook  
G4 running OS X 10.2.6 with Java Plug-in 1.4.1_01. I am running tomcat  
on this machine.

I am trying to first install and then extend a web application that is  
deployed under tomcat 4.1.24.

There is a login based configuration for most of the pages of the site  
-- I have <security-contstraint> tags and a <login-config> section in  
my applications web.xml file.

My problem is this:

One of the protected pages is a jsp (map.jsp) page that has an applet  
tag. This tag references a jar file that is also contained in the same  
protected folder (called /protected) as the jsp page.

When I login and access the page with the applet, in my java console I  
see the exception:

java.lang.ClassFormatError: com/gestalt/sgs/client/MapAsset (Bad magic  
number)
	at java.lang.ClassLoader.defineClass0(Native Method)
	at java.lang.ClassLoader.defineClass(ClassLoader.java:502)
	at  
java.security.SecureClassLoader.defineClass(SecureClassLoader.java:123)
	at sun.applet.AppletClassLoader.findClass(AppletClassLoader.java:148)
	at  
sun.plugin.security.PluginClassLoader.findClass(PluginClassLoader.java:1 
68)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:299)
	at sun.applet.AppletClassLoader.loadClass(AppletClassLoader.java:114)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:255)
	at sun.applet.AppletClassLoader.loadCode(AppletClassLoader.java:501)
	at sun.applet.AppletPanel.createApplet(AppletPanel.java:574)
	at sun.plugin.AppletViewer.createApplet(AppletViewer.java:1828)
	at sun.applet.AppletPanel.runLoader(AppletPanel.java:503)
	at sun.applet.AppletPanel.run(AppletPanel.java:292)
	at java.lang.Thread.run(Thread.java:554)


The applet apparently is never retrieved from the server. I am using  
Apple's Safari browser for this test, but the applet also fails to load  
using Mozilla 1.4 which uses the 1.4.1 plug-in.

Interesting point 1:

If I access my application from a Windows machine (running XP  
Professional with IE and Sun's Java plug-in 1.4.1), the applet DOES  
load and the application works.

Interesting point 2:

If I move the applet's jar file and the JSP page containing the applet  
tag to another part of application's folder hierarchy, NOT inside the  
protected area, and then change the pages that refer to this page to  
use the new location, the applet can be invoked from the enclosing page  
on my test Powerbook with Safari.

I asked on the Mac Java dev mailing list about this and got some ideas  
but no definitive answers.

Anyone with more tomcat experience than I (I have dabbled over the  
years but have not done anything recently) care to interpret this  
phenomenon.

My applet tag inside of map.jsp looks like:

    <applet
       archive="client.jar"
       code="com.gestalt.sgs.client.MapAsset"
       height=1 width=1>
       <param name="MAP_SET_NAME"
              value="<%= mappingSetName %>">
       <param name="SOURCE"
              value="<%= endPoints [0] %>">
       <param name="DEST"
              value="<%= endPoints [1] %>">
    </applet>


As I said above, the jar file is located in the same folder as the jsp.  
All of the pages are part of the folder pattern defined in the tag:

    <security-constraint>
       <web-resource-collection>
          <web-resource-name>SGS Authorized Pages</web-resource-name>
          <!--URL pattern should be relative to the application:-->
          <!--i.e., "/*", not "/HSP/*"-->
          <url-pattern>/protected/*</url-pattern>
       </web-resource-collection>
       <auth-constraint>
          <role-name>user</role-name>
       </auth-constraint>
    </security-constraint>

inside the application's web.xml file.

I would rather not move the problem page and applet to a non-protected  
area of my folder hierarchy. But the only way I can get the applet to  
load in my development and test environment is to make this re-location.

Any thoughts/advice appreciated.

Jim Solderitsch
jjsban@bellatlantic.net


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org