How to authenticate a JWS Client download of jar files on a web server

Question

Here is a history of how i tried to implement the auth system:
The resources(jar files) cannot be downloaded by any HTTP client from the server without some authentication method.
As JWS is not reliable when using cookies (only 1.5 supports them, but with problems when in JNLP file i specify j2se version=older that 1.5) , i implemented another mecanism that works like this:
1. 1.The template JNLP looks like this
<?xml version="1.0" encoding="utf-8"?>
<jnlp codebase="http://10.3.0.62/" href="mapped/#JWS_CODE#___#PLATFORM#___app2.2.jnlp">
    <information>
       bla bla
    </information>
    <security>
        <all-permissions/>
    </security>
    <resources>
        <j2se version="1.4"/>
        <jar href="http://10.3.0.62/mapped/gui.jar?jwsid=#JWS_CODE#" version="2.2"/>
        <jar href="http://10.3.0.62/mapped/data.jar?jwsid=#JWS_CODE#" version="2.2"/>
        <jar href="http://10.3.0.62/mapped/log4j.jar?jwsid=#JWS_CODE#"/>
    </resources>
    <application-desc main-class="com.bet.blues.gui.Application">
        <argument>-host</argument>
        <argument>ursus</argument>
        <argument>-port</argument>
        <argument>17771</argument>
    </application-desc>
</jnlp>2. All resources found in /mapped/ directory are mapped to JWSServlet
3. The users login to a site , clik on link , /mapped/app2.2.jnlp , the servlet checks if the session is active , gets the PLATFORM form browser request header , gets the JWSCODE for the logged user, replaces this in the template, and returns it to the client
4.Now after the 1st download the JNLP file is opened by JWS Client , that checks for latest version , requesting the JNLP file again
like this:
GET http://10.3.0.62/mapped/f12ks21092___windows___app2.2.jnlp5.Now the servlet sees the the request has a JNLP file name with an ID and PLATFORM, and serves the JNLP as before
6.The JWS Client will request for JAR Files
GET http://10.3.0.62/mapped/gui.jar?jwscode=f12ks21092?version-id=2.2Note: that i have forced JWSID parameter in the URL, that's why the query string contains 2 "?"
- forcing this is because the mapped/*.jar is redirected JnlpDownloadServlet that supports versions , diffs - i cannot use 'version' to put there the jswid param(e.g .../mapped/gui.jar version="fk12ks21092_2.2" because the JnlpDownloadServlet will not find this version , and if JWS Servlet will redirect to JnlpDownloadServlet with correct version param in request, the JWS Client will raise an exception because version responded is not right(JNLPDownloadServlet marks in response HTTP header the version of the jar so JWS CLient will chek it)
JWS Client expects version 'fk12ks21092_ver2.2'; to correct this i should modify the JnlpDownloadServlet and i shouldnt
THE PROBLEM :
on older versions than 1.5 JWS Client raises an exception because it wants to create a temp file named
" gui.jar?jwscode=f12ks21092" because it contains "?"
Only with 1.5 that seems to parse the jar name until it meets "?" char :(
Thats why i wanted to send an error to the client to upgrade to Java Web Start 1.5
Now, maybe u have a solution to this problem...
All i want is a solution to let JWS Client download jars only if the user is authenticated by some mecanism....and also support the versioning system.
Also:
Note that the jar names must preserve on the client JWS Cache dir ( i cannot use the same method to pass the JWSCODE when requesting the JARS as when requesting the JNLP).

Answer 1

You need to look into JAAS