ESAPI Getting Started Guide - Revision history

Pawan singh: /* Step 4: Hello, ESAPI! */

2008-10-26T10:03:15Z

‎Step 4: Hello, ESAPI!

Pawan singh: /* Step 5: Run */

2008-10-26T09:50:36Z

‎Step 5: Run

Kevin.Fealey: /* Step 2: Setting ESAPI configuration properties */

2008-10-23T15:15:40Z

‎Step 2: Setting ESAPI configuration properties

Jeff Williams: /* Step 5: Run */

2008-08-18T02:35:51Z

‎Step 5: Run

Jeff Williams: /* Step 2: Setting ESAPI configuration properties */

2008-08-18T02:35:16Z

‎Step 2: Setting ESAPI configuration properties

Jeff Williams: /* Step 1: Setting up a resources directory */

2008-08-18T02:33:51Z

‎Step 1: Setting up a resources directory

Mchalmers at 03:12, 10 August 2008

2008-08-10T03:12:30Z

Mchalmers at 20:16, 8 August 2008

2008-08-08T20:16:13Z

Jeff Williams at 14:25, 19 April 2008

2008-04-19T14:25:35Z

Jeff Williams: /* Step 4: Hello, ESAPI! */

2008-04-19T14:22:42Z

‎Step 4: Hello, ESAPI!

← Older revision		Revision as of 10:03, 26 October 2008
Line 20:		Line 20:

	==Step 4: Hello, ESAPI!==		==Step 4: Hello, ESAPI!==
−	~~You should be able to use any application container. The instructions below are for Tomcat.~~	+	More information about ESAPI functions and its usage is available through the ESAPI's demo application known as ''[http://www.owasp.org/index.php/ESAPI_Swingset THE ESAPI Swingset]''.
−
−	~~# Do a clean Tomcat 5.5/6.0 install (or use an existing container).~~
−	~~# Unzip [[Image:Test.zip]]~~ and ~~put~~ the ''~~test~~'~~' directory in the ''webapps'' folder.~~
−	~~# Run tomcat~~/~~bin~~/~~startup.bat (or~~ .~~sh)~~.
−
−	* You should enable SSL by uncommenting the SSL Connector in tomcat/~~conf/server~~.~~xml (or /etc/tomcat~~/~~server.xml, etc.). Otherwise~~ ESAPI ~~will warn that you~~'~~re sending a session id over an insecure connection~~.

← Older revision		Revision as of 09:50, 26 October 2008
Line 27:		Line 27:

	* You should enable SSL by uncommenting the SSL Connector in tomcat/conf/server.xml (or /etc/tomcat/server.xml, etc.). Otherwise ESAPI will warn that you're sending a session id over an insecure connection.		* You should enable SSL by uncommenting the SSL Connector in tomcat/conf/server.xml (or /etc/tomcat/server.xml, etc.). Otherwise ESAPI will warn that you're sending a session id over an insecure connection.
−
−	~~==Step 5: Run==~~
−	~~Just browse to https://localhost:8443/test/test.jsp (or http://localhost:8080/test/test.jsp) and log in with the credentials you set up.~~
−
−	This JSP performs a lot of "global" checks including authentication, validation, and anti-CSRF. Typically you will want to leave these steps to a framework or a filter (see the [[ESAPI Filter]]). This JSP is just to demonstrate some of the features of ESAPI.
−
−	~~[[Category:OWASP Enterprise Security API]]~~

@@ Line 6: / Line 6: @@
 ==Step 2: Setting ESAPI configuration properties==
-Unzip the default [[Image:ESAPI.properties.zip]] file into your resources directory. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.
+If it isn't there already, copy the default [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/ESAPI.properties ESAPI.Properties] file into your resources directory. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.
   MasterPassword=xxxxx
-Also unzip the [[Image:antisamy-esapi.zip]] file into your resources directory, which defines the [[antisamy]] policy that you'll use in ESAPI.
+Also copy the [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/antisamy-esapi.xml antisamy.xml] file into your resources directory, which defines the [[antisamy]] policy that you'll use in ESAPI.
 ==Step 3: Configuring user accounts==

@@ Line 29: / Line 29: @@
 ==Step 5: Run==
-Just browse to https://localhost:8443/test/test.jsp (or http://localhost:8180/test/test.jsp) and log in with the credentials you set up.
+Just browse to https://localhost:8443/test/test.jsp (or http://localhost:8080/test/test.jsp) and log in with the credentials you set up.
 This JSP performs a lot of "global" checks including authentication, validation, and anti-CSRF. Typically you will want to leave these steps to a framework or a filter (see the [[ESAPI Filter]]). This JSP is just to demonstrate some of the features of ESAPI.
 [[Category:OWASP Enterprise Security API]]

