Page redirection

Hi,

In my application users must be logged. I'm using the scope serializer
to keep the user information in the session.

I'm searching a way to redirect pages to the login page when users are
not logged. Hum... Am I clear ?

Ideally, this would be done in a .xpl file and I don't know how to do
that (if it's possible).

Any comments ?

Marc



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Marc

I would suggest something along the lines of the way the examples
supplied with OPS work.

For example, in the main page-flow.xml, you will find:
    <!-- Examples that do not work within the examples portal -->
    <page path-info="/examples-standalone/.*"
matcher="oxf:perl5-matcher" model="/examples/dispatch.xpl"/>

So this redirects all matching requests (possibly everything in your
case) to /examples/dispatch.xpl

If you take a look at that you can see an example of how it picks up the
original request path.

You probably want to incorporate at this point a check for the session,
and if not found then redirect to your login page (I would guess passing
in the original request path from above, so the login page can then
redirect back to the actual URL once logged in).

And if found, you would need to dispatch using the page-flow processor.
(And a secondary page-flow.xml where you define your real page flow).

So, the main page-flow.xml just specifies catching all URLs, checks the
session, redirects to the login if not logged in, or redirects to a new
page-flow.xml if logged in.

Steve

-----Original Message-----
From: [hidden email] [mailto:[hidden email]]
Sent: 26 April 2006 16:46
To: [hidden email]
Subject: [ops-users] Page redirection

Hi,

In my application users must be logged. I'm using the scope serializer
to keep the user information in the session.

I'm searching a way to redirect pages to the login page when users are
not logged. Hum... Am I clear ?

Ideally, this would be done in a .xpl file and I don't know how to do
that (if it's possible).

Any comments ?

Marc





--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Marc,

I would use the standard Java Servlet mechanisms for this: if you
specify things like this in your web.xml:

<security-constraint>
     <web-resource-collection>
         <web-resource-name>Protected</web-resource-name>
         <url-pattern>/my/protected/page</url-pattern>
     </web-resource-collection>
     <auth-constraint>
         <role-name>my-user-role</role-name>
     </auth-constraint>
</security-constraint>
<login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
         <form-login-page>/login</form-login-page>
         <form-error-page>/login-error</form-error-page>
     </form-login-config>
</login-config>
<security-role>
     <role-name>my-user-role</role-name>
</security-role>

The Servlet container will perform the redirections to the /login and
/login-error for you automatically when the user is not logged in and
attempts to access a protected page.

-Erik

[hidden email] wrote:
--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Thanks Stephen and Erik for these answears.

I will try both solutions.

As all my application pages must be under login control and I have lots of pages, I'm not sure that the web.xml solution is the best one for me. With Stephen's example, I don't have to add each new page in a file(web.xml).
But for special needs(with admin privileges for example) Erik solution is certainly the way to go.

Marc


-----Message d'origine-----
De : Erik Bruchez [mailto:[hidden email]] De la part de Erik Bruchez
Envoyé : mercredi 26 avril 2006 20:06
À : [hidden email]
Objet : Re: [ops-users] Page redirection

Marc,

I would use the standard Java Servlet mechanisms for this: if you specify things like this in your web.xml:

<security-constraint>
     <web-resource-collection>
         <web-resource-name>Protected</web-resource-name>
         <url-pattern>/my/protected/page</url-pattern>
     </web-resource-collection>
     <auth-constraint>
         <role-name>my-user-role</role-name>
     </auth-constraint>
</security-constraint>
<login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
         <form-login-page>/login</form-login-page>
         <form-error-page>/login-error</form-error-page>
     </form-login-config>
</login-config>
<security-role>
     <role-name>my-user-role</role-name>
</security-role>

The Servlet container will perform the redirections to the /login and /login-error for you automatically when the user is not logged in and attempts to access a protected page.

-Erik

[hidden email] wrote:
--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/




--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

You don't have to specify each URL individually in Eric's solution.

