How Do I Use the Java Plug-In Tool?
Mike is an independent consultant and lecturer. He is also director of Southgate Software Ltd. He can be reached at [email protected].
In May 1995, Netscape Communications added to its browser a Java interpreter and the ability to parse the newly added <applet> tag, bringing to the Web a standard cross-platform way to do client-side computation and presentation. Microsoft, wary of anything cross platform but still wanting to match Netscape's browser feature for feature, licensed Java technology from Sun Microsystems in March 1996 for its Internet Explorer (IE) browser.
As the web-browser market evolved, differences between Java virtual machines meant that some applets would behave differently on different browser/operating-system combinations hardly a "write once, run everywhere" situation. In addition, Microsoft's Java implementation was frozen at Version 1.1 due to a legal battle with Sun, while Java itself moved from Version 1.2 to 1.3 to 1.4, and so on.
To let programmers and end users take full advantage of state-of-the-art Java while keeping behavior consistent, Sun developed a freely available Java plug-in tool. The Java plug-in is available for many OS/browser combinations, most notably Netscape and IE on Windows and Netscape on Linux (http://java.sun.com/products/plugin/). In this article, I'll describe how to use the Java plug-in to deploy Java 1.3-enabled applets.
What Is a Plug-In?
Every group of bytes or object downloaded from web servers by web browsers have properties that browsers can use. The most important property a downloaded object has is its "content type," which is a string indicating that object's Multimedia Internet Message Extensions (MIME) type. For example, a standard web page has a content type of text/html, whereas a JPEG image has a content type of image/jpeg.
The browser knows how to handle many of these MIME types, but if it encounters a MIME type that it cannot process internally, it looks for an external piece of code registered to handle that type. That piece of code is a plug-in.
Object or Embed?
Making It Painless
If users browsing the Web with a Netscape browser hit a page with an <embed> tag that refers to a particular plug-in, that plug-in is used automatically if it is already installed; otherwise, users are directed to a page where they can download and install the plug-in if they choose. This page is specified by the pluginspage parameter of the <embed> tag.
Things are both different and more convenient with Microsoft's IE. If users hit a page with an <object> tag that refers to a not-yet-installed plug-in, IE automatically downloads, extracts, and runs a Windows executable contained in a CAB file referenced by the codebase parameter of the <object> tag. The CAB-contained executable can contain a setup program for the entire plug-in, or contain a smaller executable that downloads the rest of the plug-in from a predetermined location while presenting users with a reassuring download status indicator of the autoinstaller in action. This is exactly what Sun has done with its plug-in autoinstaller.
Not for the Faint of Heart
The Java plug-in autoinstaller mechanism downloads the Java plug-in from http://java.sun.com/ and nowhere else. Most of the time this is sufficient, but if you are deploying your applet on an intranet (especially if your intranet has no access to the outside world), you need to change the way the Java plug-in autoinstaller works. In the list of "Available Locations" for downloading, there are two entries: one for java.sun.com and one for southgatesoftware.com. To do this yourself means venturing into the murky waters of CAB files and code signing.
CAB Files and Code Signing
IE's autoinstall mechanism won't work unless the CAB file referenced by the "codebase" parameter of the <object> tag has been digitally signed. To sign a CAB file, you need to download some code signing utilities from Microsoft, as well as obtain a private key and digital certificate file from a certificate authority such as Verisign or Thawte. Once these files are in place, you sign your CAB file as in Listing Two. The signcode utility is available as a free download from Microsoft (http://msdn.microsoft.com/downloads/default.asp?url=/code/sample.asp?url=/msdn-files/027/000/218/msdncompositedoc.xml). Also, you can search Microsoft's web site for "Authenticode for Internet Explorer."
To create or modify CAB files, you also need the cabarc utility, which is also available as a free download from Microsoft by the name of "cabinet sdk." (Visual Studio may also include the cabarc utility.)
signcode -v c:\mykey.pvk -spc c:\mycert.spc file.cab -t http://timestamp.verisign.com/scripts/timstamp.dll