OWASP - User contributions [en]

ESAPI Getting Started Guide

2008-10-26T10:03:15Z

Pawan singh: /* Step 4: Hello, ESAPI! */

ESAPI is very easy to use. This tutorial shows how to get a simple application working with the reference implementation of ESAPI. Please remember that the reference implementation is a simple example. The Authenticator uses a text-based password file. This is to make it easy to test ESAPI without installing a database or directory. Enterprises will want to create their own implementation of the API that works with their identity management solution.

==Step 1: Setting up a resources directory==

Create a directory to hold ESAPI resources. This should be a secure location as it will contain a significant amount of security information. For example, you might create a directory called "C:\resources" (Windows) and use the operating system access control mechanisms (NTFS on Windows) to restrict access.

==Step 2: Setting ESAPI configuration properties==
If it isn't there already, copy the default [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/ESAPI.properties ESAPI.Properties] file into your resources directory. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.

MasterPassword=xxxxx

Also copy the [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/antisamy-esapi.xml antisamy.xml] file into your resources directory, which defines the [[antisamy]] policy that you'll use in ESAPI.

==Step 3: Configuring user accounts==
The simplest way to get started is to create an "admin" account to work with. ESAPI has a command line tool that will create your users.txt file. Type the below, for example (all one line):

java -Dorg.owasp.esapi.resources="c:\resources"
-classpath owasp-esapi-java-1.1.1.jar
org.owasp.esapi.Authenticator yourname yourpass admin

==Step 4: Hello, ESAPI!==
More information about ESAPI functions and its usage is available through the ESAPI's demo application known as ''[http://www.owasp.org/index.php/ESAPI_Swingset THE ESAPI Swingset]''.

ESAPI Getting Started Guide

2008-10-26T09:50:36Z

Pawan singh: /* Step 5: Run */

ESAPI is very easy to use. This tutorial shows how to get a simple application working with the reference implementation of ESAPI. Please remember that the reference implementation is a simple example. The Authenticator uses a text-based password file. This is to make it easy to test ESAPI without installing a database or directory. Enterprises will want to create their own implementation of the API that works with their identity management solution.

==Step 1: Setting up a resources directory==

Create a directory to hold ESAPI resources. This should be a secure location as it will contain a significant amount of security information. For example, you might create a directory called "C:\resources" (Windows) and use the operating system access control mechanisms (NTFS on Windows) to restrict access.

==Step 2: Setting ESAPI configuration properties==
If it isn't there already, copy the default [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/ESAPI.properties ESAPI.Properties] file into your resources directory. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.

MasterPassword=xxxxx

Also copy the [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/antisamy-esapi.xml antisamy.xml] file into your resources directory, which defines the [[antisamy]] policy that you'll use in ESAPI.

==Step 3: Configuring user accounts==
The simplest way to get started is to create an "admin" account to work with. ESAPI has a command line tool that will create your users.txt file. Type the below, for example (all one line):

java -Dorg.owasp.esapi.resources="c:\resources"
-classpath owasp-esapi-java-1.1.1.jar
org.owasp.esapi.Authenticator yourname yourpass admin

==Step 4: Hello, ESAPI!==
You should be able to use any application container. The instructions below are for Tomcat.

# Do a clean Tomcat 5.5/6.0 install (or use an existing container).
# Unzip [[Image:Test.zip]] and put the ''test'' directory in the ''webapps'' folder.
# Run tomcat/bin/startup.bat (or .sh).

* You should enable SSL by uncommenting the SSL Connector in tomcat/conf/server.xml (or /etc/tomcat/server.xml, etc.). Otherwise ESAPI will warn that you're sending a session id over an insecure connection.

ESAPI Swingset

2008-10-24T13:23:50Z

Pawan singh: /* Setup Swingset for Windows */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_03b.zip ESAPI Swingset 03b bundled with Apache Tomcat]]

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]

ESAPI Swingset

2008-10-24T12:48:15Z

Pawan singh: /* Setup Swingset for Windows */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_03b.zip ESAPI Swingset 03b bundled with Apache Tomcat]]

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]

ESAPI Swingset

2008-10-24T12:33:50Z

Pawan singh: /* Download the JDK */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_03b.zip ESAPI Swingset 03b bundled with Apache Tomcat]]

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set your JAVA_HOME environment variable to a JDK version 5 or later. To do this, change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK version 5 or higher. A JRE installation will not work.
#Save the file

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]

ESAPI Swingset

2008-10-24T12:24:51Z

Pawan singh: /* Download/Run */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_03b.zip ESAPI Swingset 03b bundled with Apache Tomcat]]

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JDK==
If it is not already installed, please download a Java JDK version 5 or later. Tomcat, the web server you will be using, requires a JDK, rather than a JRE, due to the use of JSPs in ESAPI Swingset.

The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here].

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set your JAVA_HOME environment variable to a JDK version 5 or later. To do this, change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK version 5 or higher. A JRE installation will not work.
#Save the file

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]