JDBC Realm in Glassfish

Following the Java EE 6 Tutorial I discovered how to secure the Application Server.
In particular I need an authentication mechanism for identify the users and give access to specific resources. In my project there are 3 kinds of users: customers, instructors and the agency (or the admin/superuser in this case). This means that we have 3 different roles with different privileges. The declaration of a role is defined in the web.xml file, in the following way:

<security-role>
   <description>User role</description>
   <role-name>USER</role-name>
</security-role>

The mapping between users and roles is specified in the sun-web.xml file, as following:

<security-role-mapping>
   <role-name>USER</role-name>
   <group-name>customer</group-name>
</security-role-mapping>

For my requirements the better solution is to configure a realm, which is a complete database of users and groups that identify valid users of a web application and are controlled by the same authentication
policy. Configuring a JDBC Realm on Glassfish is pretty simple. I followed this link, which is a bit old, but is suitable for our purposes. In the administration console of Glassfish we have to go on Configurations, Security and Realms, then we can add a new Realm.

These are the values of my SnowInstructionsRealm:

Realm Name: SnowInstructionsRealm
Class Name: com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm

JAAS Context: jdbcRealm
JNDI: jdbc/snowinstructions
User Table: user
User Name Column: email
Password Column: password
Group Table: user
Group Name Column: groupid
Digest Algorithm: none

It's important to note that the credentials of users and the corresponding role are saved inside the same table (user). Also each user can be mapped only to one group (which are agency, instructor, customer), which is the better choice in this case. Moreover the password are stored in clear inside the database (Digest Algorithm is set to none) in order to simplify the project in the initial phases. Maybe before the final deliver I will add the MD5 support. If you don't insert any value this option will be the default one.

Glassfish + MySQL JDBC Connection Pool

I used MySQL Workbench 5.2 (http://wb.mysql.com/) in order to create the Database. Next step was to use the Glassfish Administration console to configure a JDBC Connection Pool and JDBC Resources. I followed the tutorial visible at this page http://www.albeesonline.com/blog/2008/08/06/creating-and-configuring-a-mysql-datasource-in-glassfish-application-server/.

These are my values:

JDBC Connection Pool
Pool Name: SIPool
Resource Type: javax.sql.DataSource
Database Vendor: MySQL

Additional Properties
portNumber: 3306
databaseName: sidatabase
serverName: localhost
user: root
password: root
URL: jdbc:mysql://localhost:3306/sidatabase
url: jdbc:mysql://localhost:3306/sidatabase

By clicking on the Ping button I received the Ping Succeeded Message meaning that my connection was correctly configured.

Then I created a JDBC Resource using the JNDI Name jdbc/snowinstructions referring to the Connection Pool created before (SIPool).

Note that we need to have the mysql-connector-java-bin.jar (http://www.mysql.com/downloads/connector/j/) library inside the glassfish/lib folder in order to get everything right.

Database Structure

This is the structrure of the Database. It's possible to see the tables and the relations between them.

IDE and Application Server choice

For the project I decided to use the Eclipse IDE with Glassfish 3.1 and MySQL as RDBMS. The main reason for this choice is because I used them on the Service Oriented Architecture course and so they were already configured on my machine. I always had problems with Java EE application servers on my laptop (which is 64 bit) due to various bugs and other crap, so I decided to keep this configuration which is pretty stable at the moment. Let's hope it lasts!

Business Flow

In order to point out the relations between the mockup pages and also to understand the functionality of each page, I prepared a business diagram which demonstrates the process flow of the application. It displays the visual and functional components on each page and highlights the primary actions available for the user in order to complete the purchase process.

I also created the application logo using Photoshop. It's the nice and simple writing on the index page!

Use Case Diagram

Here it is! A basic Use Case diagram which lists the main actors (Agency, Instructor, Customer) and their associated actions. I'm not sure if this Use Case will be the definitive one. We'll see!

Use Case and Mockups

In order to gain a clearer picture of the overall website on how it has to look and behave, I wrote a simple Use-Case that describes how the application will be used by a customer:

The Customer wants to book the instructors for him and his family during their winter holyday. For this reason he searches the website of the local skiing agency in order to find an email address or a telephone number. Surprisingly he finds that it’s possible to book directly online the instructors, for his preferred period of the winter season. Thus from the welcome page he decides to register on the website and to take advantage of the service. He has to provide some of his personal data, included his bank account number (or his credit card number). After the registration process he is able to book the hours, choosing the date, the preferred time, the discipline, the number of people and the preferred instructor. This reservation is added to his shopping cart. The customer decides to add another extra hour only for himself so it repeats the previous process adding the reservation to his shopping cart. The subtotal is obviously updated. He finally decides to proceed to checkout. In the checkout page, customer views the total cost and the summary of his order. If he agrees to the skiing agency policy then the order is processed and the customer is taken to a confirmation page which provides some additional information on his order.

I also started to create mockups for static pages of the website, accessible directly from the address bar of the browser and without the login process. For those who ignore what a mockup is, here a useful link http://usabilita.blogosfere.it/2008/12/e-fatti-un-mockup-del-sito.html.