The most common type of container-managed security is built on form-based authentication, discussed in Section 7.1. There, the server automatically redirects unauthenticated users to an HTML form, checks their username and password, determines which logical roles they are in, and sees whether any of those roles is permitted to access the resource in question. Then, it uses a variation of session tracking to remember the users that have already been authenticated.
This approach has the advantage that the login form can have the same look and feel as the rest of the Web site. However, it has a few disadvantages. For example, if the client’s browser does not support cookies, session tracking would have to be performed with URL rewriting. Or, the server might be configured to always use URL rewriting. The servlet specification explicitly states that form-based authentication is not guaranteed to work in such a case.
So, another approach is to use the standard HTTP BASIC security. With BASIC security, the browser uses a dialog box instead of an HTML form to collect the username and password. Then, the Authorization request header is used to remember which users have already been authenticated. As with form-based security, you must use SSL if you are concerned with protecting the network traffic. However, doing so neither changes the way BASIC authentication is set up nor necessitates changes in the individual servlets or JSP pages.
There is also DIGEST security and security based on client certificates. However, few browsers or servers support DIGEST, and only fully J2EE-compliant servers are required to support client certificates. For more information on client certificates, see Section 8.5 (Using Programmatic Security with SSL).
Compared to form-based authentication, the two main disadvantages of BASIC authentication are that the input dialog looks glaringly different than the rest of your application and that it is very difficult to log in as a different user once you are authenticated. In fact, once authenticated, you have to quit the browser and restart if you want to log in as a different user! Now, in principle it is possible to write a “relogin” servlet that sends a 401 (Unauthorized) status code and a WWW-Authenticate header containing the appropriate realm. But, that is hardly “declarative” security!
Use of BASIC security involves five steps, as shown below. Each of the steps except for the second is identical to the corresponding step used in form-based authentication.
Details on these steps are given in the following sections.
This step is exactly the same when BASIC authentication is used as when form-based authentication is used. See Section 7.1 for details. For a quick summary, recall that this process is completely server specific. Tomcat uses install_dir/conf/tomcat-users.xml to store this information, JRun uses install_dir/lib/users.properties, and ServletExec has an interactive user interface to enable you to specify the information.
You use the login-config element in the deployment descriptor to control the authentication method. To use BASIC authentication, supply a value of BASIC for the auth-method subelement and use the realm-name subelement to designate the realm that will be used by the browser in the popup dialog box and in the Authorization request header. Listing 7.22 gives an example.
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN" "http://java.sun.com/j2ee/dtds/web-app_2_2.dtd"> <web-app> <!-- ... --> <security-constraint>...</security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>Some Name</realm-name> </login-config> <!-- ... --> </web-app> |
You designate password-protected resources in the same manner with BASIC authentication as you do with form-based authentication. See Section 7.1 for details. For a quick summary, you use the security-constraint element to specify restricted URLs and the roles that should have access to them. The security-constraint element should come immediately before login-config in web.xml and contains four possible subelements: display-name (an optional element giving a name for IDEs to use), web-resource-collection (a required element that specifies the URLs that should be protected), auth-constraint (an optional element that designates the abstract roles that should have access to the URLs), and user-data-constraint (an optional element that specifies whether SSL is required). Multiple web-resource-collection entries are permitted within security-constraint.
You designate SSL-only resources in the same manner with BASIC authentication as you do with form-based authentication. See Section 7.1 for details. To summarize: use the user-data-constraint subelement of security-constraint with a transport-guarantee subelement specifying INTEGRAL or CONFIDENTIAL.
In addition to simply requiring SSL, the servlet API provides a way for stipulating that users must authenticate themselves with client certificates. You supply a value of CLIENT-CERT for the auth-method subelement of login-config (see “ Specifying URLs That Should Be Password Protected ” in Section 7.1). However, only application servers that have full J2EE support are required to support this capability.
3.133.133.233