Develop Reference

Java HTTPGET request to (Web SSO) server using the current user's credentials

Description - There is an intranet web application hosted on a WebSSO server. When I manually type in the URL in a browser, the server recognizes me as a valid user and lets me into the website. The authentication is automatically done by using my Windows credentials. I do not have to fill out a login form or anything like that.
Problem - I am trying to make a HTTP GET request to the same URL. The server does not recognize me as a valid user and I get a 401 error.I am trying to do what is described here
My research so far - Looks like my Java session is not the same as my browser session. I looked at my browser's request headers. These headers automatically have a CTSession in the cookie when I manually navigate to the URL(CTSession is unique for every login and is generated dynamically). How do I make the server recognize my Java session as a valid one. What kind of headers do I need in my HTTP GET request? I have already tried the following and it did not work. I get the 401 error
1- con.setRequestProperty("Authorization", new String(Base64.encodeBase64(("username" + ":" + "password").getBytes());
2- Opening a connection to a URL of the below format.
url = "https://fullPath/j_security_check?j_username=username&j_password=pwd

GAE Remote API - Cannot connect

Ok, I'm attempting unsuccessfully to connect to a remote datastore and populate from my local machine using the steps outlined here: https://cloud.google.com/appengine/docs/java/tools/remoteapi#Configuring_Remote_API_on_the_Client
public static void main(String[] args) {
String username = "myemail#gmail.com";
String password = "mygmailpassword";
RemoteApiOptions options = new RemoteApiOptions()
.server("myappname.appspot.com", 443)
.credentials(username, password);
RemoteApiInstaller installer = new RemoteApiInstaller();
installer.install(options);
try {
DatastoreService ds = DatastoreServiceFactory.getDatastoreService();
...
I'm getting a 404 in installer.install(options):
java.io.IOException: can't get appId from remote api; status code = 404
Am I missing something here? I enabled the remote api in my web.xml and deployed to GAE. I am the owner of the project.

Run your service locally (with remote api enabled) and try running same code using 'localhost' and 8888 (port) and check if your code can access locally running service. Your code seems right. There are 2 possibilities -
1. RemoteApi is not enabled correctly.
2. app-name is not spelled correctly.
Other than this, I also use following code to access remote api-
installer.install(options);
try {
// Update the options with reusable credentials so we can skip
// authentication on subsequent calls.
options.reuseCredentials(username, installer.serializeCredentials());
} finally {
installer.uninstall();
}
However, that shouldn't give you the error you're getting.

I realize this is coming a bit late, but I just found this when googling because I had a similar problem, and I solved it for myself. For me the problem was, that my AppEngine app that was serving the remote API, was a python app, and the python docs instruct configuring the remote api endpoint as /remoteapi.*
However my remote api client is a java application, and apparently the remote api call it makes, goes to an endpoit like this: /remote_api. So adding that to the server route configuration (in my case app.yaml) solved the problem. Please note also, that if your remote api serving appengine app is not in the default module, the url should be something like my-module-name-dot-my-project.appspot.com
Also, you should use useApplicationDefaultCredential() instead of credentials(), it is deprecated.

HTTPSURLConnection failed on Java 7 update 51

My Java application runs through Java web start and I'm downloading a file from a web server using browser's session ID. It works fine on previous to Java 7 update 51 but failed on Java 7 update 51. Here is the code. There is no issue on HTTP URL. Problem only occurs with HTTPSURL.
When Java application makes connection with the HTTPS URL, web server not considering URL as a valid URL.
URL webURL = new URL(m_url);
conn = webURL.openConnection();
conn.setRequestProperty("Cookie", cookie);
Cookie has valid session ID. Again this works fine on Prior to Java 7 update 51.
Anything has changed on Java 7 update 51 related to HTTPS URL Connection?
It seems to be Java Web start sends empty HTTPS request before sending actual HTTPS request. Again this happens only after Java 7 update 51.

