aspose file tools*
The moose likes Servlets and the fly likes Authenication of a web resource Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Java 8 in Action this week in the Java 8 forum!
JavaRanch » Java Forums » Java » Servlets
Bookmark "Authenication of a web resource" Watch "Authenication of a web resource" New topic
Author

Authenication of a web resource

Hari babu
Ranch Hand

Joined: Jun 25, 2001
Posts: 208
Hi all,
I have a web resource, i specify the <auth-method> as BASIC, so whenever tries to access my page it shows him a dialog box to enter the username and the password. When the web server checks for the authenitcity of the user, where does it check ? because all my user information is database.
thanks
Harish
Maulin Vasavada
Ranch Hand

Joined: Nov 04, 2001
Posts: 1871
hi
have a llok at here
replace the use of HashTable with the database u have...
regards
maulin
Baruch Sadogursky
Ranch Hand

Joined: Apr 09, 2002
Posts: 62
Maulin's link is an example of programmatic security - i.e. you have to write the whole story yourself.
When using decarative security (like you do - via deployment descriptor) the location of usernames and passwords is server specific. If you use Tomcat look for file named tomcat-users.xml in conf directory. If not, tell me which server do you use, we'll work somethig out.
BTW, try to avoid BASIC authentication. Use Form-based instead.


Regards,<br />Baruch.<p>SDFWOF<br />FGEHWS<br />FNEVGE
chanoch wiggers
Author
Ranch Hand

Joined: May 24, 2001
Posts: 245
why avoid basic? form is no more secure since they both pass the username and password in plain text to the servlet.
also, you dont have to use the tomcat-users.xml file = tomcat has a JDBC Realm that allows you to authenticate against the details in the db.


chanoch<p><a href="http://www.amazon.com/exec/obidos/ASIN/1861007736/" target="_blank" rel="nofollow">Author of Professional Apache Tomcat</a></p>
David O'Meara
Rancher

Joined: Mar 06, 2001
Posts: 13459

Actually, Tomcat also supports LDAP-Realms which works quite nicely (better than Websphere, anyway )
Baruch Sadogursky
Ranch Hand

Joined: Apr 09, 2002
Posts: 62
I would sugest to avoid BASIC for three reasons:
  • It's not simple to log out. It can be done only programmaticly, or restart browser.
  • FORM gives you the way to style your login page.
  • The information that you can pass to user using BASIC is basic Only little string for Realm. In form - the sky is the limit. Much more flexble.

  • Besides, it shouldn't be a problem to edit tomcat-users.xml programmaticly.
    chanoch wiggers
    Author
    Ranch Hand

    Joined: May 24, 2001
    Posts: 245
    yes, but he already said that his info is on the database...
    Maulin Vasavada
    Ranch Hand

    Joined: Nov 04, 2001
    Posts: 1871
    yes. he is having database already. thats why i suggested something that can be authenticated against database.
    anyways, i am not prone to use BASIC auth i used it once. i use form base auth as well. all of them are more or less same w/ pros/cons.
    and, Baruch, I use iPlanet 4.1 as a webserver which lacks XML based configuration (so called WAR) architecture i would love to have that which is not possible for the company but thats irrelavent here.
    regards
    maulin
    Baruch Sadogursky
    Ranch Hand

    Joined: Apr 09, 2002
    Posts: 62
    Maulin, I'm not familiar with iPlanet, which way can you register users that would be available in deployment descriptor?
    Ashik Uzzaman
    Ranch Hand

    Joined: Jul 05, 2001
    Posts: 2370

    If you are interested to test a basic form-based authentication, have a look at here
    [ July 09, 2002: Message edited by: Ashik uzzaman ]

    Ashik Uzzaman
    Senior Member of Technical Staff, Salesforce.com, San Francisco, CA, USA.
    James Adams
    Ranch Hand

    Joined: Sep 12, 2003
    Posts: 188
    Originally posted by chanoch wiggers:
    why avoid basic? form is no more secure since they both pass the username and password in plain text to the servlet.
    also, you dont have to use the tomcat-users.xml file = tomcat has a JDBC Realm that allows you to authenticate against the details in the db.


    Can anyone provide information as to how this is done ? I need to replace a web application (Perl/CGI/Apache) which is doing authentication with a database table. I can find many examples of doing the authentication in Tomcat using tomcat-users.xml, but I am having a hard time finding any information on how you get the "j_security_check" of the login form to go to the database to do the authentication. For example how do you specify the URL/username/password for the database connection ? How do you specify the table to use, and how do you tell it which columns in the database table map to the username and password fields ?
    I am developing this application to be deployed on JBoss 3.2.3, which (I think) has Tomcat as its default web container. The database is Oracle 8i.
    Thanks in advance for any insight. Any references to online examples or tutorials will be very appreciated.

    -James
    James Adams
    Ranch Hand

    Joined: Sep 12, 2003
    Posts: 188
    It turns out that there are several good resources on the web, I just didn't look hard enough. Here are some links which look promising:
    http://www.huihoo.com/jboss/online_manual/3.0/ch13s78.html
    http://jakarta.apache.org/tomcat/tomcat-4.1-doc/realm-howto.html
    Still if anyone can answer any of the previous questions I posted in the previous post I'll certainly appreciate the feedback.

    -James
    [ April 23, 2004: Message edited by: James Adams ]
    Samuel Jackson
    Greenhorn

    Joined: May 02, 2004
    Posts: 2
    I'd recommend using Digest authentication over Form based or Basic, since it is much more secure than the plaintext authentication mechanisms. With Digest, only the MD5 hash of the password is sent over the network.
    Fluidlogic: http://www.keystonewebsystems.com/products/
    Fluidlogic ™
     
    I agree. Here's the link: http://aspose.com/file-tools
     
    subject: Authenication of a web resource
     
    Similar Threads
    repost: how to block direct access to jsp files?
    how to block direct access to jsp files?
    Neat Way of Writing my web.xml
    JBOSS web logon not redirecting from port 8080 to 8443 at login
    Tomcat authentication and RACF