Re: Web Security Tutorial Update

Hi Dan,
I am sorry but i am still unable to get this tutorial to work.
There must be some missing steps, and I also think that some are out of 
order.
Eg, If i follow the instructions, when i open sun-web.xml, there are no 
nodes under the file.
Also, i thought the realm had to be specified in web.xml.

I think the best is for us to sit down and we go through the tutorial 
together.
Do you have time tomorrow to do that?

thanks
ken

Dan Kolar wrote:

> Hi Ken,
>
> I send you updated tutorial, hope it will be ok now.
> I guess we should mention in somehow also valuable comment from Grover 
> Blue <[email protected]>.
> Thanks
>
> Dan
>
> ------------------------------------------------------------------------
>
> NetBeans logo <http://www.netbeans.org/index.html>
> DownloadsDownloads 
> <http://www.netbeans.org/downloads/index.html>ProductsProducts 
> <http://www.netbeans.org/products/index.html>PluginsPlugins 
> <http://www.netbeans.org/catalogue/index.html>Docs & SupportDocs & Support 
> <http://www.netbeans.org/kb/50/index.html>CommunityCommunity 
> <http://www.netbeans.org/community/index.html>PartnersPartners 
> <http://www.netbeans.org/community/partners/index.html>AboutAbout 
> <http://www.netbeans.org/about/index.html>SwitchSwitch 
> <http://www.netbeans.org/switch/index.html>
> <#>
> HOME <http://www.netbeans.org/index.html> > Docs & Support 
> <http://www.netbeans.org/kb/index.html>
> Docs & Support
> NetBeans IDE 5.5 <http://www.netbeans.org/kb/55/>
> NetBeans IDE 5.0 <http://www.netbeans.org/kb/50/>
> NetBeans IDE 4.1 <http://www.netbeans.org/kb/41/>
> Older Releases <http://www.netbeans.org/kb/archive/>
> User FAQs <http://www.netbeans.org/kb/faqs/>
> Articles <http://www.netbeans.org/kb/kb.html>
> Flash Demos <http://www.netbeans.org/kb/50/flash.html>
> Books <http://www.netbeans.org/kb/articles/books.html>
> Learning Java <http://www.netbeans.org/kb/articles/learn-java.html>
> Module Developer's Resources <http://platform.netbeans.org/index.html>
> NetBeans Support <http://developers.sun.com/developer_help/>
>
>
>
> 	
>
>
>   Securing a Web Application in NetBeans IDE 5.5
>
> Contributed and maintained by Dan Kolar
>
> This document takes you through the basics of adding security to a web 
> application that is deployed to either the Tomcat server or the Sun 
> Java System Application Server.
>
> This document shows you how to configure security authentication using 
> a basic login window and also using a login form in a web page. This 
> document takes you through the steps for creating users on the Tomcat 
> server and Sun Java System Application Server. After creating the 
> users, you then create the security roles by setting the security 
> properties in the deployment descriptor. This document also shows how 
> you can use JDBC authentication to secure your application when 
> deploying to the Sun Java System Application Server.
>
>
>       Software Needed
>
> Before you begin, you need to install the following software on your 
> computer:
>
>     * NetBeans IDE 5.5 (development build) (download
>       <http://www.netbeans.info/downloads/download.php?a=n&p=1>).
>     * Java Standard Development Kit (JDK) version 5.0 (download
>       <http://java.sun.com/Java%20SE/1.5.0/download.jsp>).
>     * (optional) Sun Java System Application Server 9.0 (download
>       <https://glassfish.dev.java.net/public/downloadsindex.html>).
