configuration webapp with authentication

[Hugo Balder]

Hi,

I want to configuration a webapp. that runs under Tomcat with authentication via tomcat-user.xml file.
But my problem is that the browser popup window where I can type the username and the password in, does not appear.



Here is the web.xml

    
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
         version="2.4" >
 
<display-name>A sample login application</display-name>
 
    <servlet>
        <servlet-name>LogIn</servlet-name>
        <servlet-class>com.foo.LoginServlet</servlet-class>
    </servlet>
 
    <servlet-mapping>
        <servlet-name>LogIn</servlet-name>
        <url-pattern>/LogInServlet.do</url-pattern>
    </servlet-mapping>
 
    <resource-env-ref>
        <description>
            User Databasefile
        </description>
        <resource-env-ref-name>
            UserDatabase
        </resource-env-ref-name>
        <resource-env-ref-type>
            org.apache.catalina.UserDatabase
        </resource-env-ref-type>
    </resource-env-ref>
 
    <security-constraint>
        <web-recource-collection>
            <web-recource-name>login</web-recource-name>
            <url-pattern>/in/*</url-pattern>
            <url-pattern>/com/*</url-pattern>
            <url-pattern>/com/foo/*</url-pattern>
        </web-recource-collection>
        <auth-constraint>
            <role-name>manager</role-name>
        </auth-constraint>
    </security-constraint>
    
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>A sample login application</realm-name>
  </login-config>
 
  <!-- Security roles referenced by this web application -->
  <security-role>
    <description>
      The role that is required to log in to the sample Application
    </description>
    <role-name>manager</role-name>
  </security-role>
 
</web-app>

And here are some pices sever.xml

    
   .
   .
   .
  <GlobalNamingResources>
    <!-- Editable user database that can also be used by
         UserDatabaseRealm to authenticate users
    -->
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>
   .
   .
   .
  <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
         resourceName="UserDatabase" digest="MD5"/>
   .
   .
 

[Ben Souther]

I don't see any url-patterns in your security-constraint tag that match your servlet's URL.

 <url-pattern>/LogInServlet.do</url-pattern>   

[Hugo Balder]

I add the the folowing line

    
<url-pattern>/LogInServlet.do</url-pattern>

into the web.xml.
But the login popup of the browser didn't appear.


The structur of my little webapp is:

    
webapps/login/index.html
webapps/login/WEB-INF/web.xml
webapps/login/WEB-INF/classes/com/foo/LoginServlet.class
webapps/login/in/result.jsp

so I think that the URL for my LoginServlet is allready matched by the line
<url-pattern>/com/foo/*</url-pattern>
of my web.xml file.

[Jesper de Jong]

Dear "Curry Wurst",

I am one of the moderators of the JavaRanch forums. Here on JavaRanch, we have a naming policy. We want the users of JavaRanch to use a real-sounding name as their display name.

Unfortunately, your name "Curry Wurst" does not comply to the naming policy. Your display name should consist of a real-sounding first name, space, and a second name. Not only a first name, no obviously fake nickname, no initials only for the second name.

Please read the naming policy carefully and change your display name. You can change your name by editing your profile.

Please note that we are taking the naming policy seriously. If you do not change your display name, your account on JavaRanch might be locked.

Have fun on JavaRanch,
Jesper Young - Bartender

[Hugo Balder]

Sorry I didn't read the naming policy. I changed my name to BalHug I hope this is Ok.
[ March 26, 2008: Message edited by: BalHug ]

[Ulf Dittmer]

Originally posted by BalHug:
Sorry I didn't read the naming policy. I changed my name to BalHug I hope this is Ok.

Unfortunately it's not. To quote from Jesper's post:

Your display name should consist of a real-sounding first name, space, and a second name. Not only a first name, no obviously fake nickname, no initials only for the second name.

So it's missing a space, and "Bal Hug" doesn't sound real to me, either (although that could just be ignorance on my part).

