Stefan Mutschler Messages: 17 Registered: June 2012 Location: Baden-Baden, Germany
Junior Member
I also tried to set up DataSourceSecurityFilter today but did not succeed.
After having disabled BasicSecurityFilter and AnonymousSecurityFilter in the default config.ini and configuring realm, jdbcDriverName, jdbcMappingName, jdbcUsername, jdbcPassword and selectUserPass for DataSourceSecurityFilter, the DevelopmentAuthFilter decided to grant access. As a next step I disabled DevelopmentAuthFilter and ended up with a 403 FORBIDDEN. Unfortunately no error message that could help me until now. Anyone else an idea?
configuration of DataSourceSecurityFilter in 'org.eclipse.db.testapp.server/producs/development/config.ini'
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#active=true
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#realm=TEST APPLICATION
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#jdbcDriverName=org.apache.derby.jdbc.EmbeddedDriver
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#jdbcMappingName=jdbc:derby:D:/Temp/max24h/scoutJuno/derbyDb
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#jdbcUsername=
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#jdbcPassword=
org.eclipse.scout.http.servletfilter.security.DataSourceSecurityFilter#selectUserPass=SELECT LOWER(NAME) FROM PERSON WHERE LOWER(NAME)=? AND PASSWORD=?
Ensure to have no white spaces at the end of the parameters and set all other security filters to active=false.
ensure the bundle 'org.eclipse.scout.http.servletfilter' is added as requred bundle in the product file.
If you are still in troubles let us know your configuration and stack traces.
I merged your text in this wiki page: Security > 2.1 Security Filters.
Maybe the text can be improved, but at least the information is there.
A last world on the PASSWORD field in the PERSON table: this is only for demonstration, because storing clear text passwords in a database is never a good idea (hash with salt is a much better practice).
The 'DataSourceSecurityFilter' does a Base64 encryption in its default negotiate implementation (see 'DataSourceSecurityFilter.negotiate' and 'DataSourceSecurityFilter.encryptPass'). So the expected password in the database is also Base64 encrypted. To change this behavior change one or the other implementation of the two methods in a subclass of DataSourceSecurityFilter.
Stefan Mutschler Messages: 17 Registered: June 2012 Location: Baden-Baden, Germany
Junior Member
Hi,
thanks for the info... also working fine in my case now. As described in the wiki the login dialog for the swing gui is shown when accessing the server for the first time. But how about the RAP gui? It seems as if there is no login dialog. Do I have to configure a servlet filter and use the (ugly) browser dialog?
Stephan Leicht Vogt Messages: 84 Registered: February 2010 Location: Baden Switzerland
Member
Hi Stefan
Unfortunately there is no ready-to-use RAP login dialog. But I would hugely appreciate it, if you would open a CR bugzilla with your implementation as patch