>
>
>       Notations Used in the Tutorial
>
> /<NETBEANS_HOME>/ - NetBeans IDE installation directory
> /<APPSERVER_HOME>/ - Sun Java System Application Server installation 
> directory
> /<TOMCAT_HOME>/ - Tomcat installation directory
> /<PROJECT_HOME>/ - directory containing your project
>
>
>       Securing a Web Application in NetBeans IDE 5.5
>
> In this document you will go through the following steps:
>
>     * Installing and Configuring the Working Environment <#Exercise_0>
>     * Creating the Web Application <#Creating_Web_App>
>           o Creating the Secure Directories <#createdir>
>           o Creating the JSP Index Page <#indexpage>
>           o Creating a Login Form (optional) <#loginform>
>     * Creating Users and Roles on the Target Server
>       <#Creating_users_roles>
>           o Defining Roles on Tomcat Web Server <#Tomcat>
>           o Defining Roles on Sun Java System Application Server <#SJSAS>
>     * Configuring the Login Method <#Basic_login_config>
>           o Basic Login <#Basic>
>           o Form Login <#Form>
>     * Using JDBC Authorization <#jdbc>
>     * Deploying and Running the Application <#Deploy_run>
>
>
>     Installing and Configuring the Working Environment
>
> Install and start NetBeans IDE 5.5. You can do this tutorial using the 
> bundled Tomcat server or using the Sun Java System Application Server 
> 9.0, Platform Edition.
>
> If you are using the Sun Java System Application Server, make sure the 
> server is installed and a server instance is registered with the IDE. 
> You can use the Server Manager to register the server instance. 
> (Choose Tools > Server Manager > Add Server. Select "Sun Java System 
> Application Server" > and click Next. Click Browse and locate the 
> installation directory of the application server. Click Finish.)
>
>
>     Creating the Web Application
>
> In this excercise you first create the web application project and the 
> directory structure. You then create some simple html files in each of 
> the secure directories. The web application uses a basic login 
> authentication for accessing the secure directories. If you want to 
> use a login form for authentication, you can add a jsp page with the form.
>
>
>       Creating the Secure Directories
>
>    1. Choose File > New Project (Ctrl-Shift-N), select Web Application
>       from the Web category, and click Next.
>    2. Name the project WebApplicationSecurity, choose the server you
>       want to use and click Finish.
>    3. In the Projects window of the IDE, right-click Web Pages and
>       choose New > Folder.
>    4. In the New Folder wizard, name the folder secureAdmin and click
>       Finish.
>    5. Repeat steps 3 and 4 to create another folder named secureUser.
>    6. Create a new html by right-clicking the folder secureUser and
>       choosing New > HTML.
>    7. Name the new file pageU and click Finish. When you click Finish,
>       the file pageU.html opens in the Source Editor.
>    8. In the Source Editor, add the following content to pageU.html.
>
><html>
>   <head>
>      <title>User secure area</title>
>   </head>
>   <body>
>      <h1>User Secure Area</h1>
>   </body>
></html>
>
>    9. Right-click the secureAdmin folder and create a new html file
>       named pageA.
>   10. In the Source Editor, add the following to pageA.html
>
><html>
>   <head>
>      <title>Admin secure area</title>
>   </head>
>   <body>
>      <h1>Admin secure area</h1>
>   </body>
></html>
>
>
>       Creating the JSP Index Page
>
> You now create the JSP index page containing links to the secure 
> areas. When the user clicks on the link they are prompted for the 
> username and password. If you use a basic login, they are prompted by 
> the default browser login window. If you use a login form page, the 
> the user enters the username and password in a form.
>
>    1. Open index.jsp in the Source Editor and add the following links
>       to pageA.html and pageU.html:
>
><p>Request a secure Admin page <a href="secureAdmin/pageA.html">here!</a></p>
><p>Request a secure User page <a href="secureUser/pageU.html" >here!</a></p>
>
>
>       Creating a Login Form (optional)
>
> If you want to use a login form instead of the basic login, you can 
> create a jsp page containing the form. You then specify the login and 
> error pages when configuring the login method <#Basic_login_config>.
>
>    1. In the Projects window, right-click the folder Web Pages and
>       choose New > JSP.
>    2. Name the file login, leave the other fields at their default
>       value and click Finish.
>    3. In the Source Editor, add the following code to login.jsp and
>       then save and close the file.
