Authentification and Security in WebApp with JSP

Hello to all.
I'm developing a Web Applications with JSP's. To use the application a user must first Login.
To restrict access via URL typing I have included in every JSP page a user_logged_in_check page that verifies that the user is logged in, and if not redirects to the Login page.
The problem is that I must not forget to include that page in all my JSPs, and if the name of the page changes, it must be changed everywhere (though a search/replace might do the job just fine).
I used this approach because is not server dependent (such as the Tomcat Realms example I have seen on this forum).
Is there a better strategy?
Is there a way to enforce security check and not rely on my attention ;)?
Is there a pattern that solves the problem?
Any help would be greatly appreciated.

The first and biggest disadvantage is the repetitive coding - what happens if you realise that you need to change something - you will need to modify each of your JSP files. The chances of someone forgetting to add it in are a security risk.
Secondly, using the web server's mechanism, in most cases, would mean that you are using a proven and much more stable security mechanism then you can whip up.
For example, in Weblogic, you can configure a JAAS provider -- that means you are not limited to using uname/password. Your customer may have an enterprise wide single sign on policy that is supported by the JAAS provider and you can use it straight away - by just making a declarative change in the web*.xml files.
If you must, use the Filter class (its a Servlet class, I checked after I had posted) as described in the Intercepting Filter pattern - at least thats a standard approach and will cut down on you having to rely on adding a snip of code to each of your JSPs.

Similar Messages

Multiple OUs with GPOs - One OU with multiple GPOs and security - One OU with one GPO and item level targeting

Background...
We have around 30 locations and we need to deliver different GPOs to these locations.
There can be between 3 and 8 PCs in each location.
These PCs can move around at short notice (mainly as a backup with neighbouring locations should
PCs fail)
The GPOs differ to change printers (2 per location and 2 backup printers from neighbouring location), auto login, desktop wallpaper
Which is in your opinion the best solution for login speed, GPO & device management?
1) Multiple OUs with a single GPO in each OU, the devices can be moved into new OU when the PCs move
2) Single OU with multiple GPOs, add devices to security group and use security filtering on the GPOs
3) Single OU with single GPO, add devices to security group and use item level targeting on the group

> 1) Multiple OUs with a single GPO in each OU, the devices can be moved
> into new OU when the PCs move
> 2) Single OU with multiple GPOs, add devices to security group and use
> security filtering on the GPOs
> 3) Single OU with single GPO, add devices to security group and use item
> level targeting on the group
4) GPMC, Sites, "show sites". Then link appropriate GPOs to each
individual site.
That's the way to go here...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

What kind of classes I can use with JSP in tomcat? Please Help

Hi people, I tried use the classes that I did for others application and it throw this exception :
"org.apache.jasper.JasperException: Unable to compile class for JSP
An error occurred at line: -1 in the jsp file: null
Generated servlet error:
[javac] Compiling 1 source file
D:\Apache Group\Tomcat 4.1\work\Standalone\localhost\_\matriculaOnLine\valide_jsp.java:14: cannot access matriculaOnLine.Connect
bad class file: D:\Apache Group\Tomcat 4.1\webapps\ROOT\WEB-INF\classes\matriculaOnLine\Connect.class
class file contains wrong class: Conexao
Please remove or make sure it appears in the correct subdirectory of the classpath.
private Connect conn = new Connect(driver,url,login,password);
^
1 error"
I used the Connect class with java apps and it work but with JSP on TomCat4.1.27
Can someone help me, please?
Tiago - [email protected]

Hi Tiago,
I have some problems in my mind.
Which databse you are using? and Which database driver you are using for connecting database?
Also can you please give a code snapet that you written for connecting databse?
----------Milind

SQL server(PC1) --- PC2: Login failed. The login is from untrusted domain and cannot be used with windows authentification

Hey,
I'want to make connection from my laptop(xxx.xxx.xxx.xxx = A) to a fixed computer(SQL server xxx.xxx.xxx.xxx =B). My connection string = "Provider=SQLNCLI11; Data source:name-pc/SQLEXPRESS; Integrated circuit=SSPI;Intial Catalog=Database name for visual
studio C#.
Laptop -> PC1 : Eror
It works when i use localhost or 127.0.0.1 and i can read my database without any problems if i install SQL server on my laptop. Know i install it to PC1 and uninstall on my laptop. When i change the name-pc by an ip-adress i get this error: Login failed.
The login is from untrusted domain and cannot be used with windows authentification. I did some research on multiple forums where they say about Local security policy(secpol.exe) but i don't have this file.
PC2-> PC3: work fine but i want to work with my laptop and i don't understand why it isn't working with my Laptop.
Can someone help me?
Thx a lot and sry about my english(its a disaster)
Thibaut