Eg you can use /* or /my-app/* for the <url-pattern>, so this may well be the simplest approach.

-----Original Message-----
From: [hidden email] [mailto:[hidden email]]
Sent: 27 April 2006 09:07
To: [hidden email]
Subject: RE: [ops-users] Page redirection

Thanks Stephen and Erik for these answears.

I will try both solutions.

As all my application pages must be under login control and I have lots of pages, I'm not sure that the web.xml solution is the best one for me. With Stephen's example, I don't have to add each new page in a file(web.xml).
But for special needs(with admin privileges for example) Erik solution is certainly the way to go.

Marc


-----Message d'origine-----
De : Erik Bruchez [mailto:[hidden email]] De la part de Erik Bruchez
Envoyé : mercredi 26 avril 2006 20:06
À : [hidden email]
Objet : Re: [ops-users] Page redirection

Marc,

I would use the standard Java Servlet mechanisms for this: if you specify things like this in your web.xml:

<security-constraint>
     <web-resource-collection>
         <web-resource-name>Protected</web-resource-name>
         <url-pattern>/my/protected/page</url-pattern>
     </web-resource-collection>
     <auth-constraint>
         <role-name>my-user-role</role-name>
     </auth-constraint>
</security-constraint>
<login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
         <form-login-page>/login</form-login-page>
         <form-error-page>/login-error</form-error-page>
     </form-login-config>
</login-config>
<security-role>
     <role-name>my-user-role</role-name>
</security-role>

The Servlet container will perform the redirections to the /login and /login-error for you automatically when the user is not logged in and attempts to access a protected page.

-Erik

[hidden email] wrote:
--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/






--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

[hidden email] wrote:
 > Thanks Stephen and Erik for these answears.
 >
 > I will try both solutions.
 >
 > As all my application pages must be under login control and I have
 > lots of pages, I'm not sure that the web.xml solution is the best
 > one for me. With Stephen's example, I don't have to add each new
 > page in a file(web.xml).

You don't have to list every single page with web.xml either: you just
specify a path that protects all the pages under it.

-Erik

--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Stephen, Erik,

Of course, I have not to add each page in web.xml...

In my app, admin user can add new users and give them access right for each field. There is potientially a great number of users(with different access right). So I think that I have to do that in OPS.
I want to redirect all matching requests to a xpl file. In this xpl, as pointed by Stephen, I check the session, redirect to the login if not logged in, or redirect to a new page-flow.xml if logged in.

I have to use "regular expression" in the path-info of the 1st page-flow.xml. And this regular expression must redirect all the pages except the one named "login". I'm not able to find how to do that. I've tried this without success :

<page path-info="/(?!login)" matcher="oxf:perl5-matcher" model="oxf:/dispatch.xpl"/>

Any help ?

Marc

-----Message d'origine-----
De : Erik Bruchez [mailto:[hidden email]] De la part de Erik Bruchez
Envoyé : jeudi 27 avril 2006 19:25
À : [hidden email]
Objet : Re: [ops-users] Page redirection

[hidden email] wrote:
 > Thanks Stephen and Erik for these answears.
 >
 > I will try both solutions.
 >
 > As all my application pages must be under login control and I have  > lots of pages, I'm not sure that the web.xml solution is the best  > one for me. With Stephen's example, I don't have to add each new  > page in a file(web.xml).

You don't have to list every single page with web.xml either: you just specify a path that protects all the pages under it.

-Erik

--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/




--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Marc

Maybe you could first put a specific match for your login page (as one <page ... /> node) , and then follow that with a 2nd <page ... /> node with your regex matcher to catch everything else?

Steve

-----Original Message-----
From: [hidden email] [mailto:[hidden email]]
Sent: 02 May 2006 10:56
To: [hidden email]
Subject: RE: [ops-users] Page redirection

Stephen, Erik,

Of course, I have not to add each page in web.xml...

