The listing shown below is a complete deployment descriptor for a DbForms application. If the web application has additional servlets in addition to the servlets that comprise DbForms, they would be added to the descriptor in the normal manner.

The order of elements in web.xml is important so be sure to follow the DTD/Schema. For convenience, the top level of the root element web-app is shown below.

    
  <!ELEMENT 
      web-app (icon?, display-name?, description?, distributable?,
      context-param*, filter*, filter-mapping*, listener*, 
      servlet*, servlet-mapping*, session-config?, mime-mapping*, 
      welcome-file-list?, error-page*, taglib*, 
      resource-env-ref*, resource-ref*, security-constraint*,
      login-config?, security-role*, env-entry*, ejb-ref*,  
      ejb-local-ref*)>
          

Add the following servlet, servlet-mapping, taglib, and context-param (optional) elements to the web-app element in the /WEB-INF/web.xml file.

The sample listing below has portions keyed to remarks that follow.

  <?xml version="1.0" encoding="ISO-8859-1"?>

  <!DOCTYPE web-app
      PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
      "http://java.sun.com/dtd/web-app_2_3.dtd">

  <web-app>

    <!--============= DBFORMS STYLING TEMPLATES =============-->
    <context-param> 
      <param-name>templateBase</param-name> 
      <param-value>templates</param-value> 
    </context-param>

    <!--=========== DbForms Configuration Servlet ===========--> 
    <servlet> 
      <servlet-name>config</servlet-name> 
      <servlet-class>org.dbforms.servlets.ConfigServlet</servlet-class> 

      <init-param> 
        <param-name>log4j.configuration</param-name> 
        <param-value>/WEB-INF/log4j.properties</param-value> 
      </init-param>

      <init-param> 
        <param-name>digesterDebugLevel</param-name> 
        <param-value>0</param-value> 
      </init-param> 

      <init-param> 
        <param-name>resourceBundle</param-name> 
        <param-value>ApplicationResources</param-value> 
      </init-param> 

      <init-param> 
        <param-name>validation</param-name> 
        <param-value>/WEB-INF/validation.xml</param-value> 
      </init-param> 

      <!--More than one validation file is possible-->
      <!--init-param>
        <param-name>validation</param-name>
        <param-value>/WEB-INF/validation.xml</param-value>
      </init-param-->
      
      <init-param> 
        <param-name>validator-rules</param-name> 
        <param-value>/WEB-INF/validator-rules.xml</param-value> 
      </init-param> 

      <load-on-startup>1</load-on-startup> 
    </servlet> 

    <!--=========== DbForms Controller Servlet ==============-->     
    <servlet> 
      <servlet-name>control</servlet-name> 
      <servlet-class>org.dbforms.servlets.Controller</servlet-class> 

      <init-param> 
        <param-name>maxUploadSize</param-name> 
        <param-value>80000</param-value> 
      </init-param> 
    </servlet> 

    <!--=========== DbForms FileServlet =====================--> 
    <servlet>
      <servlet-name>file</servlet-name> 
      <servlet-class>org.dbforms.servlets.FileServlet</servlet-class>    
      <load-on-startup>2</load-on-startup> 
    </servlet>

    <!--==== Controller Servlet and FileServlet Mappings========-->
    <servlet-mapping> 
      <servlet-name>control</servlet-name> 
      <url-pattern>/servlet/control</url-pattern> 
    </servlet-mapping>  

    <servlet-mapping>
      <servlet-name>file</servlet-name> 
      <url-pattern>/servlet/file</url-pattern> 
    </servlet-mapping>                 

     <!--=========== Session config =====================-->

     <session-config>
       <session-timeout>30</session-timeout>
     </session-config>

     <!--=========== Welcome File List =====================-->

     <welcome-file-list>
       <welcome-file>index.jsp</welcome-file>
     </welcome-file-list>  

     <!--=========== DbForms Tag Library Descriptor ==========--> 

     <taglib>
       <taglib-uri>/WEB-INF/dbforms.tld</taglib-uri>
       <taglib-location>/WEB-INF/dbforms.tld</taglib-location>
     </taglib>

     <!--=========== Application Security Controls ==========--> 

   </web-app>
        

Remarks:

	This is optional. See Section 11.3.4.1, “Template base directory ” for more information.
	The initialization parameter log4j.configuration should point to a valid log4j property file. If this parameter is not defined, the log4j standard configuration will be used for logging. Now that log4j handles all console output, you would think that by setting log4j to display fatal errors only, your console would be virtually empty. Well, no! The current version of DbForms uses the struts digester class to parse xml files at startup. This class sends info to System.out. The initialization parameter digesterDebugLevel setting can be used to specify (to the digester) the amount of detail to display. Values can range from 0 (no debug) to 10 (Show all). Sample log4j.properties file: #begin log4j.props #IMPORTANT - Watch for trailing whitespaces after each statement!!! #log4j.rootCategory=debug, stdout, logFile #log4j.rootCategory=warn, stdout log4j.rootCategory=error, stdout log4j.category.org.dbforms=warn #out to console log4j.appender.stdout=org.apache.log4j.ConsoleAppender log4j.appender.stdout.layout=org.apache.log4j.PatternLayout # Pattern to output the caller's file name and line number. log4j.appender.stdout.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n #out to file log4j.appender.logFile=org.apache.log4j.RollingFileAppender log4j.appender.logFile.File=c:\log4j\dbforms.txt #log4j.appender.logFile.File=/var/tomcat/logs/dbforms.log log4j.appender.logFile.MaxFileSize=100KB log4j.appender.logFile.MaxBackupIndex=1
	DbForms v1.1 supports internationalization (i18n). Labels, messages, etc. can be stored in "resource bundle" files and retrieved using appropriate DbForm tags. The optional initialization parameter resourceBundle setting is used to specify the resource bundle root name. Refer to Section 16.2, “Defining Resource Bundles ” for more detail.
	Enhanced validation features are available because the Apache Commons-Validator framework has been integrated into DbForms. This framework requires the use of two distinct xml descriptor files. The optional initialization parameters validator-rules and validation are used to specify these files. Refer to Section 17.1, “Commons-Validator framework ” for more discussion.
	The initialization parameter maxUploadSize tells DbForms how big of a file upload it should accept. If no value is set, a default value will be used. Setting any kind of upload size is important to protect the system against DoS (Denial of Service) attacks.

DbForms inherits all of the security controls present in the servlet container, either an application server or a dedicated servlet engine such as Tomcat. Therefore, please refer to documentation for the Application Server or Servlet Engine being used for information on this topic. The Java Servlet specification also contains information about web application security.

A typical security-aware web application deployment descriptor has elements inside its web-app element as shown below.

  <!-- ==================================================== -->
  <!-- =           APPLICATION SECURITY                   = -->
  <!-- ==================================================== -->

  <!-- =================== authentication ================= -->
  <!--
    We protect everything in directory /protected
    however, be sure NOT to protect login.jsp or logout.jsp since,
    in most containers, this would lead to endless recursion
    which ends with a crash of the Java Virtual Machine ("StackOverFlow")
  -->

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>myapp</web-resource-name>
      <url-pattern>/protected/*</url-pattern>
    </web-resource-collection>

    <auth-constraint>
      <role-name>a_users</role-name>
      <role-name>b_users</role-name>
      <role-name>guests</role-name>
    </auth-constraint>
  </security-constraint>

  <!--=================== login config ====================-->
  <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Form-Based Authentication Area</realm-name>

    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/login.jsp</form-error-page>
    </form-login-config>
  </login-config>

  <!--<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Example Basic Authentication Area</realm-name>
  </login-config>-->

  <!--=================== roles ===========================-->
  <security-role>
    <description>Have read only access</description>
    <role-name>guests</role-name>
  </security-role>

  <security-role>
    <description>Registered users can do stuff, others not.</description>
    <role-name>a_users</role-name>
  </security-role>

  <security-role>
    <description>Registered users can do less then users_a</description>
    <role-name>b_users</role-name>
  </security-role>
        

Remarks:

User authentication and mapping of users to roles are both performed by the servlet container. For Tomcat, this is controlled via the Realm element in the conf/server.xml file.

DbForms provide some additional security controls beyond the controls inherited through the container. See Chapter 9, Security for fine-grained definition of rights for data access and manipulation.