Hello,
Yes, for the Windows Authentication to work you should be using the same Windows account and password.
Are you willing to create SQL logins inside SQL Server and allow your users to connect to SQL Server using SQL Authentication
instead of Windows Authentication? That could be a solution on a workgroup network.
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com

Authentification with jsp

hi i need to restrict the acces to a website with basic auth with jsp,servlet etc., i would appreciate if anyone help me thanx

If you're using Tomcat you simply need to add some tags to your web.xml:
<security-constraint>
<web-resource-collection>
 <web-resource-name>
 Member Area
 </web-resource-name>
 <url-pattern>/members/*</url-pattern>
</web-resource-collection>
<auth-constraint>
 <role-name>member</role-name>
 <role-name>administrator</role-name>
</auth-constraint>
</security-constraint>This identifies any file under the members directory of your application context to require a "member" or "administrator" to view.
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>My Club Member Area</realm-name>
</login-config>This identifies that Basic Authentication be used.
After that, you need to make sure the "member" role (or whatever you call it) exists and any relevant users exist in your tomcat-users.xml file. If you've configured a database under the UserDatabase section then make sure the required roles and users are there.
That's about it for Tomcat. If you're using a different Servlet Container/Application Server, please specify.

SQL query with JSP and WML-parameters

Hey,
Could you help me?
I'm trying to do the following. WML deck card 1 send parameter to same WML deck's card help. I try to read the parameter with JSP in card help by putting the parameter to SQL query, but it doesn't work. I can read the parameter with WML in card help. I can also print the value of the parameter with JSP if I generate WML with JSP.
/*parameter sending from card 1 to card help*/
out.println("<go href='#helpcard'>");
out.println("<setvar name='valittukurssi' value='$(valittukurssi)'/>");
/*parameter read with WML in card help */
Valitse kurssi.
$valittukurssi
/'parameter read with JSP by generating WML with JSP*/
out.println("$valittukurssi");
/* SQL query with JSP */
ResultSet uudettulokset = uusilause.executeQuery("select * from kurssi where lyhenne='$valittukurssi'");
Thanks,
Rampe

You're problem is easy to fix. You're confusing WML variables with JSP variables. See below:
>
/*parameter sending from card 1 to card help*/
out.println("<go href='#helpcard'>");
out.println("<setvar name='valittukurssi'
value='$(valittukurssi)'/>");
Above you set a var that will work on the phone, not in JSP.
/*parameter read with WML in card help */
Valitse kurssi.
$valittukurssi
Yes the above does display the parameter, because it is a client side WML var, but you cannot use this variable in the JSP code (that's why your SWL fails).
/'parameter read with JSP by generating WML with
JSP*/
out.println("$valittukurssi");Here's you're problem, the above line is EXACTLY the same as the one before it. When the container parses through this JSP code it translates the above line to:
$valittukurssi on the WML page and the CLIENT uses it's local variable to display it.
What you need and want is to have a variable that can be used in JSP code and output to your WML page. Here's how it's done:
out.println("<go href='#helpcard'>");
String some_name = "valittukurssi";
out.println("<setvar name='"+some_name+"'
value='$("+some_name+")'/>");
//note that you may have to escape the ( and ) with a \
//so we displayed the variable above into the WML page, now we can use it in the SQL query:
/* SQL query with JSP */
ResultSet uudettulokset =
uusilause.executeQuery("select * from kurssi where
lyhenne='"+some_name+"'");//the end of the command is: " ' " ) ;
Frank Krul
Got Node?

Bursting with translation and security attributes?

Hi folks,
I've been lurking on the forum for a while and despite not always finding a solution, existing threads normally pointed me in the right direction - so thanks :)
I'm working on EBS 11.5.10 with the latest Bi-Publisher 5.6.3 (5472959) and bursting (5968876) patches installed.
I have successfully done the following individual AR Invoice Bi-Publisher tasks:
1. translated an invoice RTF template by attaching an xliff file to the data definition,
2. applied security attributes to the template to restrict updates on the resulting PDF,
3. burst a custom AR invoice print and emailed the resultant pdf's.
The PDF generated by the combined Invoice print correctly applies the translation and security attributes; however when I run the "XML Publisher Report Bursting Program" to the XML file the resultant burst PDF's do not apply the translation or security attributes. I assume this a limitation of bursting control files? If so, is this on the list of future enhancements to Bi-Publisher?
Here's an example of my control file document entry, I have included locale and pdf-security entries - these don't cause an error but equally don't generate the desired result (p.s. I know I'm emailing on a PRI filter - it's just a test):
<xapi:document output-type="pdf" delivery="att_email">
<xapi:template type="rtf"
location="/usr/tmp/xxxINVOICE3.rtf"
locale="fr-US"
pdf-security="true" pdf-encryption-level="1" pdf-permissions-password="xxxxxx"
filter=".//G_INVOICE_HEADER[PRINTING_OPTION='PRI']" >
</xapi:template>
</xapi:document>
Thanks
Dave

