I'm new to GWT and the Java world having been in the .NET space for about 10 years. Our application will be a multi-tenant one (at least, to the degree that I understand the definition). We'd like customers to be able to navigate to www.mysite.com/customerName, then log in from there. I think I have a handle on how to manage this from the GAE datastore side but am wondering how to manage this URL mapping in web.xml for GWT.
Also, would like to get some opinions on how to manage the authentication once it's set up. Here's how I see it working: - User navigates to www.mysite.com/customerName - System retrieves company data and stores in session and displays login page - User logs in. System authenticates user - For all RPC calls, system verifies user is logged in *and* checks that the URL matches the company info in the session
Basically, I want to guard against a user logging into one client site, then navigating to another.
So you can just built the ui once and always include it in the login page for which ever client as the server should be where you filter/ prevent access to data that's not for the current client.
On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> I'm new to GWT and the Java world having been in the .NET space for > about 10 years. Our application will be a multi-tenant one (at least, > to the degree that I understand the definition). We'd like customers > to be able to navigate towww.mysite.com/customerName, then log in > from there. I think I have a handle on how to manage this from the GAE > datastore side but am wondering how to manage this URL mapping in > web.xml for GWT.
> Also, would like to get some opinions on how to manage the > authentication once it's set up. Here's how I see it working: > - User navigates towww.mysite.com/customerName > - System retrieves company data and stores in session and displays > login page > - User logs in. System authenticates user > - For all RPC calls, system verifies user is logged in *and* checks > that the URL matches the company info in the session
> Basically, I want to guard against a user logging into one client > site, then navigating to another.
Not sure I understand. I plan to filter data on the server side of things. But I don't know how to configure GWT to allow me to navigate to specific client for the entire app.
For example, Acme Hair Salon would navigate to mysite.com/ acmeHairSalon/myapp.html and Generic Dog Collars would navigate to mysite.com/genericDogCollars/myapp.html. Both URLs should map to the same instance of the application but in it, I'd check the URL to see which company was being used and filter all the data in it accordingly. I know how to do the filtering and can probably figure out how to check the URL for a company token. But I don't know how to configure GWT and/or GAE to use a single instance of the application for multiple (generic) URLs that aren't pre-defined. It sounds to me like something that should be done in web.xml but again, I don't know how.
On Mar 23, 1:01 pm, "dolcra...@gmail.com" <dolcra...@gmail.com> wrote:
> So you can just built the ui once and always include it in the login > page for which ever client as the server should be where you filter/ > prevent access to data that's not for the current client.
> On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > I'm new to GWT and the Java world having been in the .NET space for > > about 10 years. Our application will be a multi-tenant one (at least, > > to the degree that I understand the definition). We'd like customers > > to be able to navigate towww.mysite.com/customerName, then log in > > from there. I think I have a handle on how to manage this from the GAE > > datastore side but am wondering how to manage this URL mapping in > > web.xml for GWT.
> > Also, would like to get some opinions on how to manage the > > authentication once it's set up. Here's how I see it working: > > - User navigates towww.mysite.com/customerName > > - System retrieves company data and stores in session and displays > > login page > > - User logs in. System authenticates user > > - For all RPC calls, system verifies user is logged in *and* checks > > that the URL matches the company info in the session
> > Basically, I want to guard against a user logging into one client > > site, then navigating to another.
> Not sure I understand. I plan to filter data on the server side of > things. But I don't know how to configure GWT to allow me to navigate > to specific client for the entire app.
> For example, Acme Hair Salon would navigate to mysite.com/ > acmeHairSalon/myapp.html and Generic Dog Collars would navigate to > mysite.com/genericDogCollars/myapp.html. Both URLs should map to the > same instance of the application but in it, I'd check the URL to see > which company was being used and filter all the data in it > accordingly. I know how to do the filtering and can probably figure > out how to check the URL for a company token. But I don't know how to > configure GWT and/or GAE to use a single instance of the application > for multiple (generic) URLs that aren't pre-defined. It sounds to me > like something that should be done in web.xml but again, I don't know > how.
> On Mar 23, 1:01 pm, "dolcra...@gmail.com" <dolcra...@gmail.com> wrote:
> > So you can just built the ui once and always include it in the login > > page for which ever client as the server should be where you filter/ > > prevent access to data that's not for the current client.
> > On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > I'm new to GWT and the Java world having been in the .NET space for > > > about 10 years. Our application will be a multi-tenant one (at least, > > > to the degree that I understand the definition). We'd like customers > > > to be able to navigate towww.mysite.com/customerName, then log in > > > from there. I think I have a handle on how to manage this from the GAE > > > datastore side but am wondering how to manage this URL mapping in > > > web.xml for GWT.
