<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app 
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" 
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<!-- Deployment Descriptor example by Sandeep Desai http://www.thedesai.net/sandeep -->
<!-- if you used only <web-app> conatiner runs in Servlet 2.3 mode and EL won't work -->
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" 
         version="2.4">
<!-- 

* 0..n ? 0..1 + 1..n

web-app 
  icon ? 
  display-name ?
  description  ?
  distributable ?
  context-param *
      param-name  
      param-value
      description ?
  servlet  *
    icon ?
    servlet-name | jsp-file
    description
    servlet-class (if servlet-name)
    load-on-startup ? (number)
    init-param *
      param-name  
      param-value
      description ?
    security-role-ref
      role-name
      role-link
  servlet-mapping *
    servlet-name
    url-pattern (wildcard, exact match, directory, extension) (start with /)
  listener (0..n) (order of loading DD order, unload on DD order, session preceds ServletContext)
    listener-class
  session-config ? 
    session-timeout (in minutes, 0 or less never expire )
  jsp-config ?
    jsp-property-group
      url-pattern (wildcard OK)
      scripting-invalid (boolean)
      el-ignored (boolean)
      include-prelude ? 
      include-coda ?
    taglib *
      taglib-uri
      taglib-location
  error-page * (servlet & JSP) works for sendError() not sendStatus()
    exception-type | error-code 
    location (/errorPage.jsp)
  welcome-file-list ? (handle partial request URI)
    welcome-file + (a.html)
  ejb-local-ref *
    ejb-ref-name (ejb/foo) (JNDI)
    ejb-ref-type (ENTITY)
    local-home
    local
  ejb-ref *
    ejb-ref-name
    ejb-ref-type
    home
    remote
  env-entry *
    env-entry-name
    env-entry-type (class with String constructor)
    env-entry-value
  resource-ref * (JNDI)
  resource-env-ref * (JNDI)
  mime-mapping *
    extension (mpg)
    mime-type  (mpeg/video)
  filter *
    filter-name
    filter-class
    dispatcher * (REQUEST (default), INCLUDE, FORWARD, ERROR)
  filter-mapping *
    icon ?
    filter-name
    url-pattern | servlet-name (url-pattern first, then servlet-name)
    init-param *
  security-constraint * (not applicable for jsp:include or jsp:forward)
    display-name ?
    web-resource-collection +
      web-resource-name
      description
      url-pattern (1..n) (default union, empty overrides all)
      http-method (POST, GET etc  default all)
    auth-constraint ? (no all, empty none)
      role-name * (* means access to all)
    user-data-transport ?
      description?
      user-data-constraint (NONE (default), INTEGRAL, CONFIDENTIAL)
  login-config ?
    auth-method ? (BASIC, DIGEST, CLIENT-CERT, FORM)
    realm-name ? (only for BASIC)
    form-login-config ? (only for FORM)
      form-login-page (j_username, j_password, j_security_check)
      form-error-page
  security-role *
    role-name (1..n)


Servlet Mapping in webapps/myapp
  <servlet>
     <servlet-name>MyServlet</servlet-name>
     <servet-class>foo.MyServlet</servlet-class>
  </servlet>
  <servlet-mapping>
     <servlet-name>MyServlet</servlet-name>
     <url-pattern>/fooapp/select.do<url-pattern>  
  </servlet-mapping>

User type http://localhost:8080/myapp/fooapp/select.do to access servlet

URL pattern can be exact match or wildcard, note no slash for 
extension wildcard match
<url-pattern>/fooApp/select.do<url-pattern>  
<url-pattern>/fooApp <url-pattern>  
<url-pattern>/fooApp/* </url-pattern>
<url-pattern>*.do</url-pattern>

Container does exact match first, then directory match and then extension match
http://localhost:8080/myApp/fooApp/ will match fooApp/*
http://localhost:8080/myApp/fooApp will match fooApp

-->

  <display-name>Sandeep's Web App</display-name>
  <description>
    Contact s_desai@hotmail.com for information on this 
    servlet and JSP app
  </description>

  <!--  
    param scope is entire app
    String value = getServletContext().getInitParameter("webmaster");
  -->

  <context-param>
    <param-name>webmaster</param-name>
    <param-value>s_desai@hotmail.com</param-value>
    <description>
      webmaster's email for questions
    </description>
  </context-param>


  <!-- 
    Servlet initialization parameters can be retrieved in a
     servlet or JSP page by calling:
    String value = getServletConfig().getInitParameter("servletParam1");
    You can define any number of servlets, including zero.
  -->

  <servlet>
    <servlet-name>controller</servlet-name>
    <description>servlet is controller in MVC</description>
    <servlet-class> MyServlet </servlet-class>
    <!-- optional load-on-startup 
         for value greater than 0 load servlet when container startsup 
         the number indicates to container which servlet to load first
         -->
    <load-on-startup>1</load-on-startup> 
    <init-param>
      <param-name>servletParam1</param-name>
      <param-value>value1</param-value>
    </init-param>
    <init-param>
      <param-name>servletParam2</param-name>
      <param-value>value2</param-value>
    </init-param>
    <!-- Load this servlet at server startup time -->
    <load-on-startup>5</load-on-startup>
    