@@ Line 6: / Line 6: @@
 ==Step 2: Setting ESAPI configuration properties==
-Unzip the default [[Image:ESAPI.properties.zip]] file. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.
+Unzip the default [[Image:ESAPI.properties.zip]] file into your resources directory. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.
   MasterPassword=xxxxx
 ==Step 3: Configuring user accounts==

← Older revision		Revision as of 02:33, 18 August 2008
Line 2:		Line 2:

	==Step 1: Setting up a resources directory==		==Step 1: Setting up a resources directory==
		+
	Create a directory to hold ESAPI resources. This should be a secure location as it will contain a significant amount of security information. For example, you might create a directory called "C:\resources" (Windows) and use the operating system access control mechanisms (NTFS on Windows) to restrict access.		Create a directory to hold ESAPI resources. This should be a secure location as it will contain a significant amount of security information. For example, you might create a directory called "C:\resources" (Windows) and use the operating system access control mechanisms (NTFS on Windows) to restrict access.

@@ Line 10: / Line 10: @@
 ==Step 3: Configuring user accounts==
-The simplest way to get started is to create an "admin" account to work with. ESAPI has a command line tool that will create your users.txt file, for example:
+The simplest way to get started is to create an "admin" account to work with. ESAPI has a command line tool that will create your users.txt file. Type the below, for example (all one line):
-  java -Dorg.owasp.esapi.resources="c:\resources" \
+  java -Dorg.owasp.esapi.resources="c:\resources"
-  -classpath owasp-esapi-java-1.1.1.jar \
+  -classpath owasp-esapi-java-1.1.1.jar
-  org.owasp.esapi.Authenticator Yourname yourpass admin
+  org.owasp.esapi.Authenticator yourname yourpass admin
 ==Step 4: Hello, ESAPI!==

@@ Line 1: / Line 1: @@
-==Getting Started with OWASP ESAPI==
+ESAPI is very easy to use. This tutorial shows how to get a simple application working with the reference implementation of ESAPI. Please remember that the reference implementation is a simple example. The Authenticator uses a text-based password file. This is to make it easy to test ESAPI without installing a database or directory. Enterprises will want to create their own implementation of the API that works with their identity management solution.
 ==Step 1: Setting up a resources directory==
+Create a directory to hold ESAPI resources. This should be a secure location as it will contain a significant amount of security information. For example, you might create a directory called "C:\resources" (Windows) and use the operating system access control mechanisms (NTFS on Windows) to restrict access.
 ==Step 2: Setting ESAPI configuration properties==
-Download the default ESAPI.properties file. Edit the MasterPassword property and choose a long, difficult-to-guess string as the security of your application depends on it.
+ MasterPassword=xxxxx
 ==Step 3: Configuring user accounts==
-The simplest way to get started is to create an "admin" account to work with. ESAPI has a command line tool that will create your users.txt file and
+ java -Dorg.owasp.esapi.resources="c:\resources" \
+ -classpath owasp-esapi-java-1.1.1.jar \
-  java -Dorg.owasp.esapi.resources="C:\resources"
+ org.owasp.esapi.Authenticator Yourname yourpass admin
 ==Step 4: Hello, ESAPI!==
 You should be able to use any application container. The instructions below are for Tomcat.
-* Do a clean Tomcat 5.5/6.0 install (or use an existing container)
+# Do a clean Tomcat 5.5/6.0 install (or use an existing container).
-* Unzip [[Image:Test.zip]] and put the "test" directory in the webapps folder
+# Unzip [[Image:Test.zip]] and put the ''test'' directory in the ''webapps'' folder.
-* Run Tomcat/bin/startup.bat (or .sh)
+# Run tomcat/bin/startup.bat (or .sh).
-* You should enable SSL by uncommenting the SSL connector in Tomcat/conf/server.xml. Otherwise ESAPI will warn that you're sending a session id over an insecure connection.
+* You should enable SSL by uncommenting the SSL Connector in tomcat/conf/server.xml (or /etc/tomcat/server.xml, etc.). Otherwise ESAPI will warn that you're sending a session id over an insecure connection.
 ==Step 5: Run==
-Just browse to https://localhost:8443/test/test.jsp and login with the credentials you have chosen.
+This JSP performs a lot of "global" checks including authentication, validation, and anti-CSRF. Typically you will want to leave these steps to a framework or a filter (see the [[ESAPI Filter]]). This JSP is just to demonstrate some of the features of ESAPI.
 [[Category:OWASP Enterprise Security API]]