Root cause for empty HTTPS request is below line of JNLP code.
**<jnlp codebase="https://20.107.21.23:443" spec="1.0+">**
Found solution in two ways.
Changes in web server code
When web server receives empty HTTPS request, do not set cookie for that request.
Change codebase attribute value in JNLP file as below
**<jnlp codebase="https://*20.107.21.23:443" spec="1.0+">**
or
**<jnlp codebase="https://20.107.21.23:443/*" spec="1.0+">**

Image getting 403 forbidden when deployed to server

Background:
I am using Spring web MVC along with JSP and HTML/JavaScript to write a website. I have added a search function, which sends a query to imdbapi.org and receives a JSON object containing movie/tv show information (via AJAX). The JSON object contains a "poster" field for each result, which is a URL to an image (on imdb server). The results are then displayed showing the poster if available, using jQuery..
someDiv.append($("<img src='"+results[i].poster+"'></img'").addClass("resultImg"));
Problem:
This works absolutely fine when running on STS built-in server and accessing locally eg.
http://localhost:8080/myWebPage.whatever
I have a ubuntu server box with Tomcat 7 installed, when deploying to the server I get a 403 error for each image. Example from chrome console:
GET http://ia.media-imdb.com/images/M/MV5BMTY2NDY4NDA0OV5BMl5BanBnXkFtZTcwNTI4MzUyMQ##._V1._SY317_CR5,0,214,317_.jpg 403 (Forbidden)
More Info:
Have tested in chrome and firefox with same results.
If I cannot fix then one solution would be to download to a temp folder on the server I think...
Is this a configuration problem on my box with the tomcat server?

Is this a configuration problem on my box with the tomcat server?
No, Not at all, Your server configuration has nothing to do with the external resource accessibility,If you are getting #._V1._SY317_CR5,0,214,317_.jpg 403 (Forbidden) - this clearly mean's that the server is refusing your request.
And it seem's many people's have these kind of problem with IMDB - see this

I have "made it work", it is not a direct solution to the question but a workaround. Using a local proxy on my server I download the image into memory in java and then return to the web page...
Java (server side)
#RequestMapping(value="/pages/proxyImg")
public ResponseEntity<byte[]> proxyImage(String url) {
log.info("Image Proxy server: " + url);
try {
final HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.IMAGE_JPEG);
return new ResponseEntity<byte[]>(IOUtils.toByteArray(new URL(url).openConnection().getInputStream()), headers, HttpStatus.CREATED);
} catch(Exception e) {
e.printStackTrace();
return null;
}
}
Javascript
someDiv.append($("<img src='"+"proxyImg.htm?url="+results[i].poster+"'></img'"));

Java 6 HTTPURLConnection and Project Server NTLM Authentication from RHEL5.5

Currently at a loss for authenticating with a Microsoft Project Server 2007 instance running on IIS with Integrated Windows Authentication enabled from a Java 1.6(u19) client running on linux, RHEL 5.5.
Note: The client works on my Windows workstation.
I initially was trying to implement a JAX-WS call and found that I could not retrieve the WSDL due to authentication errors, specifically a 401.2, followed by a 500. So I simplified it to a Java class that:
Creates an Authenticator and sets it as the default with a user name/password in AD that has permissions to the project server site
Create a java.net.URL object
Create a java.net.HttpURLConnection and invoke getInputStream
It is at this point where a failure occurs.
With HttpURLConnection debugging turned on I can see:
the initial authentication failure (401.2) returned from the server with "negotiate" and "NTLM" included in the response.
the client creating an NTLM token and sending it back to the server
the server returning with a 500 status code
On the Windows server in the logs, I can see that there is no user name included in the log file only for my requestion and only a "-" which I believe means "anonymous".
My thought is that Project Server isn't liking the NTLM token that is being passed and choking. Based on the many postings on this, NTLM (v1 & v2) are suppose to be supported within Java 1.6.
Any help would be greatly appreciated...
UPDATE 6/20/12: narrowed the issue down to a local security policy setting for Network security: Minimum session security for NTLM SSP based (including RPC) servers. The setting that causes the Java client to fail is Require NTLMv2 security. The goes against what is claimed for NTLM support with the 1.6 JDK..
Some references:
Java HTTP Authentication
Blog showing Java Authenticator Impl

A while back when i had this problem, i ended up using a scheme created by somebody else.
http://devsac.blogspot.com/2010/10/supoprt-for-ntlmv2-with-apache.html
Worked for me when i had to get image files from and iis server with ntlm.
Snippet using the code above..
AuthPolicy.registerAuthScheme(AuthPolicy.NTLM, org.xyz.JCIFS_NTLMScheme.class);
HttpClient client = new HttpClient();
client.getState().setCredentials(AuthScope.ANY, new NTCredentials(userName, password, "", strDomain));
GetMethod get = new GetMethod(strImageFile);
get.setDoAuthentication(true);
client.executeMethod(get);