> > > Also, would like to get some opinions on how to manage the > > > authentication once it's set up. Here's how I see it working: > > > - User navigates towww.mysite.com/customerName > > > - System retrieves company data and stores in session and displays > > > login page > > > - User logs in. System authenticates user > > > - For all RPC calls, system verifies user is logged in *and* checks > > > that the URL matches the company info in the session
> > > Basically, I want to guard against a user logging into one client > > > site, then navigating to another.
I think the best way to do this is to deploy new instance of client application for every customer and have one instance of "server" application that all client applications work with to get their data, non-client-side business logic, etc.
We're doing it this way when we have different versions of client application, which tends to change more often than server one. Also works when you have a development version of client that you need to test with the same server backend.
Regards, Uros
On Mar 24, 2:24 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> Not sure I understand. I plan to filter data on the server side of > things. But I don't know how to configure GWT to allow me to navigate > to specific client for the entire app.
> For example, Acme Hair Salon would navigate to mysite.com/ > acmeHairSalon/myapp.html and Generic Dog Collars would navigate to > mysite.com/genericDogCollars/myapp.html. Both URLs should map to the > same instance of the application but in it, I'd check the URL to see > which company was being used and filter all the data in it > accordingly. I know how to do the filtering and can probably figure > out how to check the URL for a company token. But I don't know how to > configure GWT and/or GAE to use a single instance of the application > for multiple (generic) URLs that aren't pre-defined. It sounds to me > like something that should be done in web.xml but again, I don't know > how.
> On Mar 23, 1:01 pm, "dolcra...@gmail.com" <dolcra...@gmail.com> wrote:
> > So you can just built the ui once and always include it in the login > > page for which ever client as the server should be where you filter/ > > prevent access to data that's not for the current client.
> > On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > I'm new to GWT and the Java world having been in the .NET space for > > > about 10 years. Our application will be a multi-tenant one (at least, > > > to the degree that I understand the definition). We'd like customers > > > to be able to navigate towww.mysite.com/customerName, then log in > > > from there. I think I have a handle on how to manage this from the GAE > > > datastore side but am wondering how to manage this URL mapping in > > > web.xml for GWT.
> > > Also, would like to get some opinions on how to manage the > > > authentication once it's set up. Here's how I see it working: > > > - User navigates towww.mysite.com/customerName > > > - System retrieves company data and stores in session and displays > > > login page > > > - User logs in. System authenticates user > > > - For all RPC calls, system verifies user is logged in *and* checks > > > that the URL matches the company info in the session
> > > Basically, I want to guard against a user logging into one client > > > site, then navigating to another.
In any case, I found something that works. I created a JSP page and dumped the contents of the MyApp.html into it. Then added the following to my web.xml:
> I think the best way to do this is to deploy new instance of client > application for every customer and have one instance of "server" > application that all client applications work with to get their data, > non-client-side business logic, etc.
> We're doing it this way when we have different versions of client > application, which tends to change more often than server one. Also > works when you have a development version of client that you need to > test with the same server backend.
> Regards, > Uros
> On Mar 24, 2:24 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > Not sure I understand. I plan to filter data on the server side of > > things. But I don't know how to configure GWT to allow me to navigate > > to specific client for the entire app.
> > For example, Acme Hair Salon would navigate to mysite.com/ > > acmeHairSalon/myapp.html and Generic Dog Collars would navigate to > > mysite.com/genericDogCollars/myapp.html. Both URLs should map to the > > same instance of the application but in it, I'd check the URL to see > > which company was being used and filter all the data in it > > accordingly. I know how to do the filtering and can probably figure > > out how to check the URL for a company token. But I don't know how to > > configure GWT and/or GAE to use a single instance of the application > > for multiple (generic) URLs that aren't pre-defined. It sounds to me > > like something that should be done in web.xml but again, I don't know > > how.
> > On Mar 23, 1:01 pm, "dolcra...@gmail.com" <dolcra...@gmail.com> wrote:
> > > So you can just built the ui once and always include it in the login > > > page for which ever client as the server should be where you filter/ > > > prevent access to data that's not for the current client.
> > > On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > > I'm new to GWT and the Java world having been in the .NET space for > > > > about 10 years. Our application will be a multi-tenant one (at least, > > > > to the degree that I understand the definition). We'd like customers > > > > to be able to navigate towww.mysite.com/customerName, then log in > > > > from there. I think I have a handle on how to manage this from the GAE > > > > datastore side but am wondering how to manage this URL mapping in > > > > web.xml for GWT.
