Security Filter not activated within Eclipse + Web Tools Platform

Jonathan O'Donovan <jonathan.odonovan-X9fETvjwtHuyZ7Fz/[email protected]> Tue, 18 Nov 2008 12:53:31 +0000
Newsgroups gmane.comp.java.securityfilter.user
Message-ID <[email protected]>
This is a multi-part message in MIME format.

--===============5842920696979166421==
Content-type: multipart/alternative;
	boundary="Boundary_(ID_KMKB3dbbn0WAKbRr4hBIWg)"

This is a multi-part message in MIME format.

--Boundary_(ID_KMKB3dbbn0WAKbRr4hBIWg)
Content-type: text/plain; charset=us-ascii
Content-transfer-encoding: 7BIT

Hi All,

I am having a problem with the securityfilter when deploying using Web Tools
Platform in Eclipse. Does anyone know of any issues when using the security
filter with Eclipse, specifically with the Web tools platform?. I have read
the following 
 
http://wiki.eclipse.org/WTP_Tomcat_FAQ.
 
Note that when launching a server with the WTP, a new instance of the server
is created under a new cataline.base. This may be causing the problem?
 
 
I am running the following 
 
Eclipse Ganymede V3.4.1
Web Tools : 1.1.20x Tomcat 4.1
JSDK 1.6

 
I have added the project to the server with no problems and can execute/step
through servlets on the server. If I disable the security filter by
commenting
it out of web.xml the site functions the same as a non Eclipse deploy.
However, if I include the security config, it does not appear to be
functioning and I cannot log into my site when running/debugging within
Eclipse.

The security filter is set up in web.xml as follows :   <filter>
<filter-name>Security Filter</filter-name>
<filter-class>org.securityfilter.filter.SecurityFilter</filter-class>
<init-param>
<param-name>config</param-name>
<param-value>/WEB-INF/securityfilter-config.xml</param-value>
<description>Configuration file location (this is the default
value)</description>
</init-param>
<init-param>
<param-name>validate</param-name>
<param-value>true</param-value>
<description>Validate config file if set to true</description>
</init-param>
<init-param>
<param-name>loginSubmitPattern</param-name>
<param-value>/sflogin</param-value>
<description>This is the action used by the login form (in place of the
standard "j_security_check")</description>
</init-param>
</filter>  <!-- map all requests to the SecurityFilter, control what it does
with configuration settings -->

  <filter-mapping>
<filter-name>Security Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>  <security-role>
<role-name>administrator</role-name>
</security-role>
<security-role>
<role-name>user</role-name>
</security-role>




The security filter config file is as follows :



<securityfilter-config>


<security-constraint>
<display-name>The Customer area of the XXX web site.</display-name>
<web-resource-collection>
<web-resource-name>UserArea</web-resource-name>
<url-pattern>/servUserArea</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>administrator</role-name>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>


<security-constraint>
<display-name>Administration of the XX Web site.</display-name>
<web-resource-collection>
<web-resource-name>AdminArea</web-resource-name>
<url-pattern>/servAdminArea</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>administrator</role-name>
</auth-constraint>
</security-constraint>



<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/servPublicArea?view=login</form-login-page>
<form-error-page>/servPublicArea?view=loginerror</form-error-page>
<form-default-page>/servUserArea?view=usermain</form-default-page>
</form-login-config>
</login-config>



<!-- start with a Catalina realm adapter to wrap the Catalina realm defined
below -->
<realm className="org.securityfilter.realm.catalina.CatalinaRealmAdapter" />



<realm className="org.apache.catalina.realm.JDBCRealm">
<realm-param name="connectionName" value="client"/>
<realm-param name="connectionPassword" value="XXX"/>
<realm-param name="connectionURL" value="XXX"/>
<realm-param name="driverName" value="oracle.jdbc.driver.OracleDriver"/>
<realm-param name="userCredCol" value="password"/>
<realm-param name="userNameCol" value="username"/>
<realm-param name="userTable" value="auth_users"/>
<realm-param name="roleNameCol" value="role_name"/>
<realm-param name="userRoleTable" value="tomcat_roles"/>
<realm-param name="debug" value="1"/>
</realm>


</securityfilter-config>



The site works fine when I set it up on a normal Tomcat installation (ie
without Eclipse/WTP) so I know there is no problem connecting to the
database realm.