>
><%@taglib uri="http://java.sun.com/jstl/core" prefix="c" %>
>              <form action="j_security_check" method="POST">
>              Username:<input type="text" name="j_username"><br>
>              Password:<input type="password" name="j_password">
>              <input type="submit" value="Login">
>          </form>
>
>    4. Create a new html file named loginError.html in the Web Pages
>       folder. This is a simple error page.
>    5. In the Source Editor, add the following simple error message
>       content to loginError.html.
>
>	  <html>
>              <head>
>              	<title>Login Test: Error logging in</title>
>              </head>
>              <body>
>                  <h1>Error Logging In</h1>
>                  <br/>
>              </body>
>          </html>
>
>
>     Creating Users and Roles on the Target Server
>
> To be able to use user/password authentication (basic login or 
> form-based login) security in web applications, the users and their 
> appropriate roles have to be defined for the target server. To log in 
> to a server, the user account has to exist on that server.
>
> How you define the users and roles varies according to the target 
> server you specified. In this tutorial the users admin and tomcat are 
> used to test the security setup. You need to confirm that these users 
> exist on the respective servers, and that the appropriate roles are 
> assigned to the users.
>
>
>       Defining Roles on Tomcat Web Server
>
> The Tomcat server bundled with the IDE already has some pre-defined 
> users and roles.
>
> The basic users and roles for the Tomcat server are defined in 
> tomcat-users.xml. You can find tomcat-users.xml in your 
> /<NETBEANS_HOME>/\enterprise3\apache-tomcat-5.5.16\conf directory.
>
><tomcat-users>
>    <role rolename="tomcat"/>
>    <role rolename="role1"/>
>    <role rolename="manager"/>
>    <role rolename="admin"/>
>    <user username="ide" password="/(enter your password here)/" roles="manager,admin"/>
>    <user username="tomcat" password="tomcat" roles="tomcat"/>
>    <user username="role1" password="tomcat" roles="role1"/>
>    <user username="both" password="tomcat" roles="tomcat,role1"/>
></tomcat-users>
>
>
>       Defining Roles on Sun Java System Application Server
>
> The Sun Java System Application Server has one pre-defined user named 
> admin. For this scenario you first need to use the Admin Console of 
> the Sun Java System Application Server to create a new user named 
> user. You then need to map the user to a role.
>
> Users and roles are defined in sun-web.xml located in the WEB-INF 
> directory of your project.
>
>    1. Open the Admin Console by right-clicking the node for the Sun
>       Java System Application Server in the Runtime window of the IDE.
>       The login page for the Sun Java System Application Server opens
>       in your browser window. You need to log in using the admin
>       username and password to access the Admin Console.
>    2. In the Admin Console, create a user named user on the server.
>       For details on how to create a user on the Sun Java System
>       Application Server, see Managing Users and Groups on the
>       Application Server
>       <http://java.sun.com/javaee/5/docs/tutorial/doc/Security-Intro6.html#wp478286>.
>    3. In the Projects window of the IDE, double-click on sun-web.xml
>       located in the Web Pages/WEB-INF directory.
>    4. Double-click on node Sun Web application and branches admin and
>       user are shown.
>    5. Select admin security role mapping and add Principal (+ Group )
>       admin
>    6. Select user security role mapping and add Principal ( + Group )
>       user
>
>       Note:Groups are needed for successful login in jdbc-realm, so if
>       you don't plan to use jdbc-realm, you don't have to create them in
>       sun-web.xml , as file realm is satisfied with "empty" group as well.
>
>
>     Configuring the Login Method
>
> When configuring the login method for your application, you can use 
> the login window provided by your browser for basic login 
> authentication. Alternatively, you can create a web page with a login 
> form. Both types of login configuration are based on user/password 
> authentication.
>
>
>       Basic Login
>
> When you use the basic login configuration, the login window is 
> provided by the browser. A valid username and password is needed to 
> access the secure content.
>
> The following steps show how to configure a basic login for the Sun 
> Java System Application Server.
