Functionality of a web application to handle user's request to download files from SFTP Server

Question

In our Java web application, customer wants to upload some large files to a SFTP server and download directly from there. The customers do not want to use any third party tool rather they want this functionality in the application itself.

The file upload part has been taken care of by the JFileUpload applet component & libraries. Once the file gets uploaded I could figure out the exact location of the stored file. And that uploaded file will be shown to the users as a link which they will click to download (like an HTTP or FTP file link).

So I've to decide the strategy for downloading the file from the SFTP servers.

One option is to parse the request, then connect with the SFTP server and stream the file via HTTP server. But here the file will be downloaded over HTTP rather SFTP and moreover it will not serve the purpose of using SFTP.

Another option which I could think of is via an applet, again like upload. As soon as the request for the SFTP file comes to the HTTP server, it will launch a page containing an applet having a directory browser for users to decide the save path. Once the user selects the save location, the file will automatically start downloading to that location from the SFTP server. In this way the connection will be completely SFTP.

I want to know how much feasible the second approach is and if there are any important things I'll have to take care of. Which SFTP libraries are the best to use for this type of operations?

Moreover, please let me know if there are other better options to do mentioned activity.

Edit

It seems this post looks like a request for suggestion on ways to download from SFTP server (may be from the heading but I could not think of any other heading!!). Thank you for the suggestions on the APIs to do that but the more important issue for us is to figure out a way where a user's request to download a file from SFTP server is done over secure SSH rather than over HTTP. Now using the mentioned APIs we could very well download the files from the SFTP server to the HTTP server's filesystem but after that if we have to redirect the same file to the user's machine we have to use HTTP and that is what we want to avoid.

Our second thought approach of using a page with an applet which will initiate a SFTP session between user's client and SFTP server is to address the above concern.

How difficult will it be to implement and what should be our approach in this regard? And if there is any other better & easier way to do the same task then please suggest.

Answer 1

Did you mean SFTP or FTPS (FTP over SSL)? If you realy ment SFTP, have a look here: http://tinyurl.com/nn852c

Answer 2

I recommend using JSch, Java Secure Channel. It is a pure Java implementation of SSH2. It has good examples for doing SFTP in addition to pretty much every other SSH2 option (XForwarding, port forwarding, etc.). We use it in a number of our projects, and have not had any issues. I have even tied it's GSS-API (Kerberos) support into a native Kerberos implementation and it worked well. It is BSD licensed, so commercial or not, you shouldn't have much issues with licensing.

I see building an applet using JSch to be pretty simple. Biggest issue will be to make sure your applet is signed and has permissions to write/read local files and connect to the SSH servers in question.

Answer 3

I favor Commons-VFS for this kind of thing. It abstracts out the actual file system type and lets you work with a standard interface regardless of the underlying implementation. It in turn depends on other libraries for the actual systems, in particular JScsh for SFTP.

Answer 4

The customer is always right, so while the requirement screams bad architecture to me, I'll just extend my sympathy on that and try to help you with the problem.

The applet approach is OK, but seems kind of clunky for a web app. There are javascript sftp libraries out there. This one supports sftp and will give a much more natural feel to a web application than poping up an applet just for the sake of providing a file transfer. It isn't free, but it isn't that pricy either. It still uses an applet under the hood to effect the file transfer, it just doesn't present a java screen to the user.