I am wondering if anyone can point me in the right direction here. Any
suggestions would be helpful.

Many thanks in advance,
Jonathan.

--Boundary_(ID_KMKB3dbbn0WAKbRr4hBIWg)
Content-type: text/html; charset=us-ascii
Content-transfer-encoding: 7BIT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16441" name=GENERATOR></HEAD>
<BODY>
<DIV>Hi All,<BR><BR>I am having a problem with the&nbsp;<SPAN 
class=593523512-18112008>securityfilter </SPAN>when deploying using Web Tools 
Platform<SPAN class=593523512-18112008> in Eclipse</SPAN>.&nbsp;<SPAN 
class=593523512-18112008>Does anyone know of any issues when using the security 
filter with Eclipse, specifically with the Web tools platform?. I have read the 
following </SPAN></DIV>
<DIV><SPAN class=593523512-18112008><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=593523512-18112008><A 
href="http://wiki.eclipse.org/WTP_Tomcat_FAQ" 
target=_blank>http://wiki.eclipse.org/WTP_Tomcat_FAQ</A>.</SPAN></DIV>
<DIV><SPAN class=593523512-18112008><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=593523512-18112008><FONT face=Arial size=2>Note that when 
launching a server with the WTP, a new instance of the server is created under a 
new cataline.base. This may be causing the problem?</FONT></SPAN></DIV>
<DIV><SPAN class=593523512-18112008><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=593523512-18112008><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=593523512-18112008></SPAN>I am running the following </DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV>Eclipse Ganymede V3.4.1<BR>Web Tools : 1.1.20x Tomcat 4.1<BR>JSDK 
1.6<BR></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV>I have added the project to the server with no problems and can 
execute/step through servlets on the server. If I disable the security filter by 
commenting<BR>it out of web.xml the site functions the same as a non Eclipse 
deploy. However, if I include the security config, it does not appear to be 
functioning and I cannot log into my site when running/debugging within 
Eclipse.<BR><BR>The security filter is set up in web.xml as follows 
:&nbsp;&nbsp; &lt;filter&gt;<BR>&lt;filter-name&gt;Security 
Filter&lt;/filter-name&gt;<BR>&lt;filter-class&gt;org.securityfilter.filter.SecurityFilter&lt;/filter-class&gt;<BR>&lt;init-param&gt;<BR>&lt;param-name&gt;config&lt;/param-name&gt;<BR>&lt;param-value&gt;/WEB-INF/securityfilter-config.xml&lt;/param-value&gt;<BR>&lt;description&gt;Configuration 
file location (this is the default 
value)&lt;/description&gt;<BR>&lt;/init-param&gt;<BR>&lt;init-param&gt;<BR>&lt;param-name&gt;validate&lt;/param-name&gt;<BR>&lt;param-value&gt;true&lt;/param-value&gt;<BR>&lt;description&gt;Validate 
config file if set to 
true&lt;/description&gt;<BR>&lt;/init-param&gt;<BR>&lt;init-param&gt;<BR>&lt;param-name&gt;loginSubmitPattern&lt;/param-name&gt;<BR>&lt;param-value&gt;/sflogin&lt;/param-value&gt;<BR>&lt;description&gt;This 
is the action used by the login form (in place of the standard 
"j_security_check")&lt;/description&gt;<BR>&lt;/init-param&gt;<BR>&lt;/filter&gt;&nbsp; 
&lt;!-- map all requests to the SecurityFilter, control what it does with 
configuration settings --&gt;<BR><BR>&nbsp; 
&lt;filter-mapping&gt;<BR>&lt;filter-name&gt;Security 
Filter&lt;/filter-name&gt;<BR>&lt;url-pattern&gt;/*&lt;/url-pattern&gt;<BR>&lt;/filter-mapping&gt;&nbsp; 
