Raible Designs

Form-Based Authentication

I posted the following message to the tomcat-user group yesterday:

On Tomcat 4/5, I am able to use the following configuration in my 
web.xml:

<login-config>
  <auth-method>FORM</auth-method>
  <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/login.jsp?error=true</form-error-page>
  </form-login-config>
</login-config>

However, I know that there are app servers out there that do not support
this - the form-error-page MUST be a different JSP.  So I'm wondering,
is there a value I can grab in my login.jsp that tells me the URL of the
protected resource the user is trying to get to?

I tried <%=request.getRequestURL()%>, but that gives me .../login.jsp -
and I am expecting welcome.do.

I know iPlanet used to set a cookie and I could use that as described
here.

Thanks,

Matt

Craig McClanahan responded with the following answer - which was just the information I was looking for:

There is no portable mechanism to acquire the request URL that was originally requested, nor any guarantee that this is even possible. All you know is that the container has detected that a protected URL was requested, and that there was no currently authenticated user.

So the lesson learned is that if you want to make your webapp portable across different app servers, use two separate pages for the login and login-error pages.

Bend, Oregon

Russell says he's heading to Bend, Oregon next weekend. Cool! I went to high school in Salem, Oregon and a bunch of my friends lived in Bend after college. Julie and I have visited Bend a few times, and it's a really nice mountain town. It's kinda like Denver, but a lot smaller (but growing rapidly). They get 300 days of sunshine a year (like Denver) and have a great micro-brewery. Everytime I've been there, I've wanted to move there. It's got great skiing too! But then again, Russ may not like it since he hates the cold and it was 15 degrees (F) this morning!

validator.w3.org

The W3C has revamped it's HTML Validation service and it shall be known as the MarkUp Validation Service from now on. I stumbled upon is when validating this site. It's now got a tip-of-the-day and links to all the different specs and associated services (i.e. CSS Validation). For you reading pleasure, here's a complete list of what's new.

Struts-XDoclet 0.1

I did a bunch of work today to get struts-xdoclet off the ground. Basically, all that exists write now is the generation of struts-config.xml and web.xml from xml files in a merge directory. There are no .java files in this project yet.

I'm posting this to you in hopes of getting some validation of the directory structure and Ant-based build/deploy process. The deploy task originally worked as Erik Hatcher suggests in his book, but whenever I tried to redeploy, it would give me errors when trying to remove a .jar file - so I resorted back to a simple copy to $CATALINA_HOME/webapps. The build.xml file I put together is based on what I found in struts-blank.war (for 1.1), roller's build process, my own experience and good ideas from the Ant book.

I've also configured form-based authentication and I plan to add a bunch of optional modules (i.e. SSLExt for SSL Switching, password encryption) to the mix.

I'm still searching for a sample-app idea for the persistence layer (i.e. authors and books). I'd like to do something that folks can use, so I'd definitely like to include an admin section for administering user's and their properties. Maybe even offer features such as registration (might be a bit difficult using tomcat-users.xml, but not so bad with JDBCRealm or an LDAP server), and password recovery.

You can download the first cut of this - which should build and allow you to login - at http://www.raibledesigns.com/struts/.

Next steps include the security modules I mentioned above, and generating validation.xml and persistence classes from a POJO. I'm still undecided on using Castor or Hibernate for the persistence layer. Dave (Johnson) seems to think Hibernate has some great stuff, and he's used Castor for a while, so that's probably the direction I'm leaning towards. It would be great do be able to do both.

Mozilla 1.2 Final?

MacUpdate reports that Mozilla 1.2 Final has been released - even though it's located in the nightly build area of the site. I'll wait until the announcement is posted on mozilla.org, but just in case you're impatient. [Download]

Photoshop 7 Shortcuts

Zeldman gives a link to Photoshop 7 Keyboard shortcuts for Windows. On the Mac, substitute COMMAND (the Apple key) for CTRL and OPTION for ALT.

I'd probably know a lot more of these if I was still continuing my quest for a Photoshop Certification. I still want to get it, but the Java/Struts/XDoclet realm is more inspiring and more fun right now. I haven't touched the Photoshop 7 Bible in about a month! Maybe I'll get back into it, but I probably won't finish it this year.

Services for UNIX

I received a Services for UNIX CD in the mail today from Microsoft. That's funny since I remember receiving an installing SFU 3.0 back in July. I tried to telnet into my XP box, and apparently the 120-Day Evaluation has expired. It's nice that they sent me a new 120-Day Evaluation. I wonder if I'll get another one after 4 months. I'd buy it if I really needed it since it's only $99. However, since the license expired a couple weeks ago, and I didn't even notice, I must not use it. It's very much like Cygwin, except you get everything that UNIX has - including a telnet server, and you can type ls from a DOS prompt.

BTW, did you know you can enable command-completion on any Windows machine? Here's how.

Most Common 508 Issues

I found this great link on the Most Common 508 Accessiblity Errors. It also has some great examples on using the <label> and <fieldset> tags for marking up your forms.

Running Tomcat 5

I've gotten a little closer to using and running Tomcat 5. My last post on the subject pointed out an error I received about comments in XML (org.xml.sax.SAXParseException: The string "--" is not permitted within comments). Well, this turned out to be a Xerces issue and has already been reported. So, like a good little programmer, I downloaded the nightly build of Xerces, and replaced xercesImpl.jar and xmlParseAPIs.jar in common/endorsed. Now, I can view the jsp-examples and servlet-examples applications, but I get this error on startup.

XDoclet and Castor

I found this post on the castor-dev mailing list this afternoon. It seems to indicate that there's a better version of the Castor module for XDoclet.

The "exolab2" module is nearly identical to the original exolab module in that it:

1. generates the mapping.xml file

however, exolab2 differs in that it:

1. works on the fields in a class instead of the methods
-working with field name seems easier and more logical as castor
is for mapping class/db fields, not methods
2. generates the database.xml file
3. generates the create.sql and drop.sql for each class' table
4. doesn't require explicitly declaring the @castor:field-sql type="..." for each class field; it uses a simple look up .xml file to retrieve the appropriate/default sql type for the field's java type
5. doesn't require explicitly declaring the @castor:class table="...";
the class' name will be used as the default table name

so in summary, it generates:

-database.xml
-mapping.xml
-create.sql
-drop.sql

with less "work" than before. basically, these improvements are to help developers quickly and easily generate all the castor-specific and non-castor-specific (sql table defintions) code for new projects.

Too bad this isn't available in XDoclet as of yet. Hmmm, maybe I can use Castor Doclet to generate my DDL.