Jetty

Armi, can you change the JDBCUserRealm class do use integer comparison, and test it for backwards compatibility with mysql? Thanks.

Hi Armi, what's the status on this issue, is it fixed?

Hi Jan,

I sent emails on this last 12/6/2006 and again on 01/16/2007 ( I hope they didn't get lost somewhere ). As I mentioned that time, I tried using Jetty JDBCUserRealm with Derby and it actually worked for me as it was. If you'd prefer though, I modified the class to do integer comparison and the modified file is committed in my sandbox. I used the "test" webapp example for testing with both Derby and MySQL.

Best regards,
Armi

Matthias, can you confirm whether this is a problem under jetty 6.1.1 or 6.1.2pre0? If it is, please also include details of your platform etc. Thanks.

Sorry, I really missed those mails. I will check as requested and let you know. Thanks for addressing this.
Best regards,
Matthias

Hello,

I just tried again with jetty-6.1.2pre0 as requested. It continues to not work.
Derby is current: db-derby-10.2.2.0-bin; JDK is Sun 1.6 or JDK 1.5 (does not matter). Since the source code has not changed a bit for JDCBUserRealm, I really did not expect any change in functionality. The code still contains setObject instead of setInt in 6.1.2pre0.

I am using the test application as well.

• Starting jetty with java -jar start.jar etc\jetty.xml
• with a realm definition in jetty.xml as follows:
  <Set name="UserRealms">
  <Array type="org.mortbay.jetty.security.UserRealm">
  <Item>
  <New class="org.mortbay.jetty.security.JDBCUserRealm">
  <Arg>Test Realm</Arg>
  <Arg>etc/derbyRealm.properties</Arg>
  </New>
  </Item>
  </Array>
  </Set>
• with derbyRealm.properties containing:

-8<-
jdbcdriver=org.apache.derby.jdbc.ClientDriver
url=jdbc:derby://localhost:1527/DBWebApp
username=app
password=password
usertable=users
usertablekey=id
usertableuserfield=username
usertablepasswordfield=pwd
roletable=roles
roletablekey=id
roletablerolefield=role
userroletable=user_roles
userroletableuserkey=user_id
userroletablerolekey=role_id
cachetime=30
-8<-

• and derby's derbynet.jar and derbyclient.jar in lib/ext
• and a normal derby listener running on localhost:1527 with database DBWebApp

The schema can be set up using follwing SQL (note that derby does not allow column name user without quoting as this is a reserved keyword, hence I chose username):
-8<-
CREATE TABLE USERS
(
ID INTEGER NOT NULL constraint users_pk primary key,
USERNAME VARCHAR(32) NOT NULL,
PWD VARCHAR(32) NOT NULL
);

CREATE TABLE ROLES
(
ID INTEGER NOT NULL constraint roles_pk primary key,
ROLE VARCHAR(32) NOT NULL
);

CREATE TABLE USER_ROLES
(
ID INTEGER NOT NULL constraint userroles_pk primary key,
USER_ID INTEGER constraint userid_fk references USERS(ID),
ROLE_ID INTEGER constraint roleid_fk references ROLES(ID)
);

insert into USERS values ( 100, 'admin', 'password' );
insert into ROLES values ( 100, 'content-administrator' );
insert into USER_ROLES values ( 100, 100, 100 );

select r.role from roles r, users u, user_roles ur where u.id=ur.user_id and r.id=ur.role_id and u.username='admin';
ROLE
--------------------------------
content-administrator
-8<-

Acessing a protected resource from the test web application
http://admin:password@localhost:8080/test/dump/auth/admin/foo
still fails. When switching to a HashUserRealm in jetty.xml it works.

Unfortunately I do not have access to a MySQL database right now but I'm sure that code using "setInt/getInt" would run nicely there as well. Of course someone will have to test it.

Best regards,
Matthias

Hello, Matthias. Sorry, the code still contains setObject because the modified JDBCUserRealm is merely in my sandbox. Jan, I don't have commit rights to the jetty repo, so I committed the file in my sandbox.

Fix from Armi applied. svn rev 1607.