>
>    1. In the Projects window, double-click web.xml located in the Web
>       Pages/WEB-INF directory to open the file in the Visual Editor.
>    2. Click Security in the toolbar to open the file in Security view
>       and expand the Login Configuration node.
>    3. Set the Login Configuration to Basic.
>    4. Click Add Role and add the following Security Roles.
>           * Admin, for administrators
>           * Tomcat (User), for users
>    5. Click Add Security Constraint, name it AdminConstraint, and do
>       the following:
>          1. Add a Web Resource Collection, set the Resource Name to
>             Admin and the URL Pattern to /secureAdmin/* and click OK.
>          2. Select Enable Authentication Constraint and click Edit.
>          3. In the Edit Role Names dialog box, select Admin in the
>             left pane, click Add and then click OK.
>    6. Click Add Security Constraint, name it UserConstraint, and do
>       the following:
>          1. Add a Web Resource Collection, set the Resource Name to
>             User and the URL Pattern to /secureUser/* and click OK.
>          2. Select Enable Authentication Constraint and click Edit.
>          3. In the Edit Role Names dialog box, select Admin and Tomcat
>             in the left pane, click Add and then click OK.
>
>
>       Form Login
>
> Using a form for login enables you to customize the content of the 
> login and error pages. The steps for configuring authentication using 
> a form are the same as for the basic login configuration, except that 
> you specify the login and error pages <#loginform> you created.
>
> The following steps show how to configure a login form for the Sun 
> Java System Application Server.
>
>    1. In the Projects window, double-click web.xml located in the Web
>       Pages/WEB-INF directory to open the file in the Visual Editor.
>    2. Click Security in the toolbar to open the file in Security view
>       and expand the Login Configuration node.
>    3. Set the Login Configuration to Form.
>    4. Set the Form Login Page by clicking Browse and locating login.jsp.
>    5. Set the Form Error Page by clicking Browse and locating
>       loginError.html.
>    6. Click Add Role and add the following Security Roles.
>           * Admin, for administrators
>           * Tomcat (User), for users
>    7. Click Add Security Constraint, name it AdminConstraint, and do
>       the following:
>          1. Add a Web Resource Collection and set the name to Admin
>             and the path to /secureAdmin/*
>          2. Select Enable Authentication Constraint and click Edit.
>          3. In the Edit Role Names dialog box, select Admin in the
>             left pane and click Add.
>    8. Click Add Security Constraint, name it UserConstraint, and do
>       the following:
>          1. Add a Web Resource Collection and set the name to User and
>             the path to /secureUser/*
>          2. Select Enable Authentication Constraint and click Edit.
>          3. In the Edit Role Names dialog box, select Admin and Tomcat
>             in the left pane and click Add.
>
>
>     Using JDBC Authorization
>
> If you are deploying your application to the Sun Java System 
> Application Server, you can also configure your application to 
> retrieve the authorization information from a JDBC database table. 
> Using this method, managing user accounts is much easier than managing 
> user accounts directly on the server.
>
> The JDBC authorization method is already supported in Glassfish v2 
> <https://glassfish.dev.java.net/downloads/31May06.html>, but if you 
> are using Sun Java System Application Server 9.0 you need to use a 
> precompiled jar 
> <https://glassfish.dev.java.net/nonav/issues/showattachment.cgi/65/JDBCRealm.jar>. 
> To enable the realm jdbc-realm on the Sun Java System Application 
> Server you need to do the following steps. (The steps are based on 
> JDBCRealm for Glassfish. 
> <https://glassfish.dev.java.net/issues/show_bug.cgi?id=171>)
>
>    1. Download JDBCRealm.jar
>       <https://glassfish.dev.java.net/nonav/issues/showattachment.cgi/65/JDBCRealm.jar>.
>    2. Copy the jar to the lib directory located in the Sun Java System
>       Application Server installation directory.
