10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

<strong>The</strong> action attribute has the expression #{navigation.logout.action} to invoke the action<br />

method of the Navigation enum. This returns the enum constant, representing the logical<br />

outcome, logout.<br />

<strong>The</strong> following piece of a navigation rule configuration in the faces-config.xml file<br />

corresponds to the action attribute expression of the preceding commandLink tag. It causes the<br />

logoff.jsp page to open if the logout logical outcome is returned.<br />

<br />

...<br />

<br />

<br />

Any action that returns "logout" should go to the<br />

logoff page and invalidate the session.<br />

<br />

logout<br />

/logoff.jsp<br />

<br />

When a page in the application is rendered, it is constructed with the aid of a template<br />

mechanism. Every page includes the template.jsp page, which in turn includes certain<br />

subcomponents, such as banner.jsp, into the page depending on which page is being rendered.<br />

<strong>The</strong> screendefinitions.jspf page, included in template.jsp, determines which page to<br />

render based on the current view ID, which identifies the UI component tree that represents the<br />

page to be rendered. <strong>The</strong> screendefinitions.jspf page accesses the view ID with this<br />

expression from its definition tag:<br />

<br />

Based on the view ID, the templating mechanism will include specific components into the<br />

page.<br />

Protecting theWeb Client Resources<br />

Web Client<br />

In the <strong>Java</strong><strong>EE</strong> platform, you protect a web resource from anonymous access by specifying which<br />

security roles can access the resource. <strong>The</strong> web container guarantees that only certain users<br />

acting in those roles can access the resource. For the web container to enforce the security<br />

constraint, the application must specify a means for users to identify themselves, and the web<br />

container must support mapping a role to a user.<br />

In the Duke’s Bank web client, you restrict all the URLs listed in Table 37–2 to the security role<br />

bankCustomer. <strong>The</strong> application requires users to identify themselves by means of the<br />

form-based login mechanism. When a customer tries to access a web client URL and has not<br />

been authenticated, the web container displays the JSP page logon.jsp. This page contains an<br />

Chapter 37 • <strong>The</strong> Duke’s Bank Application 1065

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!