Java Applets and endorsed jars

[IHateMyJob2004]

We are currently doing a project which requires endorsed jars when running as a java application.

We need to provide the ability to run this application as an applet also. How do endorse the jar files when running an applet?

Is this possbile?

Thanks,
Karl

EDIT: It seems possible if the client machine has the jar files in the endorsed directory on the client machine. We want to keep the jar files which require endorsing on the server side of things.

 

[kamper]

Can't say I know much about endorsed jars or applet sandboxing, but this is obviously a security measure. If you have control over the clients, you could probably tweak the security settings (of course that'd be a really bad idea if they would then have to apply the same reduced security to generic applets from the internet). I'd be willing to bet that you could sign the jars in some way, put a public key on the clients and then have them treat your signed jars as safe.

Educate me a bit: what exactly is the purpose of endorsing a jar and why do you need to do it?

 

[IHateMyJob2004]

Originally posted by: kamper
Can't say I know much about endorsed jars or applet sandboxing, but this is obviously a security measure. If you have control over the clients, you could probably tweak the security settings (of course that'd be a really bad idea if they would then have to apply the same reduced security to generic applets from the internet). I'd be willing to bet that you could sign the jars in some way, put a public key on the clients and then have them treat your signed jars as safe.

Educate me a bit: what exactly is the purpose of endorsing a jar and why do you need to do it?

I might have to update this. i'm not sure if xerces is the issue.

We are using xerces and the version shipping with 1.4 is not compatabile with the application we are using the newer version. We have to deliver the program in both application and applet form. The application is easy enough and almost done. Now we are trying to resolve some of the issues with running it as an Applet.

This is all being done on a closed network, so it will not be connecting in any way to the outside world.

Normally, endorsing a jar file simply means that you want the classes in that jar file to be used instead of the default classes found in Java 1.4.2_09.

Java 1.5 ships with the latest class files for xerces, so we make Java 1.5 the requierd version to have installed in order to run the software as an Applet.

I'll look into signing the jar files tommorrow when I get to work. Any other advice you could give would be greatly appreciated.

 

[kamper]

Hmm, now that I get the basic idea behind endorsed jars, I retract my statement about signed jars. I highly doubt that'll work.

 

[IHateMyJob2004]

Originally posted by: kamper
Hmm, now that I get the basic idea behind endorsed jars, I retract my statement about signed jars. I highly doubt that'll work.

It might. In my googling today at work, signed jars came up as a topic. So, your re-iteration makes it a worth while topic to delve into further.

One work around is to have teh clients set up their PCs/laptops with the jar files in the <JAVA_HOME>/lib/endorsed folder.

It seems like it's a possiblity, but I'm not sure how we can tell an applet to look on a client's PC for those endorsed jar files.

To give you an idea of what we're doing, read up on jaxb/jaxp and SVG (via Batik).

It's an interesting project to say the least. Quite awesome tech we are dealing with and without java, it would probably cost 10x moe to produce the software. Java is a god-send 😉

 

[kamper]

Originally posted by: IHateMyJob2004
It seems like it's a possiblity, but I'm not sure how we can tell an applet to look on a client's PC for those endorsed jar files.

If I understand correctly (and I think I've already demonstrated that it's quite possible that I don't 😛) the system classloader will automatically look in the endorsed folders for classes before grabbing them out of wherever the rest of the class library is stored. In short, it should work by itself.