form authenticaiton using https

Greenhorn

Posts: 29

posted 11 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

hello ,i am implementing form authentication using https.but i am not sure where to place tomcat-config.xml file & what is the role of server.xml file .i am using eclipse ide.can anyone help me out .i am posting my code as follows:

login.html

web.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns="http://java.sun.com/xml/ns/javaee"
 xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
 http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0">
  <display-name>FormSecurityUsingSSL</display-name>
  <welcome-file-list>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
  
  <servlet>
    <servlet-name>TestServlet</servlet-name>
    <servlet-class>org.demo.TestServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>TestServlet</servlet-name>
    <url-pattern>/test</url-pattern>
  
  </servlet-mapping>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Wild card means whole app require authentication</web-resource-name>
      <url-pattern>/*</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>tomcat</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
   	
  <login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/login.html</form-login-page>
      <form-error-page>/login-failed.html</form-error-page>
    </form-login-config>
  </login-config>
</web-app>

TestServlet.java

package org.demo;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.Enumeration;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet implementation class TestServlet
 */
@WebServlet("/TestServlet")
public class TestServlet extends HttpServlet {
	private static final long serialVersionUID = 1L;
       
    /**
     * @see HttpServlet#HttpServlet()
     */
    public TestServlet() {
        super();
        // TODO Auto-generated constructor stub
    }

/**
	 * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doGet(HttpServletRequest request, HttpServletResponse response) thro
             ws ServletException, IOException 
	{
		
		response.setContentType("text/html");		
		PrintWriter out=response.getWriter();		
		
		Enumeration headerNames=request.getHeaderNames();
		
		while(headerNames.hasMoreElements())
		{
			String headerName=(String)headerNames.nextElement();
			out.print("<br/> Header Name : <em> "+headerName);
			String headerValue=request.getHeader(headerName);
			out.print("<br/> Header Name : <em> "+headerValue);
		}	
	}

/**
	 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doPost(HttpServletRequest request, HttpServletResponse response)
         throws ServletException, IOException {
		// TODO Auto-generated method stub
	}
}

WebContent->WEB-INF->tomcat-users.xml

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
<
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
  
 >
  <role rolename="manager"/>
  <role rolename="admin"/>
  <user username="admin" password="admin" roles="admin,manager"/>
  	
  
  
  <Connector port="8080" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" redirectPort="4321" acceptCount="100"
               connectionTimeout="20000" disableUploadTimeout="true" />
               
    <Connector port="4321" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
</tomcat-users>

need help

Tim Holloway

Saloon Keeper

Posts: 28430

210

I like...

posted 11 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Eclipse has little to do with it other than that the WTP Tomcat runner makes a mess of things. I use the sysdeo plug-in instead, as it uses Tomcat's actual configuration information instead of an incomplete and easily-outdated clone the way the WTP plugin does.

Tomcat's server.xml is the master configuration file for Tomcat. It contains the elements that wire Tomcat's components together into an actual webapp server as well as server-global definitions. You can also define webapp contexts in server.xml, but you should not. Webapp contexts should either be defined as a separate META-INF/context.xml file in the webapp WAR or as an xml file in TOMCAT_HOME/conf/Catalina/localhost.

Security can be defined either at the global level (server.xml) or at the per-application level (context). Usually I do it at the context level, unless there's a site-wide security policy in effect or I'm using a Single Signon configuration (which, by definition is global).

The actual authentication and authorization for container-managed (J2EE standard) security is managed by the security Realm. The Realm uses plug-in components to allow a wide variety of choices for security references, including text files such as tomcat-users.xml, databases, LDAP/Active Directory and more (including custom plug-ins).

The tomcat-users.xml file was originally created for the Tomcat MemoryRealm plugin. I believe that the actual location of this file was configurable, but the default location was the TOMCAT_HOME/conf directory where server.xml also resides. The MemoryRealm is not really designed for production work. For one thing, if you wanted to add a user or change a role, you had to not only edit the tomcat-users.xml file, you had to restart Tomcat, since this file was only read at startup. Plus, as far as I know, it thereafter resided in RAM, so lots and lots of users and roles would make it eat into memory otherwise usable for webapps.

Since about Tomcat 6, one or 2 other Realm plugins were added that can also read tomcat-users.xml but are more flexible about it. However, the best use for MemoryRealm and its relatives is for testing or very small simple sites with few users. Serious production sites will generally want to employ a database or directory server or something whose uses go beyond the local server.

Often the most important part of the news is what they didn't tell.

Who knew that furniture could be so violent? Put this tiny ad out there to see what happens:

Smokeless wood heat with a rocket mass heater

https://woodheat.net