Re: [xwt-users] RPC/servlet session state with XWT?

On Fri, Sep 19, 2003 at 06:05:55PM -0500, Jeff Buhrt wrote:
> Does anyone have a sample of logging in and maintaining session state 
> using XWT with xml-rpc under Tomcat (java servlets)? [I tested 
> HttpSession's .getSession() but it seems ignored.]
> I saw an email from March where the person said they passed a sessionId 
> they made up back and forth, no further details though.

I'm still working on refining this, but I think the attached code is
going to be a convenient framework for 'sessioned' xml-rpc communication
with the backend. While this is currently very much targeted at real
user logins, you could easily create session behaviour by feeding the
autocreate function a generated username ('user' + timestamp + ip, for
example) and a fixed password, and just have the auth accept that
(return a fixed HA1).

Anyhow, how it works is:

(1)
* Your xwt app calls http://username:password@server/auth/login . Note that
  the password will not go on the wire as cleartext since the servlet
  forces digest auth. The servlet responds with either:
  + "ok": login accepted, proceed at (3)
  + "createallowed": the username did not exist but you are allowed to
    create a new account with this username, proceed at (2)
  + "wrongpassword": username as recognized but password was wrong,
    proceed to (1)
  + "usernotfound": user was not found and you cannot create an account
    by this name, proceed to (1)

(2)
* your xwt app calls http://server/auth/create(username, password) . Note
  that these *will* go over the wire in cleartext unless you're using
  SSL. The servlet responds with either:
  + "ok": account created, proceed to (3)
  + "notallowed": you were told "usernotfound" at (1) but tried to
    create anyway, proceed to (1)
  + "invalidusername": the username is invalid, proceed to (1) or (2)
  + "invalidpassword": the password is invalid, proceed to (1) or (2)

(3)
You have been authenticated and can now do work. The actual xml-rpc
calls can be made to
http://username:password@server/work/yourmethod(yourparams). The servlet
will make sure that you're authenticated and will return
HTTP_UNAUTHORIZED if you're sending the wrong account info. The password
will not pass the wire in cleartext since the servlet uses digest auth.

Needs work and documentation but it's been working nicely for me. It
should be doable to create an XWT widget that handled most of the
interaction with the auth servlet which should be reusable over
different apps.

-- 
Emiliano

_______________________________________________
users mailing list
[email protected]
http://lists.xwt.org/listinfo/users