[memo] Accessing files in a web application

Sometimes the easiest things are also the easiest to miss (or to forget :-) ). Therefore, in order to have this once and for all in one place - the quickest guide how to access files in a servlet environment (Spring Boot application in my case).

1. Classpath resource

A file that is present in a classpath (typically /WEB-INF/classes, /WEB-INF/lib).
Can be anything, most probably a configuration file that is packed with WAR during package preparation stage. In case of good old Maven - all of the resources (by default src/main/resources) will end up in the classpath. Access - via context class loader.
For example:

2. Web resource 

All of the web application files - including static content (images, styles, html, ...) and files that are loaded into classpath (JARs from /WEB-INF/lib etc.) can be accessed this way. The only requirement is the presence of a ServletContext. 

PRO TIP: In a Spring application, the ServletContext can be simply autowired into a service requiring it. 

For example: 

As a last word - be __very__ cautious when planning to use ServletContext.getRealPath(). Why? Just take a look here: http://stackoverflow.com/questions/12160639/what-does-servletcontext-getrealpath-mean-and-when-should-i-use-it

Xalan Java exensions

Lately, I've been given a task involving some XSLT processing with Java extensions. Transformation was meant to be run from a JSR-168 portlet running in the IBM WebSpere Portal.
First prototype used following declarations:

• function (namespace) declaration:
  xmlns:custom="java:foo.bar.CustomFunction"
  
• class instance injection:
  xsl:param name="instance"
  
• sample instance method call:
  custom:setTitle($instance, text())
  

It run smoothly in Tomcat without any problems, even given that I had to use instance method calls on object passed by param.
Then I moved to IBM WebSphere and things got complicated. At first I was blessed by the TransformerConfgiurationException. I took me plenty of googling to figure out what was happening. Eventually it occurred that WebSphere's Xalan was unable to identify the exact type (!) of injected custom class instance. It's well-known limitation, identified in this Apache JIRA issue.
My final XSLT declarations are as follows:

• function (namespace) declaration:
  xmlns:my-namespace="xalan://foo.bar.CustomFunction"
  
• class instance injection:
  xsl:param name="instance"
  
• sample instance method call:
  my-namespace:setTitle(xsltc:cast('foo.bar.CustomFunction', $instance), '', text())
  

The best thing is that such configuration works in both containers (Tomcat and WebSphere) without any problems :)

JAAS security @ WebLogic

This may be a valuable tip for anyone struggling with custom JAAS-based security on Oracle WebLogic. Apart from tiresome JPDA debugging of custom authenticators or even server's code there is one nifty feature available: debug logging.

To enable some in-depth information logging, one needs to navigate to:

Servers -> [server name] -> Debug

There are two main categories: default and weblogic. For security debugging, the latter is interesting. Typically I enable following:

• default -> security -> DebugSecurity


• default -> security -> realm -> DebugSecurityRealm


• default -> security -> realm -> DebugSecurityService

With those active, your console output will be filled with lots of debug data. Picking useful information is a somewhat different story.. ;-)