Login Window in Html page Apache style

[George Joseph]

Hello Java Ranchers,

How to generate A Login window of the format
------------------------------------------------------
Enter Network Password
Please type your user name and password
Site :
Realm :
User Name _________
Password _________
ok cancel
-----------------------------------------------------
I want a Login window like the above which seems to be seperated from the web page
What is the required JSP/ HTML code for this
In many new sites we see this type of Login window mostly apacehe sites
form
George Joseph

[James Swan]

This is called Basic Authentication and depends on what HTTP server you are using for how to set it.
Some HTTP servers simply have the requirement of placing a special file (eg .htaccess) in a directory you want to protect. The file contains a list of valid users, and when the browser tries to access anything in that directory they are asked to authenticate.
You would really need to look up the Apache manual for how to set this.
Another approach from JSP/Servlets and to modify the HTTP headers sent back to the browser specifying that Basic Authentication is required.
But easiest is just let the HTTP server worry about it.
James.

[James Swan]

Here is an example of a Servlet performing Basic Authentication:

package mypackage;
import java.io.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class BasicAuthentication extends HttpServlet { 
    Hashtable users = new Hashtable();
    public void init(ServletConfig config) throws ServletException {
        super.init(config);
        // put userName :password
        users.put("User1:hello","allowed");
        users.put("User2:xxx","allowed");
        // this user requires no password
        users.put("User3:","allowed");
    }
    public void doGet(HttpServletRequest req, HttpServletResponse res)
                               throws ServletException, IOException {
        res.setContentType("text/plain");
        PrintWriter out = res.getWriter();
        // Get Authorization header
        String auth = req.getHeader("Authorization");
        // Do we allow that user?
        if (!allowUser(auth)) {
            // Not allowed, so report he's unauthorized
            res.setHeader("WWW-Authenticate", "BASIC realm=\"test_realm\"");
            res.sendError(res.SC_UNAUTHORIZED);
            // Could offer to add him to the allowed user list
        } else {
            // Allowed, so show him the secret stuff
            out.println("Top-secret stuff");
        }
    }
    // This method checks the user information sent in the Authorization
    // header against the database of users maintained in the users Hashtable.
    protected boolean allowUser(String auth) throws IOException {
        if (auth == null) {
            return false;  // no auth
        }
        if (!auth.toUpperCase().startsWith("BASIC ")) { 
            return false;  // we only do BASIC
        }
        // Get encoded user and password, comes after "BASIC "
        String userpassEncoded = auth.substring(6);
        // Decode it, using any base 64 decoder
        sun.misc.BASE64Decoder dec = new sun.misc.BASE64Decoder();
        String userpassDecoded = new String(dec.decodeBuffer(userpassEncoded));
    
        // Check our user list to see if that user and password are "allowed"
        if ("allowed".equals(users.get(userpassDecoded))) {
            return true;
        } else {
            return false;
        }
    }
}

James
[This message has been edited by james swan (edited November 06, 2001).]

[George Joseph]

Hi James,
Thanks for your prompt and valuable response
regards
George Joseph

Originally posted by james swan:
[B]Here is an example of a Servlet performing Basic Authentication:

package mypackage;
import java.io.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class BasicAuthentication extends HttpServlet { 
    Hashtable users = new Hashtable();
    public void init(ServletConfig config) throws ServletException {
        super.init(config);
        // put userName  [img]http://www.javaranch.com/ubb/tongue.gif[/img]assword
        users.put("User1:hello","allowed");
        users.put("User2:xxx","allowed");
        // this user requires no password
        users.put("User3:","allowed");
    }
    public void doGet(HttpServletRequest req, HttpServletResponse res)
                               throws ServletException, IOException {
        res.setContentType("text/plain");
        PrintWriter out = res.getWriter();
        // Get Authorization header
        String auth = req.getHeader("Authorization");
        // Do we allow that user?
        if (!allowUser(auth)) {
            // Not allowed, so report he's unauthorized
            res.setHeader("WWW-Authenticate", "BASIC realm=\"test_realm\"");
            res.sendError(res.SC_UNAUTHORIZED);
            // Could offer to add him to the allowed user list
        } else {
            // Allowed, so show him the secret stuff
            out.println("Top-secret stuff");
        }
    }
    // This method checks the user information sent in the Authorization
    // header against the database of users maintained in the users Hashtable.
    protected boolean allowUser(String auth) throws IOException {
        if (auth == null) {
            return false;  // no auth
        }
        if (!auth.toUpperCase().startsWith("BASIC ")) { 
            return false;  // we only do BASIC
        }
        // Get encoded user and password, comes after "BASIC "
        String userpassEncoded = auth.substring(6);
        // Decode it, using any base 64 decoder
        sun.misc.BASE64Decoder dec = new sun.misc.BASE64Decoder();
        String userpassDecoded = new String(dec.decodeBuffer(userpassEncoded));
    
        // Check our user list to see if that user and password are "allowed"
        if ("allowed".equals(users.get(userpassDecoded))) {
            return true;
        } else {
            return false;
        }
    }
}

James
[This message has been edited by james swan (edited November 06, 2001).][/B]

[Pedro Garcia]

I put the Servlet below but, when I make the call from a from, send me:
HTTP Status 405 - The specified HTTP method is not allowed for the requested resource
type Status report
description The specified HTTP method is not allowed for the requested resource

<form method="POST" action="servlet/BasicAuthentication" >
  <table border="0" cellspacing="5">
    <tr>
      <th align="right">Username:</th>
      <td align="left"><input type="text" name="j_username"></td>
    </tr>
    <tr>
      <th align="right">Password:</th>
      <td align="left"><input type="password" name="j_password"></td>
    </tr>
    <tr>
      <td align="right"><input type="submit" value="Log In"></td>
      <td align="left"><input type="reset"></td>
    </tr>
  </table>
</form>

How can I test this Servlets