> > > > Also, would like to get some opinions on how to manage the > > > > authentication once it's set up. Here's how I see it working: > > > > - User navigates towww.mysite.com/customerName > > > > - System retrieves company data and stores in session and displays > > > > login page > > > > - User logs in. System authenticates user > > > > - For all RPC calls, system verifies user is logged in *and* checks > > > > that the URL matches the company info in the session
> > > > Basically, I want to guard against a user logging into one client > > > > site, then navigating to another.
Kyle, I built a similar architecture, but with only one instance of the app serving all users. When a user authenticates, I look them up in a global store to figure out which tenant they belong to, and then use their tenant-specific database for all data persistence for the session. So all visitors use one instance of the app but each tenant has their own isolated database...multi-tenancy.
The problem is, true multi-tenancy isn't supported by GAE...they've been talking about it for almost 2 years now, but it doesn't seem to be a priority for them. They want you to use a different domain for every tenant, which means multiple app instances (multiple versions of your app to deploy & maintain). It also means your customer/tenant has to be in the loop for all domain administration tasks, which to me kind of defeats the purpose of customer-focused cloud computing.
I set my multi-tenant app up on Amazon EC2, using 1 tomcat server and 6 mysql databases (6 tenants...each tenant has on average 10 users). The beauty is if I need to scale or load balance the app, add more tenants/database instances or just backup one tenant's data, this is pretty much just a mouse-click or 6 in the EC2 developer console.
Murray
On Mar 25, 8:15 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> In any case, I found something that works. I created a JSP page and > dumped the contents of the MyApp.html into it. Then added the > following to my web.xml:
> I added /clients in there for now because we're using gwt-dispatch and > I haven't overridden its default of submitting things to /myApp/ > dispatch.
> Still some kinks to work out (like resource references) but early > results are encouraging.
> On Mar 24, 10:54 am, Uros Trebec <uros.tre...@gmail.com> wrote:
> > I think the best way to do this is to deploy new instance of client > > application for every customer and have one instance of "server" > > application that all client applications work with to get their data, > > non-client-side business logic, etc.
> > We're doing it this way when we have different versions of client > > application, which tends to change more often than server one. Also > > works when you have a development version of client that you need to > > test with the same server backend.
> > Regards, > > Uros
> > On Mar 24, 2:24 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > Not sure I understand. I plan to filter data on the server side of > > > things. But I don't know how to configure GWT to allow me to navigate > > > to specific client for the entire app.
> > > For example, Acme Hair Salon would navigate to mysite.com/ > > > acmeHairSalon/myapp.html and Generic Dog Collars would navigate to > > > mysite.com/genericDogCollars/myapp.html. Both URLs should map to the > > > same instance of the application but in it, I'd check the URL to see > > > which company was being used and filter all the data in it > > > accordingly. I know how to do the filtering and can probably figure > > > out how to check the URL for a company token. But I don't know how to > > > configure GWT and/or GAE to use a single instance of the application > > > for multiple (generic) URLs that aren't pre-defined. It sounds to me > > > like something that should be done in web.xml but again, I don't know > > > how.
> > > On Mar 23, 1:01 pm, "dolcra...@gmail.com" <dolcra...@gmail.com> wrote:
> > > > So you can just built the ui once and always include it in the login > > > > page for which ever client as the server should be where you filter/ > > > > prevent access to data that's not for the current client.
> > > > On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > > > I'm new to GWT and the Java world having been in the .NET space for > > > > > about 10 years. Our application will be a multi-tenant one (at least, > > > > > to the degree that I understand the definition). We'd like customers > > > > > to be able to navigate towww.mysite.com/customerName, then log in > > > > > from there. I think I have a handle on how to manage this from the GAE > > > > > datastore side but am wondering how to manage this URL mapping in > > > > > web.xml for GWT.
> > > > > Also, would like to get some opinions on how to manage the > > > > > authentication once it's set up. Here's how I see it working: > > > > > - User navigates towww.mysite.com/customerName > > > > > - System retrieves company data and stores in session and displays > > > > > login page > > > > > - User logs in. System authenticates user > > > > > - For all RPC calls, system verifies user is logged in *and* checks > > > > > that the URL matches the company info in the session
> > > > > Basically, I want to guard against a user logging into one client > > > > > site, then navigating to another.
> In any case, I found something that works. I created a JSP page and > dumped the contents of the MyApp.html into it. Then added the > following to my web.xml:
> I added /clients in there for now because we're using gwt-dispatch and > I haven't overridden its default of submitting things to /myApp/ > dispatch.
That is the best way to move forward. Since its unlikely that one client will access the website for another, you don't want the /#customer-name kind of urls. Also, in future, if you want to support a separate domain for each client, it would be easily doable.
> Kyle, I built a similar architecture, but with only one instance of > the app serving all users. When a user authenticates, I look them up > in a global store to figure out which tenant they belong to, and then > use their tenant-specific database for all data persistence for the > session. So all visitors use one instance of the app but each tenant > has their own isolated database...multi-tenancy.
> The problem is, true multi-tenancy isn't supported by GAE...they've > been talking about it for almost 2 years now, but it doesn't seem to > be a priority for them. They want you to use a different domain for > every tenant, which means multiple app instances (multiple versions of > your app to deploy & maintain). It also means your customer/tenant has > to be in the loop for all domain administration tasks, which to me > kind of defeats the purpose of customer-focused cloud computing.
> I set my multi-tenant app up on Amazon EC2, using 1 tomcat server and > 6 mysql databases (6 tenants...each tenant has on average 10 users). > The beauty is if I need to scale or load balance the app, add more > tenants/database instances or just backup one tenant's data, this is > pretty much just a mouse-click or 6 in the EC2 developer console.
> Murray
> On Mar 25, 8:15 am, Kyle Baley <kyle.ba...@gmail.com> wrote: > > Is that possible with GAE?
> > In any case, I found something that works. I created a JSP page and > > dumped the contents of the MyApp.html into it. Then added the > > following to my web.xml:
> > I added /clients in there for now because we're using gwt-dispatch and > > I haven't overridden its default of submitting things to /myApp/ > > dispatch.
> > Still some kinks to work out (like resource references) but early > > results are encouraging.
> > On Mar 24, 10:54 am, Uros Trebec <uros.tre...@gmail.com> wrote:
> > > I think the best way to do this is to deploy new instance of client > > > application for every customer and have one instance of "server" > > > application that all client applications work with to get their data, > > > non-client-side business logic, etc.
> > > We're doing it this way when we have different versions of client > > > application, which tends to change more often than server one. Also > > > works when you have a development version of client that you need to > > > test with the same server backend.
> > > Regards, > > > Uros
> > > On Mar 24, 2:24 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > > Not sure I understand. I plan to filter data on the server side of > > > > things. But I don't know how to configure GWT to allow me to navigate > > > > to specific client for the entire app.
> > > > For example, Acme Hair Salon would navigate to mysite.com/ > > > > acmeHairSalon/myapp.html and Generic Dog Collars would navigate to > > > > mysite.com/genericDogCollars/myapp.html. Both URLs should map to the > > > > same instance of the application but in it, I'd check the URL to see > > > > which company was being used and filter all the data in it > > > > accordingly. I know how to do the filtering and can probably figure > > > > out how to check the URL for a company token. But I don't know how to > > > > configure GWT and/or GAE to use a single instance of the application > > > > for multiple (generic) URLs that aren't pre-defined. It sounds to me > > > > like something that should be done in web.xml but again, I don't know > > > > how.
> > > > On Mar 23, 1:01 pm, "dolcra...@gmail.com" <dolcra...@gmail.com> > wrote:
> > > > > So you can just built the ui once and always include it in the > login > > > > > page for which ever client as the server should be where you > filter/ > > > > > prevent access to data that's not for the current client.
> > > > > On Mar 22, 10:41 am, Kyle Baley <kyle.ba...@gmail.com> wrote:
> > > > > > I'm new to GWT and the Java world having been in the .NET space > for > > > > > > about 10 years. Our application will be a multi-tenant one (at > least, > > > > > > to the degree that I understand the definition). We'd like > customers > > > > > > to be able to navigate towww.mysite.com/customerName, then log > in > > > > > > from there. I think I have a handle on how to manage this from > the GAE > > > > > > datastore side but am wondering how to manage this URL mapping in > > > > > > web.xml for GWT.
> > > > > > Also, would like to get some opinions on how to manage the > > > > > > authentication once it's set up. Here's how I see it working: > > > > > > - User navigates towww.mysite.com/customerName > > > > > > - System retrieves company data and stores in session and > displays > > > > > > login page > > > > > > - User logs in. System authenticates user > > > > > > - For all RPC calls, system verifies user is logged in *and* > checks > > > > > > that the URL matches the company info in the session
> > > > > > Basically, I want to guard against a user logging into one client > > > > > > site, then navigating to another.
> > > > > > Thanks > > > > > > Kyle
> -- > You received this message because you are subscribed to the Google Groups > "Google Web Toolkit" group. > To post to this group, send email to google-web-toolkit@googlegroups.com. > To unsubscribe from this group, send email to > google-web-toolkit+unsubscribe@googlegroups.com<google-web-toolkit%2Bunsubs cribe@googlegroups.com> > . > For more options, visit this group at > http://groups.google.com/group/google-web-toolkit?hl=en.
|