In my app, admin user can add new users and give them access right for each field. There is potientially a great number of users(with different access right). So I think that I have to do that in OPS.
I want to redirect all matching requests to a xpl file. In this xpl, as pointed by Stephen, I check the session, redirect to the login if not logged in, or redirect to a new page-flow.xml if logged in.

I have to use "regular expression" in the path-info of the 1st page-flow.xml. And this regular expression must redirect all the pages except the one named "login". I'm not able to find how to do that. I've tried this without success :

<page path-info="/(?!login)" matcher="oxf:perl5-matcher" model="oxf:/dispatch.xpl"/>

Any help ?

Marc

-----Message d'origine-----
De : Erik Bruchez [mailto:[hidden email]] De la part de Erik Bruchez
Envoyé : jeudi 27 avril 2006 19:25
À : [hidden email]
Objet : Re: [ops-users] Page redirection

[hidden email] wrote:
 > Thanks Stephen and Erik for these answears.
 >
 > I will try both solutions.
 >
 > As all my application pages must be under login control and I have  > lots of pages, I'm not sure that the web.xml solution is the best  > one for me. With Stephen's example, I don't have to add each new  > page in a file(web.xml).

You don't have to list every single page with web.xml either: you just specify a path that protects all the pages under it.

-Erik

--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/






--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Thanks again Stephen.

Marc

-----Message d'origine-----
De : Stephen Bayliss [mailto:[hidden email]]
Envoyé : mardi 2 mai 2006 16:59
À : [hidden email]
Objet : RE: [ops-users] Page redirection

Marc

Maybe you could first put a specific match for your login page (as one <page ... /> node) , and then follow that with a 2nd <page ... /> node with your regex matcher to catch everything else?

Steve

-----Original Message-----
From: [hidden email] [mailto:[hidden email]]
Sent: 02 May 2006 10:56
To: [hidden email]
Subject: RE: [ops-users] Page redirection

Stephen, Erik,

Of course, I have not to add each page in web.xml...

In my app, admin user can add new users and give them access right for each field. There is potientially a great number of users(with different access right). So I think that I have to do that in OPS.
I want to redirect all matching requests to a xpl file. In this xpl, as pointed by Stephen, I check the session, redirect to the login if not logged in, or redirect to a new page-flow.xml if logged in.

I have to use "regular expression" in the path-info of the 1st page-flow.xml. And this regular expression must redirect all the pages except the one named "login". I'm not able to find how to do that. I've tried this without success :

<page path-info="/(?!login)" matcher="oxf:perl5-matcher" model="oxf:/dispatch.xpl"/>

Any help ?

Marc

-----Message d'origine-----
De : Erik Bruchez [mailto:[hidden email]] De la part de Erik Bruchez Envoyé : jeudi 27 avril 2006 19:25 À : [hidden email] Objet : Re: [ops-users] Page redirection

[hidden email] wrote:
 > Thanks Stephen and Erik for these answears.
 >
 > I will try both solutions.
 >
 > As all my application pages must be under login control and I have  > lots of pages, I'm not sure that the web.xml solution is the best  > one for me. With Stephen's example, I don't have to add each new  > page in a file(web.xml).

You don't have to list every single page with web.xml either: you just specify a path that protects all the pages under it.

-Erik

--
Orbeon - XForms Everywhere:
http://www.orbeon.com/blog/







--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Hi Marc,

If you users are dynamically created, listing them in tomcat-users.xml
would not work. However that does not necessarily rule out the option
of using standard servlet authentication. Here using another security
realm might solve your problem. For instance, if you have your list of
users and groups stored in a relational database, you can use the
Tomcat JDBCRealm. More on Tomcat realms can be found on:

http://tomcat.apache.org/tomcat-5.0-doc/realm-howto.html

Alex

On 5/2/06, [hidden email] <[hidden email]> wrote:
--
Blog (XML, Web apps, Open Source):
http://www.orbeon.com/blog/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws