1. Access control 2/18/2009

2. TOMCAT Security Model Declarative Security:  the expression of application security external to the application, and it allows runtime configuration  Configure in web.xml Programmatic Security:  implement fine-grained access control, enabling components to become security aware  Involves using HttpServletRequest API method

3. Declarative Security the expression of application security external to the application, and it allows runtime configuration Configure in web.xml

4. Role-based Authorization Use role-based authorization to manage access Define role in /conf/tomcat-user.xml *Need to restart TOMCAT after reconfiguration.

5. Role-based Authorization Define security role in web.xml The role that is required to log in to the Manager Application user /protected/* user

6. Authentication Method – 1: Basic Usage:  Pop up a dialog box  Browser-based auth  User & Password are sent in every http request  Must exit the browser to logout  Not secure at all (no encryption) Configuration in web.xml BASIC Tomcat Manager Application

7. Authentication Method – 2: Digest Usage:  Same as BASIC  Username and password are encrypted into a message digest value Configuration in web.xml DIGEST Tomcat Manager Application Has to use a secure connection, such as SSL, etc

8. Authentication Method – 3: Form Usage:  Define your own login and error page  Authentication is defined in servlet session  Logout by session.invalidate() Configuration in web.xml FORM /protected/login.jsp /protected/error.jsp

9. Authentication Method – 3: Form Must follow the rules  Use j_username field for the username  Use j_password field for the password  Submit to j_security_check Login.jsp Name: Password: Error.jsp The username and password you supplied are not valid. Click '>here to retry login

10. Authentication Method – 4: Client Usage  implemented with SSL and requires the client to possess a public key certificate  Most secure, but costly

11. Programmatic Security implement fine-grained access control, enabling components to become security aware Involves using HttpServletRequest API method

12. Access authentication info. getRemoteUser() getAuthType() isUserInRole() getUserPrincipal()  Principal is an alternated object to identify user show_security.jsp User principal:. User name:. Request Authenticated with:. You are in user role

13. Use Role in Web App. Under Structs Restricted access to Actions  In JSP  ……

14. Reference Good security tutorial: http://www.informit.com/articles/article.aspx?p=24253 http://www.informit.com/articles/article.aspx?p=24253 Http servlet request APIs: http://www.caucho.com/resin- javadoc/javax/servlet/http/HttpServletRequest.htmlhttp://www.caucho.com/resin- javadoc/javax/servlet/http/HttpServletRequest.html http://www.java2s.com/Tutorial/Java/0400__Servlet/0440 __Authentication.htm http://www.java2s.com/Tutorial/Java/0400__Servlet/0440 __Authentication.htm