John Paul Hoey

Its now working - but in Chrome and not Edge.

It seems to be browser related.

Strange that since I updated the app to run on Tomcat 10 and moved to a DataSourceRealm, Edge has stopped working.

PS  I've also just noticed I have posted this in the wrong section as it should probably be under security - apologies. Feel free to move if required.

Hi,

I recently upgraded a working web application which utilises JDBCRealm to Tomcat 10 however it stopped working. Further investigations found that JDBCRealm is now deprecated with Tomcat 10 therefore I have implemented DataSourceRealm.

The connection to the database using DataSourceRealm appears to be fine.

Now, however, when I attempt to log into the application using form authentication I am getting a server 408 response. Strangely, when I enter invalid credentials the invalid credentials page is being displayed.

I have performed a quick Google for a solution however the answers that I find don't seem to fix the issue.

I'm not sure why changing from JDBCRealm to DataSourceRealm would cause this issue however I'm hoping developers with more knowledge and experience than myself may be able to help me.

For info, here are the resource and realm tags from my context.xml file:

<Resource name="jdbc/login_details"                auth="Container"                type="javax.sql.DataSource"                maxTotal="100" maxIdle="30" maxWaitMillis="10000"                username="root" password="sesame"                driverClassName="com.mysql.cj.jdbc.Driver"                url="jdbc:mysql://localhost:3306/login_details"/>                  <Realm className="org.apache.catalina.realm.DataSourceRealm"                      dataSourceName="jdbc/login_details" localDataSource="true" userTable="userpass"                      userRoleTable="userrole" userNameCol="Username" userCredCol="Password"                      roleNameCol="role">                </Realm>

And here is my web.xml file:

<login-config>        <auth-method>FORM</auth-method>        <form-login-config>            <form-login-page>/Web-pages/Home/login.html</form-login-page>            <form-error-page>/Web-pages/Home/login_error.html</form-error-page>        </form-login-config>    </login-config>

I have left the server.xml file as default.

If you would like me to submit any more code then please let me know. Thanks

Just a quick update to inform anyone who may be interested that I managed to get my code to work. There where two issues:

1) The reference transforms were being added to the arraylist in the incorrect order, the ordering has to be the other way around as follows:

transformList.add(envTransform); transformList.add(exc14nTranform);

2) The white space between the elements of the XML that was being loaded by my code had to be removed. I did this using the following code:

public static ByteArrayInputStream TrimWhiteSpaceFromXml()    {                ByteArrayInputStream xmlStream = null;                try        {                        String thisLine = "";            String xmlString = "";            BufferedReader br = new BufferedReader(new FileReader("C:\\MyFile.xml"));                        while ((thisLine = br.readLine()) != null)            {                xmlString = xmlString + thisLine.trim();            }            br.close();                        xmlStream = new ByteArrayInputStream(xmlString.getBytes());                        // Print out details of loaded XML file            int n = xmlStream.available();            byte[] bytes = new byte[n];            xmlStream.read(bytes, 0, n);            String s = new String(bytes, StandardCharsets.UTF_8);            xmlStream.reset();            System.out.println("Input XML: " + s);                      }        catch (IOException ex)        {            ex.printStackTrace();        }                    return xmlStream;    }

Once I had performed the above, the digital signatures included within my XML worked as expected.

Just to add, I used the following code to also verify my digital signatures worked:

