This example will show you how to do this. I am using eclipse IDE in this example.
Create a new Dynamic Web project in Eclipse. I name the project as BasicAuthTest.
Right click on the WebContent folder and create a new JSP page. I name it as home.jsp.
Change the content of the page as below.
<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE html>
<html>
<head>
</head>
<body>
<h1>Hello User!</h1>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body>
<h1>Hello User!</h1>
</body>
</html>
Now open the web.xml file. You can find it in WEB-INF folder.
Clear the default content between <webapp> </webapp> tags. Now the file will look like this.
Now add following block between the <webapp> </webapp> tags.
<security-constraint>
<web-resource-collection>
<web-resource-name>jsp pages</web-resource-name>
<url-pattern>*.jsp</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
</security-constraint>
<web-resource-collection>
<web-resource-name>jsp pages</web-resource-name>
<url-pattern>*.jsp</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
</security-constraint>
As you can understand in the above code we have introduced a security-constraint block. Within it we define a web-resource-collection. web-resource-collection is a collection of resources that we need to protect. First we give a name for the collection. Then we define a url pattern. It means all the resources which match this url pattern are protected. Note that the url pattern we have used is *.jsp. It means all the requests ends with .jsp require this authentication.
Similarly you can define a url pattern of a servlet within the url-pattern tags as below.
<url-pattern>/LoginServlet</url-pattern>
Then all the requests with this pattern(i.e. http://localhost:8080/BasicAuthTest/LoginServlet) also requires authentication.The http-method specifies which HTTP methods should be refined by this security constraint. In above code we have only the GET defined as the http method. It means this constraint applies only to GET requests. You can have multiple http-method nodes within the <web-resource-collection> </web-resource-collection> block . If you didn't specify any http-methods this constraint is applied to all the HTTP methods.
Then within <auth-constraint> </auth-constraint> tags we define the role where users in which can access this resources. You can have multiple <role-name> tags within this <auth-constraint> </auth-constraint> tags. Here we have specified manager as the role where users belongs to which role can access these restricted resources. We should also have to define this role as a security role in web.xml. See below code.
Add following block after the <security-constraint> </security-constraint> block.
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>allPages</realm-name>
</login-config>
<security-role>
<role-name>manager</role-name>
</security-role>
<auth-method>BASIC</auth-method>
<realm-name>allPages</realm-name>
</login-config>
<security-role>
<role-name>manager</role-name>
</security-role>
In above code within the <login-config> </login-config> block we define the auth-method (authentication method) as BASIC. This is because in this example we are going to use Basic Authentication.
Possible values for auth-method are:
✔ BASIC
✔ DIGEST
✔ CLIENT-CERT
✔ FORM
There is another node inside the <login-config> </login-config> tags. It is <realm-name>allPages</realm-name>. What does this do?
The tag realm-name is used to separate a certain authenticated area which can be accessed using same credentials. This realm value is included in the header of the server response and when the browser reads this it opens a dialog box asking the username and password for this realm.
Keep in mind that realm-name is used in Basic Authentication only.
Ok. That is it. Now right click on the project name BasicAuthTest ⇨ Run As ⇨ Run On Server
Select Tomcat server and click Finish.
Now your application will be deployed in Tomcat server. After the server started, enter following url in the address bar of your web browser.
http://localhost:8080/BasicAuthTest/home.jsp (Assuming your Tomcat runs on port 8080)
✎ Note:-
I recommend to use FireFox because in chrome it is difficult to clear the cached credentials of Basic Authentication. In FireFox cached Basic Authentication Credentials are cleared after you restart the FireFox. If you still want to test this with chrome you may need to read this stackoverflow post.
Wow! You will see a dialog box asking for a username and a password to access the page.
Enter arbitrary credentials and try. You will again and again receive the popup.
Configuring Tomcat users and Roles
In order to login you need to have a user with the role manager configured in tomcat-users.xml file.
In Project Explorer open the Servers folder and you will see your Tomcat instances. Expand the relevant tomcat folder and double click the tomcat-users.xml file.
✎ Note:-
In your Tomcat installation directory you can find another tomcat-user.xml file. However in the case you start the Tomcat through Eclipse, there is no effect of changing this default tomcat-user.xml file. When Tomcat is started through Eclipse it doesn't read configurations from this file. Instead it reads the tomcat-user.xml file I have shown in above screen.
Add following lines inside the <tomcat-users> </tomcat-users> tags. In first line we are creating a role named as "manager". In second line we are creating a user with username "admin" and password "admin" and assigns the role "manager" to that user.
<role rolename="manager"/>
<user password="admin" username="admin" roles="manager"/>
<user password="admin" username="admin" roles="manager"/>
Save the tomcat-users.xml file and restart the Tomcat server. Restart FireFox and retry the url
http://localhost:8080/BasicAuthTest/home.jsp (Assuming your Tomcat runs on port 8080).
Enter the username and password as "admin" and "admin".
Now you should be able to login.
✎ Note:-
After you successfully logged in, you can again and again access your protected resources without being asked for the credentials. If you want to see the login box again just restart FireFox. For chrome users please take a visit to this stackoverflow post.
No comments:
Post a Comment