>    3. Add the following to the login.conf file located in the
>       /<APPSERVER_HOME>//domains/domain1/config/
>
>jdbcRealm {
>net.java.glassfish.security.auth.realm.jdbc.JDBCLoginModule required;
>};
>                  
>
>    4. Start the server and open the Admin Console.
>    5. In Configuration > Security > Realms, create a new Realm named
>       "jdbc-realm" and enter the following classname:
>
>net.java.glassfish.security.auth.realm.jdbc.JDBCRealm
>
>    6. Add the following properties and values to the realm:
>           * jaas-context : jdbcRealm
>           * datasource : jdbc/__default
>           * user : APP
>           * password : APP
>           * find-user-query : A SQL query that return the user's
>             identifier when injected two parameters
>             (username/password), like
>             SELECT IDENTIFIER FROM PERSON WHERE USERID = ? AND
>             PASSWORD = ?
>           * find-groups-query : A SQL query that return group name(s)
>             when injected the user name, like
>             SELECT GROUP_NAME FROM PERSON P, "GROUP" G WHERE
>             P.GROUP_ID = G.ID AND USERID = ?
>
>       *Note:* The user and password are for the Java DB database
>       server bundled with the Sun Java System Application Server.
>
>    7. In the Admin Console, locate Application Server/JVM
>       Settings/Path Settings/Classpath suffix and add the following line:
>
> ${com.sun.aas.installRoot}/lib/JDBCRealm.jar
>
>    8. Create the appropriate tables in jdbc/__default and add the
>       proper data to the table,
>       with this SQL script:
>
>create table "GROUP" (
>    ID          SMALLINT NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 5, INCREMENT BY 5),
>    GROUP_NAME  VARCHAR(15),
>    CONSTRAINT GROUP_QU UNIQUE (ID)
>);
>create table PERSON (
>    IDENTIFIER  INT NOT NULL GENERATED ALWAYS AS IDENTITY,
>    UserID      Varchar(10),
>    password    varchar(10),
>    GROUP_ID    SMALLINT NOT NULL,
>    CONSTRAINT PERSON_PK PRIMARY KEY (UserID),
>    CONSTRAINT PERSON_FK FOREIGN KEY (GROUP_ID) REFERENCES "GROUP" (ID) ON DELETE RESTRICT
>);
>INSERT INTO "GROUP" (GROUP_NAME) VALUES ('user');
>INSERT INTO "GROUP" (GROUP_NAME) VALUES ('admin');
>INSERT INTO PERSON (UserID,password,GROUP_ID) VALUES ('admin','adminadmin',10);
>INSERT INTO PERSON (UserID,password,GROUP_ID) VALUES ('user','user',5);
>
>                  
>
>  
>
>
>     Deploying and Running the Application
>
> In the Projects window, right-click the project node and choose Run. 
> After building and deploying the application to the server, the start 
> page opens in your web browser. Choose the secure area which you want 
> to access by clicking either *admin* or *user*.
>
> After supplying the user and password, there are three possible results:
>
>     * Password for this user is correct and user has privileges for
>       secured content -> secure content page is displayed
>     * Password for this user is incorrect -> Error page is displayed
>     * Password for this user is correct, but user does not have right
>       to access the secured content -> browser displays Error 403
>       Access to the requested resource has been denied
>
> Note: As successful login atempt persist whole session, you have to 
> restart your browser to be able to login under different user.
>
> 	
>  
>  
> MORE INFO: | HOME <http://www.netbeans.org/> | SHOP 
> <http://www.cafeshops.com/netbeans/> | REPORT A BUG 
> <http://www.netbeans.org/community/issues.html> | SITE MAP 
> <http://www.netbeans.org/download/sitemaps/www_map.html> | LEGAL 
> <http://www.netbeans.org/about/legal/index.html> | CONTACT 
> <http://www.netbeans.org/about/contact.html>     BY USE OF THIS 
> WEBSITE, YOU AGREE TO THE NETBEANS POLICIES AND TERMS OF USE 
> <http://www.sunsource.net/TUPPCP.html>
>