public class Validate {        public static boolean verify()    {        boolean verificationResult = false;        try        {            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();            dbf.setNamespaceAware(true);            Document signedDocument = dbf.newDocumentBuilder().parse("C:\\MyFile.xml");            NodeList nl = signedDocument.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");                        if (nl.getLength() == 0)            {                throw new IllegalArgumentException("Cannot find Signature element");            }            XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");            DOMValidateContext valContext = new DOMValidateContext(GetPublicKey(), nl.item(0));            XMLSignature signature = fac.unmarshalXMLSignature(valContext);            verificationResult = signature.validate(valContext);                              }        catch (Exception e)        {            System.out.println("Error while verifying digital siganature" + e.getMessage());            e.printStackTrace();        }            return verificationResult;    }      public static PublicKey GetPublicKey()    {        PublicKey publicKey = null;        FileInputStream is = null;                try        {            is = new FileInputStream("C:\\MyJavaKeyStore.jks");            KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());            keystore.load(is, "changeit".toCharArray());            String alias = "Alias";            Key key = keystore.getKey(alias, "password".toCharArray());            if (key instanceof PrivateKey)            {                // Get certificate of public key                //java.security.Certificate cert = (java.security.Certificate) keystore.getCertificate(alias);                X509Certificate cert = (X509Certificate) keystore.getCertificate(alias);                // Get public key                publicKey = cert.getPublicKey();                            }          }        catch (FileNotFoundException ex)        {        }        catch (KeyStoreException | NoSuchAlgorithmException | CertificateException | UnrecoverableKeyException | IOException ex)        {        }        finally        {            try            {                is.close();            }            catch (IOException ex)            {                ex.printStackTrace();            }        }                        return publicKey;    }     }

Hopefully the above may help someone in the future.

We have an unsupported application at my place of work which digitally signs XML messages using a certificate from a keystore that we want to replace. Im attempting to write a replacement application using Java however when I sign the XML, the generated digital signatures between both the existing application and my Java code are different. As the existing application obviously works Im not sure what is wrong with my Java code.

The digital signatures generated between both the existing application and my Java code are exactly the same except from the digest value and the signature value.

Here is the digital signature that is generated:

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">            <SignedInfo>                <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>                <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                <Reference URI="">                    <Transforms>                        <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>                    </Transforms>                    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>                    <DigestValue>Amj4gpGgVaLsiuaU0gceXYUazOI=</DigestValue>                </Reference>            </SignedInfo>            <SignatureValue>hwbSkMimeA0ib4OADR64L1bO75vPnt3d6ULZtmVOW0hCx3vtEM/IR80IdLgYf1FDOjKZi+no37hU9Rv0KOPPqvN5PK8mFdFSe4N9DTLsGym8/iCDnMoepRpKdoGwZjFFmi/iyBZDuZQD84O7JkeE76tc254gEM7bhX9okFLEL/A=</SignatureValue>            <KeyInfo>                <X509Data>                    <X509IssuerSerial>                        <X509IssuerName>DC=local, DC=PR-CA, CN=Organisation</X509IssuerName>                        <X509SerialNumber>290432545904520689811773</X509SerialNumber>                    </X509IssuerSerial>                </X509Data>            </KeyInfo>        </Signature>

Here is the code that I use to generate the digital signature:

XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM"); Transform exc14nTranform = fac.newTransform("http://www.w3.org/TR/2001/REC-xml-c14n-20010315", (TransformParameterSpec) null); Transform envTransform = fac.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null); List<Transform> transformList = new ArrayList(); transformList.add(exc14nTranform); transformList.add(envTransform); Reference ref = fac.newReference("", fac.newDigestMethod(DigestMethod.SHA1, null), transformList,null, null); SignedInfo si = fac.newSignedInfo(fac.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE,(C14NMethodParameterSpec) null),fac.newSignatureMethod(SignatureMethod.RSA_SHA1, null), Collections.singletonList(ref)); KeyStore ks = KeyStore.getInstance("JKS"); ks.load(new FileInputStream("C:\\keystore.jks"), "changeit".toCharArray()); KeyStore.PrivateKeyEntry keyEntry = (KeyStore.PrivateKeyEntry) ks.getEntry ("alias", new KeyStore.PasswordProtection("password".toCharArray()));     X509Certificate cert = (X509Certificate) keyEntry.getCertificate(); KeyInfoFactory kif = fac.getKeyInfoFactory(); List x509Content = new ArrayList(); X509IssuerSerial issuer = kif.newX509IssuerSerial("DC=local, DC=PR-CA, CN=Organisation", cert.getSerialNumber()); x509Content.add(issuer); X509Data xd = kif.newX509Data(x509Content); KeyInfo ki = kif.newKeyInfo(Collections.singletonList(xd)); DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); doc = dbf.newDocumentBuilder().parse(new FileInputStream("C:\\test.xml")); DOMSignContext dsc = new DOMSignContext(keyEntry.getPrivateKey(), doc.getDocumentElement()); XMLSignature signature = fac.newXMLSignature(si, ki); signature.sign(dsc); OutputStream os = new FileOutputStream("C:\\outputXML.xml"); TransformerFactory tf = TransformerFactory.newInstance(); Transformer trans = tf.newTransformer(); trans.transform(new DOMSource(doc), new StreamResult(os));

