how to create a web page with restricted access ?

[tyris]

hi all,
i've made a full web app with jsp and servlet. this will be used by the users under windows NT/windows 2000 and IE. the jsp "talks" with the servlet, and the servlet makes sql queries to a distant MS sql server 7.

i do have a database of users, only those users can access to the tables i use in my sql queries.

i'd like to make this : only the person that have a login matching with the one in the database will be able to access to my web app. the others will get a message like : "you are not alowed to access to this page" in the browser.

i've been told that there is no way to deal with NT challenge/response (integrated authentication).

so is there an other way to do this ?

Best regards X-),
Elise

 

[manu0]

hi,

there is more than one way to do that, but you can try this one :

1) make a "login" jsp file asking for login and password

2) if the login query match an user in your database you can redirect him to your welcome jsp letting him use your wep-app, I suppose he can then access a menu or links to do some work...

3) if the login query fails redirect him to a bad user jsp letting him do nothing

--> you can also put some java bean object in the session scope in case 2) to allow your servlets check if the current user trying to view a page by sending a request has a good login...

best regards

manu0

 

[tyris]

well that's a good possibility, but we don't want to use this one.


if i want a real end user application, where the user don't have to enter the login + password (because our users are non computer scientists and need some quick and easy way to access to the web page). what can i do to identify them with the NT start up logon only ? Best regards X-),
Elise

 

[manu0]

well, this is much harder...

with JSP only I think it is not possible

but if you know a little of visual basic and activeX perhaps you can embed an activeX object in your jsp page.

then when a user submit some action you can make a validation call to a javascript method that call the activeX object that access Windows NT API to retrive the NT logon information...

huh... I

 

[tyris]

heheh weel that's an idea.. i will think about this way (well in fact i do not have other ways to do ;o) )

thanks ! Best regards X-),
Elise