    <!-- map roles used in servlet code to container defined roles
         container looks here first and then at container roles
         if (request.isUserInRole("dba")) {}
         request.getRemoteUser() can be used to check authenticatin
         request.getUserPrincipal() used with EJBs
    -->
    <security-role-ref>
      <role-name>dba</role-name>
      <role-link>admin</role-link>
    </security-role-ref>
  </servlet>
  
  <!-- JSP Servlet parameters --> 
  <servlet>
    <servlet-name>MyJSP</servlet-name>
    <jsp-file>/my.jsp</jsp-file>
    <init-param>
      <param-name>servletparam</param-name>
      <param-value>learnjsp</param-value>
    </init-param>
  </servlet>
  
 
  <!-- list one listener tag per listener class --> 
  <listener>
    <listener-class> MyServlet </listener-class>
  </listener>

 <listener>
    <listener-class> MySessionAttribute </listener-class>
  </listener>

  <!-- 
      Define mappings that are used by the servlet container to
       translate a particular request URI (context-relative) to a
       particular servlet.  The examples below correspond to the
       servlet descriptions above.  Thus, a request URI like:
       
         http://localhost:8080/{contextpath}/myservlet.do
         http://localhost:8080/myservlet/myservlet.do

       will be mapped to the "controller" servlet.

       You may define any number of servlet mappings, including zero.
       It is also legal to define more than one mapping for the same
       servlet, 
  -->

  <servlet-mapping>
    <servlet-name>controller</servlet-name>
    <url-pattern>/myservlet.do</url-pattern>
  </servlet-mapping>
  
  <servlet-mapping>
    <servlet-name>MyJSP</servlet-name>
    <url-pattern>/my.jsp</url-pattern>
  </servlet-mapping>


  <!-- Define the default session timeout for your application,
       in minutes.  From a servlet or JSP page, you can modify
       the timeout for a particular session dynamically by using
       HttpSession.setMaxInactiveInterval(int seconds). -->

  <session-config>
    <session-timeout>30</session-timeout>    <!-- 30 minutes -->
  </session-config>
  
  <!-- can do this using <%@ page isELIgnored=true  -->
  <!-- these are the defaults -->
  <jsp-config>
    <jsp-property-group>
       <url-pattern>*.jsp</url-pattern> can use wildcards *.jsp 
       <scripting-invalid>false</scripting-invalid>
       <el-ignored>false</el-ignored>
       <!-- insert header, footer on all pages matching url-pattern -->
       <!-- <include-prelude>/header.html<include-prelude>  -->
       <!-- <include-coda>/footer.html<include-coda>  -->
    </jsp-property-group>
    <!-- old style
     <taglib>
      <taglib-uri>http://www.thedesai.net/tags</taglib-uri>
      <taglib-location>/foo.tld</taglib-location>
    </taglib>
    -->
  </jsp-config>

  <!-- getServletContext().getInitParameter("appParam1") -->
  <context-param>
    <param-name>appParam</param-name>
    <param-value>foobar</param-value>
  </context-param>

  <!-- can say java.lang.Throwable or specific exception 
       errorpages get ${pageContext.exception}
       applies to servlets and JSP
       exception type will look at wrapped exception for ServletException
         or subclass of ServletException
       servlet doXXX can only throw exception wrapped in 
          ServletException, IOException (or subclass)
       or some RuntimeException
   -->
  <error-page>
    <exception-type>java.lang.ArithmeticException</exception-type>
    <location>/errorPage.jsp</location>
  </error-page>
  
  <!-- app can set error/status code by calling 
       request.sendError(404) ;
       request.sendError(HttpServletResponse.SC_NOT_FOUND) -->
  <error-page>
    <error-code>404</error-code>
    <location>/errorPage.jsp</location>
  </error-page>
  
  <!-- File to display when user enters http://localhost:8080/myservlet 
       If user types a URL that ends in directory container will look for the
       first matching file
  -->
  <welcome-file-list>
    <welcome-file>myform.html</welcome-file>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>
  
  <!-- EJB referencing 
       optional elements ejb-link and description
  -->
  <ejb-local-ref>
    <ejb-ref-name>ejb/Customer</ejb-ref-name> <!-- JNDI lookup name -->
    <ejb-ref-type>Entity</ejb-ref-type>
    <local-home>foo.CustomerHome</local-home>
    <local>foo.Customer</local>
  </ejb-local-ref>

  <!-- Note that remote tag is not ejb-remote-ref -->
  <ejb-ref>
    <ejb-ref-name>ejb/Customer</ejb-ref-name> <!-- JNDI lookup name -->
    <ejb-ref-type>Entity</ejb-ref-type>
    <home>foo.CustomerHome</home>
    <remote>foo.Customer</remote>
  </ejb-ref>
  
