Bob CHOI

if security mechanism is concerned simply with authentication(A) and authorization(A), the scenarioes below demostrate how the basics work.

assumption:

- client access to "hello.jsp" is required to be AAed
- hello.jsp is located under web app root "myapp"
- Tomcat has created a few default user-password-role mapping, we'll use the one "tomcat-tomcat-tomcat"

hello.jsp:

hello <%= request.getRemoteUser() %>

web.xml config-1:

<?xml version="1.0" encoding="ISO-8859-1"?> <web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee <a href="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"" target="_blank" rel="nofollow">http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"</a> > <security-constraint> <web-resource-collection> <web-resource-name>my-dmz</web-resource-name> <url-pattern>/hello.jsp</url-pattern> </web-resource-collection> [B]<auth-constraint> <role-name>tomcat</role-name> </auth-constraint>[/B] </security-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config> </web-app>

call flow:

1. client requesting http://localhost/myapp/hello.jsp
2. server asking for authentication
3. client popping up authentication window
4. user typing "tomcat", "tomcat"
5. client requesting http://localhost/myapp/hello.jsp with encoded authentication info
6. server verifying and authorizing the access
7. "hello tomcat" returning to client

web.xml config-2: use "*" for permitting all roles

<auth-constraint> <role-name>*</role-name> </auth-constraint>

except from servlet spec p143 $17

"The auth-constraint indicates the user roles that should be permitted access to this resource collection."

- Did the servlet intend to send 403?
- If not, restart the browser you'll get through, "*" means all user roles are allowed to gain access to those resources you mean.
- add declaratives below to web.xml, then authentication will pop up
<login-config> <auth-method>BASIC</auth-method> </login-config>
[ January 14, 2007: Message edited by: Bob CHOI ]

Hi Jasiek

Sorry, i was mistaked about "rtexprvlaue" - it's all about attribute. The behavior on both code snippets might actually depend on "body-content" setting on c:set and jsp:attribute.

"body-content" has four optional values:
- empty
- scriptless
- jsp
- tagdependant

Therefore, "body-content=tagdependant" could cause them to act "irregually" till we find out how the tag handlers work accordingly.

Hi Jasiek

jsp:attribute might declare not accepting ELed stuff providing that it had used declarative "rtexprvalue=false".

Howerver the problem on the 2nd code snippet seems strange to me, too.

Go on with "dynamic" attribute a little bit below

tag form 3: dynaAttrName="value"
converted to: javax.servlet.jsp.tagext.DynamicAttributes:setAttribute(namespace,dynaAttrName,value),
inside the setter, we can code below,

{
pageContext.setAttribute(dynaAttrName,value,PageContext.REQUEST_SCOPE);
}

tag form 4: dynaAttrName="${name}"
converted to: javax.servlet.jsp.tagext.DynamicAttributes:setAttribute(namespace,dynaAttrName,value=getValue(name)),
inside the setter, we can code similar to above.

let's explore how tag handler classes use setter to deal with attributes.

tag form 1: attribute="name"
converted to: setAttribute(name),
inside the setter, we can code below,

{
name instanceof String?this.value=getValue(name):throw new Exception();
}

tag form 2: attribute="${name}"
converted to: setAttribute(value=getValue(name)),
inside the setter, we can code below,

{
this.value=value;
}

In the handlers we can continue set/get properties of value normally if it is bean object, otherwise an exception is thrown.
[ January 12, 2007: Message edited by: Bob CHOI ]

The "target" attribute may accept ELed/expressed value when "rtexprvalue" is turned on in tld. "Unforturnately" here it IS the case.

We can use jsp:bean to create any type, which has non-parameterized constructor i assume. If such type without public setter, not so much pratical use can be foreseen since its object state is unable to be updated by standard action or jstl. Right?

just once more tiny try, i see: jsp:useBean actually does "tag:useObject" 2!!!

In jsp, we can use jsp:useBean to create a bean object.

Can we create other type of object with standard action or jstl than scripting e.g. <% request.setAttribute("name", new Object()) %>?

Probably we have to write our own custom tag "tag:useObject" for it, do we? :roll:

output:

default text

new text

tag hanlder class InnerTag

package p; import java.util.*; import java.io.*; import javax.servlet.jsp.*; import javax.servlet.jsp.tagext.*; public class InnerTag extends BodyTagSupport { private OuterTag ot; private BodyContent bc; //Step 4 public void setInnerAttributeName(String value) { setValue("innerAttributeName", value); } //Step 5 public int doStartTag() throws JspException { ot = (OuterTag)findAncestorWithClass(this, OuterTag.class); //ot = (OuterTag)getParent(); //convenience mothod to above Object innerAttributeValue = getValue("innerAttributeName"); Object outerAttributeValue = ot.getValue("outerAttributeName"); if (innerAttributeValue.equals(outerAttributeValue)) return EVAL_BODY_BUFFERED; else return SKIP_BODY; } //Step 6 public void setBodyContent(BodyContent bc) { this.bc = bc; } //Step 7 public int doAfterBody() throws JspException { try { String innerTextValue = bc.getString(); ot.setValue("outerTextName", innerTextValue); } catch (Exception e) { System.out.println("InnerTag: " + e); } return SKIP_BODY; } }

[ January 12, 2007: Message edited by: Bob CHOI ]
[ January 12, 2007: Message edited by: Bob CHOI ]

tag handler class OuterTag

package p; import java.util.*; import java.io.*; import javax.servlet.jsp.*; import javax.servlet.jsp.tagext.*; public class OuterTag extends TagSupport { private PageContext pc; //Step 1 public void setPageContext(PageContext pc) { this.pc = pc; setValue("outerTextName", "default text"); } //Step 2 public void setOuterAttributeName(String outerAttributeValue){ setValue("outerAttributeName", outerAttributeValue); } //Step 3 public int doStartTag() throws JspException { return EVAL_BODY_INCLUDE; } //Step 8 public int doEndTag() throws JspException { try { JspWriter jw = pc.getOut(); Object outerTextValue = getValue("outerTextName"); jw.println(outerTextValue + "<p>"); } catch (Exception e) { System.out.println("OuterTag: " + e); } return EVAL_PAGE; } }

tld

<?xml version="1.0" encoding="UTF-8"?> <taglib xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee web-jsptaglibrary_2_0.xsd" version="2.0"> <tlib-version>1.0</tlib-version> <uri>http://my-tag-world.com</uri> <tag> <name>outer</name> <tag-class>p.OuterTag</tag-class> <body-content>JSP</body-content> <attribute> <name>outerAttributeName</name> <required>true</required> </attribute> </tag> <tag> <name>inner</name> <tag-class>p.InnerTag</tag-class> <body-content>JSP</body-content> <attribute> <name>innerAttributeName</name> <required>true</required> </attribute> </tag> </taglib>