=================
==Properties Idea's
=================
You would have happened to try applying the security stuff in the application for your template? Try that and see if the pdf properties get set.
If that doesn't work your left with two options:
1. create a java concurrent program and set the properties manually.
2. Log a tar.
=================
==local idea's
=================
Are you sure you don't have to create template config for the locale? i suspect that's why it's not applying the xliff translation. Also, your NLS_LANG needs to be set to FRENCH for the approriate template to be applied. If your logged-in as english your french format template will not be applied, neither will the translation. As an example you can query vl table and you'll only get american (us) but if you alter your session you'll get the translation for that language when your query the table.
location="xdo://xxxAR.xxx_XML_PRINT.fr.US"
try it out and see if that works. Note: This will only work if your session NLS_LANG is set to FRENCH.

HT2534 My friend created me an itunes store account with his credit card , his credit card is about to expire and they are asking me to re-enter the credit card and security card number .... I don't have these numbers ... How can i create new itunes accou

My friend created me an itunes store account with his credit card , his credit card is about to expire and they are asking me to re-enter the credit card and security card number .... I don't have these numbers ... How can i create new itunes account without credit card?????

Why do you need to create a new account?
Just change the payment method.
http://support.apple.com/kb/ht1918

My iPhone 5 has broken and is being replaced with a new iPhone tomorrow. However, My carrier (orange) will b picking up my broken iPhone and I am unsure how to secure the content and icloud data on the broken phone. Is there a way to display the data?

My iPhone 5 has broken and is being replaced with a new iPhone tomorrow. However, My carrier (orange) will b picking up my broken iPhone and I am unsure how to secure the content and icloud data on the broken phone. Is there a way to disable the data held on it and ensure that if it is fixed, nobody can use/see my data and access my account?

Hi Gazpan,
Thanks for visiting Apple Support Communities.
I recommend using the steps in this article to back up your iPhone if possible:
iOS: Back up and restore your iOS device with iCloud or iTunes
http://support.apple.com/kb/ht1766
You may also find this advice helpful for your situation:
What to do before selling or giving away your iPhone, iPad, or iPod touch
http://support.apple.com/kb/ht5661
If you no longer have your iOS device
If you're using iCloud and Find My iPhone on the device, you can erase the device remotely and remove it from your account by signing in to icloud.com/find, selecting the device, and clicking Erase. When the device has been erased, click Remove from Account.
If you're unable to complete either of the above steps, you should change your Apple ID password. Changing your password won't remove any personal information that is cached on the device, but it will make sure that the new owner can't delete your information from iCloud.
Cheers,
Jeremy

What are the security settings to lock down a form with fillable fields and yet allow someone with Reader to fill in the fields as will as save the form and print it?

What are the security settings to lock down a form with fillable fields and yet allow someone with Reader to fill in the fields as will as save the form and print it?

You want to allow someone to open your document and fill out the form (in the fields you have created), but not change or edit the form, right? Here's the answer - assuming you are using Acrobat Pro and someone will be opening the PDF using at least Acrobat Reader 9 and up:
Tools > Protection > Encrypt < Encrypt with Password
Answer YES to change the security.
A new window opens:
 Do NOT select Document Open (or that will require a password to open the document.)
 Select: Permissions (Check the box next to "Restrict editing and printing of the document.")
 Change the following 2 settings from the drop-down box:
 Printing Allowed: Select High Resolution
 Changes Allowed: Select Commenting, filling in form fields, and signing signature fields
 Leave selected: "Enable text access for screen reader devices for the visually impaired"
 Change Permissions Password (insert a strong password)
 Leave all other settings alone in "Options"
 OK - OK
 Re-enter the Permissions Password (the one you entered above)
 OK - OK
 Save the PDF to apply the security [notice that (SECURED0 will appear after the document title]

Is there a way to view Flash videos on my iMac without downloading Adobe Flash Player? I'm concerned about performance and security with Flash Player.

Is there a way to view Flash videos on my iMac without downloading Adobe Flash Player? I'm concerned about performance and security with Adobe Flash Player.

