The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Examples: SecuringWeb Applications
864
application included with this tutorial, many of these steps have been completed for you and are
listed here simply to show what needs to be done should you wish to create a similar
application. The completed version of this example application can be found in the directory
tut-install/javaeetutorial5/examples/web/hello1_formauth/.
The following steps describe how to set up your system for running the example applications,
describe the sample application, and provide the steps for compiling, packaging, deploying, and
testing the example application.
1. If you have not already done so, set up your system so that the Ant tool and/or NetBeans
IDE will run properly. To do this, follow the instructions in “Building the Examples” on
page 69.
2. If you have not already done so, add an authorized user to the Application Server. For this
example, add users to the file realm of the Application Server and assign the user to the
group user. This topic is discussed more in “Adding Authorized Roles and Users” on
page 868.
3. Create a web module as described in “Web Modules” on page 81. The subsequent steps
discuss adding security to this basic application. The resulting application is found in the
directory tut-install/javaeetutorial5/examples/web/hello1_formauth/.
4. Create the login form and login error form pages. Files for the example application can be
viewed at tut-install/javaeetutorial5/examples/web/hello1_formauth/web. These
pages are discussed in “Creating the Login Form and the Error Page” on page 865.
5. Create a web.xml deployment descriptor and add the appropriate security elements (the
application on which this section is based did not originally require a deployment
descriptor.) The deployment descriptor for the example application can be viewed at
tut-install/javaeetutorial5/examples/hello1_formauth/web/WEB-INF. The security
elements for the web.xml deployment descriptor are described in “Specifying a Security
Constraint” on page 866.
6. Map the role name defined for this resource (loginUser) to a group of users defined on the
Application Server. For more information on how to do this, read “Mapping Application
Roles to Application Server Groups” on page 869.
7. Build, package, deploy, and run the web application by following the steps in “Building,
Packaging, and Deploying the Form-Based Authentication Example Using NetBeans IDE”
on page 869 or “Building, Packaging, and Deploying the Form-Based Authentication
Example Using Ant” on page 870.
8. Test the web client, following the steps in “Testing the Form-Based Authentication Web
Client” on page 870.
Creating aWeb Client for Form-Based Authentication
The web client in this example is a standard JSP page, and annotations are not used in JSP pages
because JSP pages are compiled as they are presented to the browser. Therefore, none of the
code that adds form-based authentication to the example is included in the web client. The code
The Java EE 5Tutorial • June 2010