Extending authentication

[schemers]

strange. I just cut-and-pasted from the sample code again and it is working fine for me.

[jgao]

Nothing special on my end. I did copy and paste, modified DOMAIN_KEY, modified user1.

I'm using https on port 8080.

Does the error page give you any clue?

Thanks.

[schemers]

I'd look for a typo around the domain key line, or for any line wraps. You might also want to take the example verbatim and see if it works (i.e., compiles).

I just changed the sample to be an attachment instead of inline code as well

[jgao]

I loaded tomcat example, cal, it works. Please see this link:
http://jian.cirrata.net/zimbra/cal/login.html

I just copied and pasted your new jsp again, removed comments on the top, replaced domain_key and user, reviewed it with vi to make sure no line wrapper, BUT it gave me the same error:
http://jian.cirrata.net/zimbra/preauth.jsp

[schemers]

ok, it looks like it might be a tomcat versioning issue. As far as I can tell from the tomcat release notes:

http://tomcat.apache.org/tomcat-5.5-doc/changelog.html

they started support JDK 1.5 in JSPs around 5.5.10, I think we are shipping 5.5.9, and I'm running 5.5.12 on my Mac. I reproduced your error on another system, and I'll see if I can the example working on an earlier version, as well as ask that we upgrade our tomcat version.

[schemers]

OK. I updated the example one more time, this time removing JDK 1.5-isms. This time it should hopefully work.

[jgao]

It's working now. Please update your jsp when you have a new version of tomcat.

[jgao]

I gave a button to the users so they can jump into Zimbra WebMail directly. But they are frustrated by the progressing page before they get in. How to diable or hide this progressing page?

Thanks.

[KevinH]

That splash page is there while the application loads and caches the needed data, gets the first page of messages/conversations, etc. So if we were to remove it (which we don't plan to do) the user would just have a blank page during that time. In general after the first login the time spent on that page should be much shorter since user's will have the application, CSS, and images cached in their browser.

[msca]

Hi!

I tried this pre-auth stuff and this is excellent

i have only one question.

If anybody gets the site-key, I messed up

Is any security option apart from hide-ing security key.?
for example accept pre-auth from only 1 ip address, and deny access from anywhere else?

thanks
Szabi