[Billy_bon]

Using authentication to control access to Flex applications

To use authentication to prevent unauthorized access to your Flex application, you typically use the container to set up constraints on resources. You then challenge the user who then submits credentials. These credentials determine the success or failure of the user's login attempt, as the container's authentication logic determines.

For example, you can protect the page that the Flex application is returned with, or protect the SWF file itself. You do this in the web.xml file by defining specific URL patterns, as the following example shows:

<web-app>
    <security-constraint> 
        <web-resource-collection> 
            <web-resource-name>Payroll Application</web-resource-name> 
                <url-pattern>/payroll/*</url-pattern> 
                <http-method>GET</http-method> 
                <http-method>POST</http-method> 
            </web-resource-collection> 
        <auth-constraint> 
            <role-name>manager</role-name> 
        </auth-constraint> 
    </security-constraint> 
</web-app>

When the browser tries to load a resource that is secured by constraints in the web.xml file, the browser either challenges the user (if you are using BASIC authentication) or forwards the user to a login page (with FORM authentication).

With BASIC authentication, the user enters a username and password in a popup box that the browser creates. To specify that an application uses BASIC authentication, you use the login-config element and its auth-method subelement in the web application's web.xml file, as the following example shows:

<web-app>
    <login-config> 
        <auth-method>BASIC</auth-method> 
        <realm-name>Managers</realm-name> 
    </login-config> 
    ...
</web-app>

With FORM authentication, you must code the page that accepts the username and password, and submit them as FORM variables named j_username and j_password. This form can be implemented in HTML or as a Flex application or anything that can submit a form.

When you configure FORM authentication, you can specify both a login form and an error form in the web.xml file, as the following example shows:

<web-app>
    <login-config> 
        <auth-method>FORM</auth-method> 
        <form-login-config> 
            <form-login-page>/login.htm</form-login-page> 
            <form-error-page>/loginerror.htm</form-error-page> 
        </form-login-config>
    </login-config> 
</web-app>

You submit the results of the form validation to the j_security_check action. The server executing the application recognizes this action and processes the form.

A simple HTML-based form might appears as follows:

<form method="POST" action="j_security_check"> 
    <table> 
        <tr><td>User</td><td><input type=text name="j_username"></tr> 
        <tr><td>Password</td><td><input type=password name="j_password"></tr> 
    </table> 
    <input type=submit> 
</form>

The results are submitted to the container's JAAS system with base-64 encoding, which means they can be read by anyone that can view the TCP/IP traffic. Use encryption to prevent these so-called "man-in-the-middle" attacks. In both BASIC and FORM authentication, if the user accessed the resource through SSL, the username and password submission are encrypted, as is all traffic during that exchange.

After it is complete, the container populates the browser's security context and provides or denies access to the resource. Flash Player inherits the security context of the underlying browser. As a result, when you make a data service call, the established credentials are used.

When a user fails an authentication attempt with invalid credentials, be sure not to return information about which item was incorrect. Instead, use a generic message such as "Your login information was invalid."

For application-server specific information about using custom authentication with LiveCycle Data Services, you can use the examples in flex_install_dir/resources/security.

Я написал свою логин-форму на флексе, но она не работает, если же использовать код, который написан в примере(написать например с логин форму с помощью html или jsp), все работает прекрасно. j_security_check - это стандартный экшин в томкате.