If the video is only available in a format that requires Flash player : then no.
However, a great many can also be viewed in an HTML5 version, in which case http://hoyois.github.io/safariextensions/clicktoplugin/ or similar can be set up so that Flash never runs unless you specifically choose it to.

Hi guys Pls tell me a way to connect db4 database with jsp and which driver

hi guys
Pls tell me a way to connect db4 database with jsp and
also tell me which driver i have to use
also tell me how to connect with excel sheets

take a look at the follwing links. There, you'll find all what you need :
DB4:
http://www.oracle.com/database/berkeley-db/je/index.html
http://www.oracle.com/technology/products/berkeley-db/je/index.html
http://www.oracle.com/database/berkeley-db/db/index.html
http://www.oracle.com/database/docs/berkeley-db-je-datasheet.pdf
Excel:
http://64.18.163.122/rgagnon/javadetails/java-0516.html
Hope That Helps

How to export "Managed by" field of Distribution and Security groups and import with new values? (Exchange 2010, AD 2003)

My Active Directory environment is 2003 functional level and we have Exchange 2010.
I am trying to find out the best way to do a mass edit for the "Managed by" values of our security and distribution groups.
I know we can export the "managed by" field by csvde but I am not sure this is the correct way to do it. Also in the case that there are multiple users assigned to be managing a distribution group it only shows one value. Also powershell from Exchange
2010 can be used with "get-distribution" but as our AD environment is 2003 is this correct also?
Finally once the data is exported to csv can it be edited to then reimport and udpate the existing group managed by fields with new values?
Not really sure that the best way to go about this is.
Summary - We have 2003 AD with Exchange 2010 and I am trying to export a list of all our Distribution/Security groups showing the group name and managedby values so we can edit and update the
existing managedby values with new ones. In some cases we have multiple users as the owners.
Appreciate any advice on how this can be best achieved. Thank you.

Hi,
We can use the following command in Exchange 2010 to export "Managed by" field of Distribution and Security groups:
Get-DistributionGroup | Select-object Name,@{label="ManagedBy";expression={[string]::join(“;”,$_.managedby)}},Primarysmtpaddress | Export-Csv
C:\export.csv
After you changed the Managed by field in export.csv and saved it as a new file named import.csv, we can run the following command to set with new value:
Import-Csv C:\import.csv | Foreach-Object{ Set-DistributionGroup –Identity $_.Name –ManagedBy $_.ManagedBy}
Hope it works.
Thanks,
Winnie Liang
TechNet Community Support

Prelude and coda with JSP documents

Hello.
I have problems with adding prelude and coda templates to JSP documents (XML-format JSP).
This is content of my web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" version="2.4"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
 <display-name>simple</display-name>
 <jsp-config>
 <jsp-property-group>
 <display-name>simple</display-name>
 <url-pattern>*.jsp</url-pattern>
 <el-ignored>false</el-ignored>
 <scripting-invalid>false</scripting-invalid>
 <is-xml>true</is-xml>
 <include-prelude>/prelude.jspx</include-prelude>
 <include-coda>/coda.jspx</include-coda>
 </jsp-property-group>
 </jsp-config>
</web-app>This is from prelude.jspx:
<?xml version="1.0" ?>
<jsp:root version="2.0" xmlns:jsp="http://java.sun.com/JSP/Page">
 <jsp:directive.page contentType="text/html"/>
 <html xmlns="http://www.w3.org/1999/xhtml">This is coda.jspx:
 </html>
</jsp:root>And this is simple index.jsp of my web application:
<head>
 <title>Simple</title>
</head>
<body>
 <h2>Simple</h2>
</body>When running this on Tomcat 5.0.24 for Windows (Windows 2000 SP4) I get following exception on first request
org.apache.jasper.JasperException: /prelude.jspx(4,45) XML document structures must start and end within the same entity.Anyone have idea why is this happening ? How to include prelude and coda without breaking XML structure ?
Thanks, Nedim

The problem with what you are trying to do is that include will inlcude the response and not the original document.
In other words the jsp engine will try to compile prelude into a servlet, but because your xml document is not valid this would fail. Hence the XML error.
Do you absolutely need to use the xml syntax? Because jsp page syntax would work in this situation.

Standards in a web application with JSP and J2EE

Hello!
Can anyone to point me to a tutorial or an URL that contains standards for an web application with jsp(including tag libs), beans and servlets.
Thanks
Catalin

on the left side of this page...there are links "Documenation", "Tutorials", "Code Samples", pick your choice...there are alot of tutorials, try some or try them all :)

Authentification and Security in WebApp with JSP

Similar Messages

Maybe you are looking for