&lt;security-role&gt;<BR>&lt;role-name&gt;administrator&lt;/role-name&gt;<BR>&lt;/security-role&gt;<BR>&lt;security-role&gt;<BR>&lt;role-name&gt;user&lt;/role-name&gt;<BR>&lt;/security-role&gt;<BR><BR><BR><BR><BR>The 
security filter config file is as follows 
:<BR><BR><BR><BR>&lt;securityfilter-config&gt;<BR><BR><BR>&lt;security-constraint&gt;<BR>&lt;display-name&gt;The 
Customer area of the XXX web 
site.&lt;/display-name&gt;<BR>&lt;web-resource-collection&gt;<BR>&lt;web-resource-name&gt;UserArea&lt;/web-resource-name&gt;<BR>&lt;url-pattern&gt;/servUserArea&lt;/url-pattern&gt;<BR>&lt;/web-resource-collection&gt;<BR>&lt;auth-constraint&gt;<BR>&lt;role-name&gt;administrator&lt;/role-name&gt;<BR>&lt;role-name&gt;user&lt;/role-name&gt;<BR>&lt;/auth-constraint&gt;<BR>&lt;/security-constraint&gt;<BR><BR><BR>&lt;security-constraint&gt;<BR>&lt;display-name&gt;Administration 
of the XX Web 
site.&lt;/display-name&gt;<BR>&lt;web-resource-collection&gt;<BR>&lt;web-resource-name&gt;AdminArea&lt;/web-resource-name&gt;<BR>&lt;url-pattern&gt;/servAdminArea&lt;/url-pattern&gt;<BR>&lt;/web-resource-collection&gt;<BR>&lt;auth-constraint&gt;<BR>&lt;role-name&gt;administrator&lt;/role-name&gt;<BR>&lt;/auth-constraint&gt;<BR>&lt;/security-constraint&gt;<BR><BR><BR><BR>&lt;login-config&gt;<BR>&lt;auth-method&gt;FORM&lt;/auth-method&gt;<BR>&lt;form-login-config&gt;<BR>&lt;form-login-page&gt;/servPublicArea?view=login&lt;/form-login-page&gt;<BR>&lt;form-error-page&gt;/servPublicArea?view=loginerror&lt;/form-error-page&gt;<BR>&lt;form-default-page&gt;/servUserArea?view=usermain&lt;/form-default-page&gt;<BR>&lt;/form-login-config&gt;<BR>&lt;/login-config&gt;<BR><BR><BR><BR>&lt;!-- 
start with a Catalina realm adapter to wrap the Catalina realm defined below 
--&gt;<BR>&lt;realm 
className="org.securityfilter.realm.catalina.CatalinaRealmAdapter" 
/&gt;<BR><BR><BR><BR>&lt;realm 
className="org.apache.catalina.realm.JDBCRealm"&gt;<BR>&lt;realm-param 
name="connectionName" value="client"/&gt;<BR>&lt;realm-param 
name="connectionPassword" value="XXX"/&gt;<BR>&lt;realm-param 
name="connectionURL" value="XXX"/&gt;<BR>&lt;realm-param name="driverName" 
value="oracle.jdbc.driver.OracleDriver"/&gt;<BR>&lt;realm-param 
name="userCredCol" value="password"/&gt;<BR>&lt;realm-param name="userNameCol" 
value="username"/&gt;<BR>&lt;realm-param name="userTable" 
value="auth_users"/&gt;<BR>&lt;realm-param name="roleNameCol" 
value="role_name"/&gt;<BR>&lt;realm-param name="userRoleTable" 
value="tomcat_roles"/&gt;<BR>&lt;realm-param name="debug" 
value="1"/&gt;<BR>&lt;/realm&gt;<BR><BR><BR>&lt;/securityfilter-config&gt;<BR><BR><BR><BR>The 
site works fine when I set it up on a normal Tomcat installation (ie without 
Eclipse/WTP) so I know there is no problem connecting to the database 
realm.<BR><BR>I am wondering if anyone can point me in the right direction here. 
Any suggestions would be helpful.<BR><BR>Many thanks in advance,<BR><SPAN 
class=593523512-18112008><FONT face=Arial 
size=2>Jonathan.</FONT></SPAN></DIV></BODY></HTML>

--Boundary_(ID_KMKB3dbbn0WAKbRr4hBIWg)--


--===============5842920696979166421==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
--===============5842920696979166421==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
securityfilter-user mailing list
securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/securityfilter-user

--===============5842920696979166421==--