[Hugo Balder]

Ok I change it from BalHug to Hugo Balder I think now it's ok.
But this will not help me by my problem.

[Ben Souther]

What is the URL that you're using when trying to log into your app?

[Hugo Balder]

http://localhost:8080/login/ for the entry of the webapp via index.html.
Here is the code of my index.html

    
<html>
Index.html
<p>
<a href="/login/LogInServlet.do">doIt</a>
<p>
<a href="/login/result.jsp">result</a>
</html>

and here is the code of the LoginServlet.java witch is under webapps/login/WEB-INF/classes/com/foo

    
package com.foo;
 
import java.io.IOException;
 
import javax.servlet.*;
import javax.servlet.http.*;
 
public class LoginServlet extends HttpServlet {
 
   public void doGet(HttpServletRequest request,
                      HttpServletResponse response)
                      throws IOException, ServletException {
      
      String s = "";
      if( request.isUserInRole("Manager")){
        s = "is Manager";
      }else {
        s = "is not Manager";
      }
      
      System.out.println(s);
      
      request.setAttribute("st",s);
      
      RequestDispatcher view = request.getRequestDispatcher("in/result.jsp");
      view.forward(request, response);
      
   }
}
 

BTW:
I am using Firefox under Windows XP
[ March 26, 2008: Message edited by: Hugo Balder ]

[Ben Souther]

Why not:

<url-pattern>/login/*</url-pattern>

?

[Hugo Balder]

Hallo Ben,

thank you for your replay I still changed the web.xml to

    
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
         version="2.4" >
 
<display-name>A sample login application</display-name>
 
    <servlet>
        <servlet-name>LogIn</servlet-name>
        <servlet-class>com.foo.LoginServlet</servlet-class>
    </servlet>
 
    <servlet-mapping>
        <servlet-name>LogIn</servlet-name>
        <url-pattern>/LogInServlet.do</url-pattern>
    </servlet-mapping>
 
    <resource-env-ref>
        <description>
            User Databasefile
        </description>
        <resource-env-ref-name>
            UserDatabase
        </resource-env-ref-name>
        <resource-env-ref-type>
            org.apache.catalina.UserDatabase
        </resource-env-ref-type>
    </resource-env-ref>
 
    <security-constraint>
        <web-recource-collection>
            <web-recource-name>login</web-recource-name>
            <url-pattern>*.jsp</url-pattern>
            <url-pattern>*.html</url-pattern>
            <url-pattern>/in/*</url-pattern>
            <url-pattern>/login/*</url-pattern>
            <url-pattern>/com/*</url-pattern>
            <url-pattern>/com/foo/*</url-pattern>
        </web-recource-collection>
        <auth-constraint>
            <description>Must authenticate before querying the system</description>
            <role-name>member</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>NONE</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
    
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>A sample login application</realm-name>
  </login-config>
 
  <!-- Security roles referenced by this web application -->
  <security-role>
    <description>
      The role that is required to log in to the sample Application
    </description>
    <role-name>member</role-name>
  </security-role>
 
</web-app>

I include your advice with the <url-pattern>/login/*</url-pattern> but nothing happens.

Here are some more information:
I use tomcat 6.0.14 under Windows XP and Firefox and IE as browser.

[Ulf Dittmer]

May we call you Egon?

If the name of your web app is "login" -and the URL you've posted suggests that it is-, then "login" should not be part of the URL patterns. Try "<url-pattern>/LogInServlet.do</url-pattern>" or, of course, "<url-pattern>/*</url-pattern>" if you want to protect everything.

[Hugo Balder]

I'ill take the strawberry ;-)

Ok, I protect everything with "<url-pattern>/*</url-pattern>" but the popup didn't appear.

So what do I wrong?

[Ben Souther]

Oops.
I missed that 'login' was the actual name of the app.

Did you restart the app after making changes to your deployment descriptor?

[Hugo Balder]

Hallo Ben,

every time I changed the deployment descriptor, I restart Tomcat and Firefox.