|
| Re: RAP - form based login? [message #1435976 is a reply to message #1433783] |
Thu, 02 October 2014 03:58   |
Eclipse User |
|
|
|
The easiest way to activate form-based authentication is to use the facility provided by your webcontainer. An alternative would be to register a servlet-filter to listen for requests on the root alias which provides the user with a login-page if not authenticated yet.
In the following, I will present you the steps required for the first approach by using Tomcat webcontainer:
First, you need a login HTML-page like the following. Place that file (e.g. auth-login.html) into your 'web-resources' folder of your RAP application.
<html>
<head>
<title>Form Authentication</title>
</head>
<body>
<form method="POST" action="j_security_check">
<table>
<tr>
<th align="right">Username:</th>
<td align="left"><input type="text" name="j_username"></td>
</tr>
<tr>
<th align="right">Password:</th>
<td align="left"><input type="password" name="j_password"></td>
</tr>
<tr>
<td align="right"><input type="submit" value="Log In"></td>
<td align="left"><input type="reset"></td>
</tr>
</table>
</form>
</body>
</html>
In the plugin.xml of your RAP application, make sure that there is registered kind of a resolver to make those resources accessible by an alias.
<extension point="org.eclipse.equinox.http.registry.resources">
<resource alias="/res" base-name="/web-resources"/>
</extension>
This entry means that any resources placed in the 'web-resources' folder are accessible in the form '/res/*', in your case this would be '/res/auth-login.html'.
In a second step, activate form-based authentication in the web.xml of your application by adding the following sections:
<!-- Enable FORM-based authentication -->
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/res/auth-login.html</form-login-page>
<form-error-page>/res/ auth-login.html</form-error-page>
</form-login-config>
</login-config>
<!-- Configure a security role to access your application -->
<security-role>
<role-name>appRole</role-name>
</security-role>
<!-- Make the static resources of '/res' accessible without authentication required -->
<security-constraint>
<web-resource-collection>
<web-resource-name>All Access</web-resource-name>
<url-pattern>/res/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- Protect your application -->
<security-constraint>
<display-name>Restricted Access</display-name>
<web-resource-collection>
<web-resource-name>Restricted Access</web-resource-name>
<url-pattern>/web/*</url-pattern>
<url-pattern>/tablet/*</url-pattern>
<url-pattern>/mobile/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>appRole</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
To authenticate users, you have to configure a REALM [1]. A Realm is a 'database' of usernames and passwords that identify valid users of a web application. If not configured different, the Tomcat 'MemoryRealm' is used meaning that the user-role configuration is loaded from the file '$CATALINA_BASE/conf/tomcat-users.xml' at startup-time.
In that file, create a user and assign it the role configured in the web.xml.
<user username="user" password="password" roles="appRole"/>
For production use, I suggest you to go with the JDBCRealm. See [2] for more information of how to setup such a realm.
Finally, form-based-authentication should work. There is only one issue when it comes to HTTP-session invalidation due session expiration. It might happen, that the user is presented with a RAP parsing exception instead of the logout page. This is because RAP does not expect a HTML page to be returned for a running AJAX request. To solve this, set the init-param 'reloadOnSessionTimeout' of your LogoutFilter to 'true'.
[1] http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html
[2] http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html#JDBCRealm
[Updated on: Thu, 02 October 2014 04:00] by Moderator |
|
|
|
|
|
|
|
|
|
| Re: RAP - form based login? [message #1703053 is a reply to message #1701948] |
Tue, 28 July 2015 06:50 |
| Eclipse User |
|
|
|
Hi there,
so i tried to do it the same way as shown in the feature branch above.
The only thing I'm not sure is, how the web.xml has to look like. Because that is unfortunately not included in the branch....
Jermie, would it be possible to add the web.xml file here if it is available?
Thanks,
Peter
|
|
|
Powered by
FUDForum. Page generated in 0.06425 seconds
Home