<< Sums Of Odd Integers | Home | If Your Ant Build File Works On Windows But ... >>

Weblog Software Upgraded

I upgraded the weblog software this weekend to Pebble 1.4-dev. A major new feature is trackback.

An interesting twist is that Pebble 1.4-dev uses the commons-httpclient.jar from Apache Commons Project. JBoss 3.2.1 + Tomcat 4.1.24 that hosts this weblog also uses it.

Of course they use different versions of the jar. And posting a trackback to my weblog causes a NoSuchMethodException because the older version that JBoss uses lacks certain method present in the newer version.

Tweaking JBoss's class loading scheme to force the webapp to load it's own commons-httpclient.jar causes errors elsewhere. Copying the newer jar over the older jar doesn't work either.

Luckily, the latest beta version of JBoss, 3.2.2 RC4, uses the exact same version of commons-httpclient.jar as Pebble 1.4-dev. So I upgraded JBoss, and the new feature works as advertised now.

I still have problem with HTTP BASIC authentication in the embedded Tomcat. But it only affect the owner.

Tags :
Responses[6] RSS feed for responses to this blog entry
Posted by Weiqi Gao on October 12, 2003 7:50:11 PM CDT #


Reply

Re: Weblog Software Upgraded

Comment from Simon Brown on October 14, 2003 5:12:39 AM CDT #
If you login and then navigate back to the home page of the webapp, do you lose all the admin links at the top of the page? I've installed the same version of JBoss/Tomcat that you're running and this is what happens to me. I am guessing that this is why I also can't see the remove comment link when the popup window opens. It seems that JBoss doesn't remember that you are logged in unless you access a secured resource. Very strange. I thought at first that the session was timing out immediately, but this doesn't seem to be the case. I will continue looking for a solution.
Reply

Re: Weblog Software Upgraded

Comment from Weiqi Gao on October 14, 2003 7:55:38 AM CDT #
Yes, I do lose the admin links if I come back to the home page after loggin in. I checked JBoss's bug database at SourceForge and saw one entry about Form based authentication not working with Jetty (Bug number 786668). I'm not sure if that is related to what we are seeing, though. My post to jboss-users remain unanswered.
Reply

Re: Weblog Software Upgraded

Comment from Weiqi Gao on October 14, 2003 10:35:46 AM CDT #

JBoss's Scott M Stark wrote on jboss-user:

There is nothing wrong with basic auth in JBoss-3.2.2RC4_Tomcat-4.1.27. It sounds like the app is expecting there to be a valid user on non-secured pages and the caching that is required to achive this is disabled in the embedded version because it breaks the ability to transmit the caller credentials from servlets to ejbs. There is no spec mandate that the caller identity is available within a session from unsecured pages.

Reply

Re: Weblog Software Upgraded

Comment from Simon Brown on October 14, 2003 2:22:11 PM CDT #
True, the spec may not explicitly mandate this, but section SRV.12.3 Programmatic Security (servlets 2.3) says the following:

If no user has been authenticated, the getRemoteUser method returns null, the isUserInRole method always returns false, and the getUserPrincipal method returns null.

Clearly this is in contrast because this statement doesn't differentiate protected and unprotected resources. The javadoc of the relevant methods in HttpServletRequest also makes no differentiation between protected and unprotected resources, instead being specific about whether the current user has been authenticated. With our problem, the current user has been authenticated. IMHO, I don't think JBoss is playing ball.

Perhaps it's worth dropping a note to this effect (or even copying and pasting this response) into the JBoss forum. ;-)
Reply

Re: Weblog Software Upgraded

Comment from Simon Brown on November 26, 2003 4:02:42 PM CST #
Just thought you'd like to know that Pebble 1.4 will have fixes for all this stuff nasty security stuff. I'll write a blog entry about it all (as I think it's quite interesting), but essentially when logging in, I've had to stick the user's credentials into their session. I think it's the only way that you can guarantee consistency between web servers. Tomcat and Resin work how I would expect, but JBoss and Jetty are a different story!
Read more...

Deploying Pebble to JBoss 3.2.1/Tomcat 4.1.24

TrackBack from Simon Brown's weblog on October 14, 2003 8:35:05 AM CDT #

Weiqi runs Pebble on the JBoss 3/Tomcat 4 distribution and aside from some problems with the Servlet security mechanism it seems to be working well.


Add a comment Send a TrackBack