Can someone more experienced than me please take a look over my code to ensure that it looks OK and im not missing anything obvious? Also, any other troubleshooting tips that can be offered would be greatly appreciated. Thanks

Hi Tsuji,

It was indeed what you suggested. I downloaded and added the most recent .jars as you suggested and it worked as expected.

Thanks again for taking the time out to help me which is really appreciated.

I have the following XML:

<Catalog> <CD> <TITLE>Empire Burlesque</TITLE> <ARTIST>Bob Dylan</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>Columbia</COMPANY> <PRICE>10.90</PRICE> <YEAR>1985</YEAR> </CD> <CD> <TITLE>Empire Burlesque</TITLE> <ARTIST>Bob Dylan</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>Columbia</COMPANY> <PRICE>10.90</PRICE> <YEAR>1985</YEAR> </CD> <CD> <TITLE>Hide your heart</TITLE> <ARTIST>Bonnie Tyler</ARTIST> <COUNTRY>UK</COUNTRY> <COMPANY>CBS Records</COMPANY> <PRICE>9.90</PRICE> <YEAR>1988</YEAR> </CD> <CD> <TITLE>Empire Burlesque</TITLE> <ARTIST>Bonnie Tyler</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>Columbia</COMPANY> <PRICE>10.90</PRICE> <YEAR>1985</YEAR> </CD> <CD> <TITLE>Greatest Hits</TITLE> <ARTIST>Dolly Parton</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>RCA</COMPANY> <PRICE>9.90</PRICE> <YEAR>1982</YEAR> </CD> </Catalog>

And I want to remove the duplicate records from the XML that contain the same <TITLE> and <ARTIST> elements so that I end up with the following XML output:

<Catalog> <CD> <TITLE>Empire Burlesque</TITLE> <ARTIST>Bob Dylan</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>Columbia</COMPANY> <PRICE>10.90</PRICE> <YEAR>1985</YEAR> </CD> <CD> <TITLE>Hide your heart</TITLE> <ARTIST>Bonnie Tyler</ARTIST> <COUNTRY>UK</COUNTRY> <COMPANY>CBS Records</COMPANY> <PRICE>9.90</PRICE> <YEAR>1988</YEAR> </CD> <CD> <TITLE>Empire Burlesque</TITLE> <ARTIST>Bonnie Tyler</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>Columbia</COMPANY> <PRICE>10.90</PRICE> <YEAR>1985</YEAR> </CD> <CD> <TITLE>Greatest Hits</TITLE> <ARTIST>Dolly Parton</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>RCA</COMPANY> <PRICE>9.90</PRICE> <YEAR>1982</YEAR> </CD> </Catalog>

The expected output works when I use the following stylesheet on the XML and transform it using XML Spy:

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes"/> <xsl:strip-space elements="*"/> <xsl:template match="@*|node()"> <xsl:copy> <xsl:apply-templates select="@*|node()"/> </xsl:copy> </xsl:template> <xsl:template match="CD[TITLE = following::CD/TITLE and ARTIST = following::CD/ARTIST]"/> </xsl:stylesheet>

However when I pass this transformation to my Java code, the duplicates are removed however the last record within my XML is also removed. I have tried this with different XML files and it always removes the duplicates along with the last record - I have no idea why the last record is also being removed.

My Java code is as follows:

import java.io.File; import java.io.FileWriter; import java.io.IOException; import javax.xml.transform.Transformer; import javax.xml.transform.TransformerConfigurationException; import javax.xml.transform.TransformerException; import javax.xml.transform.TransformerFactory; import javax.xml.transform.stream.StreamSource; import org.dom4j.Document; import org.dom4j.DocumentException; import org.dom4j.io.DocumentResult; import org.dom4j.io.DocumentSource; import org.dom4j.io.SAXReader; import org.dom4j.io.XMLWriter; public class CreateXml {    private Document doc, newDoc;    private final String stylesheetPath = "C:\\transformation.xsl";    private final String inputFile = "C:\\Xml_File.xml";    private final String outputFile = "C:\\Transformed_File.xml";        public static void main(String[] args)    {                CreateXml xml = new CreateXml();        xml.RemoveDuplicates();            }        public void RemoveDuplicates()    {                  try        {            // Get XML File            File xmlFile = new File(inputFile);                        // Parse XML Document            doc = ParseDocument(xmlFile);                        // Get newly styled XML File            newDoc = StyleDocument(doc);                        // Write XML to file            XMLWriter writer = new XMLWriter(new FileWriter(outputFile));            writer.write(newDoc);            writer.close();                    }        catch (IOException ex)        {            ex.printStackTrace();        }    }            public Document ParseDocument(File fileName)    {                Document document = null;                try        {            SAXReader reader = new SAXReader();            document = reader.read(fileName);        }        catch (DocumentException ex)        {            ex.printStackTrace();        }                return document;      }        public Document StyleDocument(Document document)    {        Document transformedDoc = null;                        try        {            // load the transformer using JAXP            TransformerFactory factory = TransformerFactory.newInstance();            Transformer transformer = factory.newTransformer(new StreamSource(stylesheetPath));                        // now lets style the given document            DocumentSource source = new DocumentSource(document);            DocumentResult result = new DocumentResult();            transformer.transform(source, result);                        // return the transformed document            transformedDoc = result.getDocument();                    }        catch (TransformerConfigurationException ex)        {            ex.printStackTrace();        }        catch (TransformerException ex)        {            ex.printStackTrace();        }                return transformedDoc;      }     }

Has anyone got any idea as to why when I transform the XML using XMLSpy it works but when I transform the XML using my Java code the last record is being removed?

Thanks in advance

Hi,

I have a problem that I'm hoping someone may be able to help me with.

I want to load a public key (.cer file) into a keystore and then use this key to encrypt some data.

The key appears to be loaded into the keystore correctly because I can view its contents using the keystore.getCertificate(alias) method.

However, when I then attempt to use this key to encrypt a piece of data, I get the following error displayed:

Exception in thread "main" java.security.InvalidKeyException: Unsupported key type: null
at sun.security.mscapi.RSACipher.engineGetKeySize(RSACipher.java:404)

Here is my code:

String alias = "alias"; //Create keystore KeyStore ksName = KeyStore.getInstance(KeyStore.getDefaultType()); //Make an empty store ksName.load(null); // insert .cer file path here FileInputStream fis = new FileInputStream("C:\\cert\\certificate.cer"); BufferedInputStream bis = new BufferedInputStream(fis); CertificateFactory cf = CertificateFactory.getInstance("X.509"); while (bis.available() > 0) { java.security.cert.Certificate cert = cf.generateCertificate(bis); ksName.setCertificateEntry(alias, cert); } // retrieve public key from keystore PublicKey pubKey = (PublicKey) ksName.getKey(alias, null); String data = "... data to be encrypted ...."; String alg = "RSA/ECB/PKCS1Padding"; Cipher cipher = Cipher.getInstance(alg); cipher.init(Cipher.ENCRYPT_MODE, pubKey); byte encryptedBytes[] = cipher.doFinal(data.getBytes());

I am not sure why I am getting this error therefore if someone could provide some input or guidance with this matter then that would be greatly appreciated.

Regards

Hi Bear,

Thanks for your response.

Hogwash. Beans are used extensively in web apps, especially in communicating between the servlet controllers and JSPs.

Yeah I was getting confused here. What I was actually meaning was in relation to the statement:

Do NOT use <jsp:useBean> if you're already using a servlet to process the model. It will only lead to confusion and maintenance trouble because the <jsp:useBean> follows a different level of MVC approach than when you're using servlets. It's either servlets or <jsp:useBean>, not both

Which it states at the bottom of the following link:

Stack Overflow - Servlets

This now makes sense to me.

Thanks again.

Hi K. Tsang,

I decided to go with session scope however can I ask what is the preferred way to store data between JSP and Servlets? Is it to use JavaBeans or to use Session scope? Is there a benefit to one over the other? Or is it subjective?

Thanks in advance

Hi All,

I 'think' I have figured out my question therefore I am marking this as resolved.

Cheers

Hi All,

[I have edited my initial question to this shorter one]

Basically, whats the best way to retain form data between multiple JSPs without using a submit button?

Essentially, when a user selects a value from a drop down list on one of the JSPs which populated multiple entries within a form, I want this selected data to be 'retained' between different JSPs until such time the user is happy with what they have selected. At which point the user can opt to 'submit' their selections from one of the JSPs - this is the only page to contain a submit button.

Is JavaBeans the way to go? I recently read that using JavaBeans with Servlets doesnt really conform to the correct standard. Ideally, if someone could advise if this is possible by only using JSTL along with session scope variables then that would be appreciated.

Hopefully my questions make sense however if not then please dont hesitate to let me know

Thanks in Advance

John Paul

Hi Bear,

Thanks for your responses.

The reason why im using Glassfish is because this is what was used during my Java module at the Open University. However after doing some Googling it seems Tomcat is the most popular.

Hopefully someone who uses Glassfish browses these forums but if not and I dont get any joy, I may give Tomcat a try :)

Thanks again

Hi All,

Firstly apologies for my ignorance but I have tried Googling this issue to no avail and most resolutions seem to relate more to JSTL and Tomcat rather than JSTL and Glassfish.

Anyway, I am currently in the process of learning JSP (JSLT & EL) using Netbeans 6.9.1 and Glassfish 3 and have encountered an issue that I cant seem to resolve.

When I add the following line into my JSP page:

<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>

I get the following error message displayed in Netbeans:

The absolute uri: http://java.sun.com/jsp/jstl/core cannot be resolved in either web.xml or the JAR files deployed with this application

As ive already mentioned, most resolutions to this point to JSTL and Tomcat e.g. check your JSTL version and then download the relevant JSTL JAR files and put them in the WEB-INF/lib directory. However when I try and adopt this same approach with Glassfish, I dont seem to see a WEB-INF/lib directory, only a WEB-INF directory where I have put my .jsp files.

Nevertheless my questions are as follows:

1) As im using annotations, I havent created a web.xml file, which I assumed would be OK with the version of JEE im using. Does JSTL need a web.xml file to be present and configured to work correctly?
2) I cant seem to figure out how to locate the version of JSTL I am using within Glassfish. Can someone explain how I go about finding out what version of JSTL im using?
3) What is the directory path within Glassfish / Netbeans where I need to put my JSTL JAR files if I need to download them again?
4) Lastly, anyone got any idea how to solve this issue? :)

Any help with my questions & issues would be very much appreciated!

Regards

JP

Hi Steve / harshvardhan ojha,

Thanks very much for you feedback and yes, after taking some time out to understand this i think i have grasped the connection!

@Steve, your mention of the public Thread(Runnable target) constructor was the missing piece to my understanding, because basically, the reason why i can create Thread objects just by implementing the Runnable interface on my WhereAmI class is all down to that constructor; So by using that constructor, it needs something that IS-A Runnable, which in this case, is the place1 object!

Finally!

Thanks Guys, ive been trying to figure this out since Friday (should have came here first but i do like to try and figure things out myself )

Ill assume this same approach can be applied to other implementations of interfaces?

Thanks again

John Paul

Hi Steve,

Thanks very much for your quick response!

Ill take some time out to read and digest your feedback and the link you provided and if i have any more questions ill certainly come back

Thanks again

John Paul