Secure Map Rendering on Javabean based API

Question

Hi,
I need to apply secure mapping functionality using Mapviewer’s JavaBean based API. I’ve created a secure data source by adding the plsql_package="web_user_info" statement on the data source definition. For testing purposes I’ve used mvdemo data set and followed the steps of Secure Map Rendering Demo. I created "web_user_info" package on mvdemo schema as well as a view on CUSTOMERS table (create or replace view customers_view as select * from customers where account_mgr = web_user_info.get_user) and a geometry theme: mycystomers on that view.
I also added the appropriate authenticated web users to the OC4J container(e.g. alex) and assigned them the "users" role.
Finally I included the relative path of JSP Demo (with mapclient lib) that resides at http://server:port/mapviewer/demo/mapinit.jsp to the <security-constraint> element of web.xml file so that the data source can get the web user name from J2EE user:
<!-- For Secure Map Rendering demos only -->
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure mapping demo page</web-resource-name>
<description>MapViewer secure map rendering demo</description>     
     <url-pattern>/demo/secure-mapping.html</url-pattern>
     <url-pattern>/demo/mapinit.jsp</url-pattern>
     <url-pattern>/demo/map.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>secure_maps_role</role-name>
</auth-constraint>
</security-constraint>
After authenticating to the http://server:port/mapviewer/demo/mapinit.jsp JSP demo through mapviewer's login page that was automatically generated because of the security-constraint, I filled in the required fields asking for base map: demo_map. I also modified "demo_map" by adding "mycustomers" theme to it. Unlike Oracle Maps Map Rendering Demo (http://server:port/mapviewer/demo/secure-mapping.html) that displays only those customers that belong to the authenticated user, the generated map does not display any customer data at all.
Does Secure Map Rendering Demo apply just for the Oracle Maps Javascript API and the XML API or is there any other parameter that I’m missing and needs to be configured in order for it to run for the JavaBean based API as well?
Any help on the above matter would be really appreciated.
Thanks in advance.

Answer 1

Hi,
The reason the JSP files did not show the secured customers, is because while you authenticated to the J2EE server when accessing these JSP files, the JSP file themselves did not authenticate to the J2EE server. In other words, there are two sessions involved. One session is between your browser and the J2EE server, which contains the authenticated user ID. This session is initiated when you try to open the mapinit.jsp page.
The other session is established when the JSP page (map.jsp) opens a new HTTP Connection to the server to send the XML map request generated from various JavaBean API calls. To be more specific, when the JSP page invokes MapViewer.run(), this method internally gathers all the themes/basemaps you have added to the client handle, then constructs a single XML map request out of these pieces of information. It then opens a HTTP connection back to the same server to send the XML doc to mapviewer for processing. The problem is that to the J2EE server this is a new session (initiated by map.jsp), and it does not contain any authentication info.
Because currently the JavaBean API does not support setting a cookie or user credential directly on its internal Http connections, there seems to be no easy work around for this issue for now. Please contact us offline if you would like to open an enhancement request.
Thanks
LJ