  <!-- type has to be class that has a constructor that takes a String 
       cannot be primitive data type
       value passed as String or Character if env-entry-type is Character
   -->
  <env-entry>
    <env-entry-name>/foo/bar</env-entry-name>
    <env-entry-type>java.lang.Integer</env-entry-type>
    <env-entry-value>1</env-entry-value>
  </env-entry>
  
  <!-- <resource-ref> and <resource-env-ref> also allows access to JNDI -->
  
  <!-- Note no . in extension -->
  <mime-mapping>
    <extension>mpg</extension>
    <mime-type>video/mepg</mime-type>
  </mime-mapping>
  
  <!-- filter 
       when multiple url pattern match, 
       first all url-patterns
       then servlet
       order based on DD declaration
  -->
  <filter>
    <filter-name>FooRequestFilter</filter-name>
    <filter-class>MyFilter</filter-class>
    <!-- optional dispatcher can list 0 to 4
      <dispatacher>REQUEST</dispatcher> - default 
      <dispatacher>INCLUDE</dispatcher> - call for include()
      <dispatacher>FORWARD</dispatcher> - call for forward()
      <dispatacher>ERROR</dispatcher>
    -->
    <init-param> <!-- optional -->
      <param-name>filterParam1</param-name>
      <param-value>foobar</param-value>
    </init-param>
  </filter>
  
  <filter-mapping>
    <filter-name>FooRequestFilter</filter-name>
    <url-pattern>*.do</url-pattern> <!-- required url-pattern or servlet-name -->
  </filter-mapping>
  
  <filter-mapping>
    <filter-name>FooRequestFilter</filter-name>
    <servlet-name>controller</servlet-name>
  </filter-mapping>
  <!-- end filter -->
  
  <!-- declarative security 
       servlet also supports programmatic security
  -->
  <security-constraint>
    <web-resource-collection>
      <url-pattern>/restricted.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>tomcat</role-name>
    </auth-constraint>
  </security-constraint>
  
  
  <security-constraint>
    <!-- one or more web-resource-collection -->
    <web-resource-collection>
      <!-- required, used by tools -->
      <web-resource-name>FooConstraints</web-resource-name>
      <description>Some Foo desc</description> <!-- optional -->
      <!-- 1 or more url-pattern -->
      <url-pattern>/secret/*</url-pattern>
      <url-pattern>/private/*</url-pattern>
      <!-- restricted for methods listed here 
           if no method listed, restricted for all methods   
           GET, POST, PUT, TRACE, DELETE, HEAD, OPTIONS
           if servlet implements a method and method not listed here it is allowed
           -->
      <http-method>POST</http-method>
      <http-method>GET</http-method>
    </web-resource-collection>
    <!-- if no auth-constraint all users have access 
         <auth-constraint/> means nobody can access useful when access should
           only be done by programatic servlet/JSP forward
    -->
    <auth-constraint>
      <!-- if no roles then no user can access url 
           <role-name>*</role-name> all users allowed
           role names are case sensitive
      -->
      <role-name>tomcat</role-name>
      <role-name>admin</role-name>
    </auth-constraint>
    
    
    <!-- transport-guarantee values are 
         NONE (default)
         INTEGRAL, CONFIDENTIAL (container will typicall use https)
         when user requests constrained resource using http container will send 
         status code 301 asking client to send using https
         then login takes place normally
         setting up https requres public key cerificate from Verisign
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-gaurantee>
    </user-data-constraint>
    -->
  </security-constraint>
  <!-- rules for combining auth-constraint for two security-constratint with 
       same URL pattern
       by default union 
       if <auth-constraint/> then nobody can access  
       e.g admin and * implies all roles
       e.g <auth-constraint/> and * implies no roles
  -->
  
  <!-- 
  causes authentication 
  realm, means ability for different webapps on same container to work with different
     user/password login
  methods are
    BASIC: passes encrypted userid/password using base64, (weak security)
    DIGEST: more secure may not be supported by container 
            (www.ietf.org/rfc/rfc2617.txt)  
    CLIENT-CERT: transmit using Public Key Certificate (PKC) 
            browser needs to have certificate mainly used in B2B
    FORM: allows you to create custom login, users/password sent unencrypted    
          should be used with https (use only if cookie or SSL session 
          tacking in place)
    can have vendor specific authentication scheme      
    -->
  <!-- <login-config>
    <auth-method>BASIC</auth-method>
  </login-config> -->

   <!--  Form should use names and action below so that they are recognized by the container
    <form method="POST" action="j_security_check">
    <input type="text" name="j_username"> 
    <input type="text" name="j_password"> 
    <input type="submit" value="Enter">
  </form> -->

  <login-config>
    <auth-method>FORM</auth-method>
    <!-- realm-method ? -->
    <form-login-config>
      <form-login-page>/login.html</form-login-page>
      <form-error-page>/loginError.html</form-error-page>
    </form-login-config>
  </login-config>

  <!-- see <security-role-ref> in <servlet> -->
  <security-role>
    <role-name>admin</role-name>
    <role-name>tomcat</role-name>
  </security-role>
  
  
</web-app>
