2

Hi I am using basic authentication method for protecting some pages in my Webapp. Which have a specified url pattern as follows:

<url-pattern>/Important/*</url-pattern>
<auth-method>BASIC</auth-method>

Now the problem is if the user logs in the normal way using a login form .The data is posted to my servlet which validates the username and password and then proceeds further. Is there a way that i could setRemoteUser in this servlet , because the authentication input appears again once the user tries to access pages in the Important folder. Is there a way that I could inform the authentication mechanism that the user has already signed in ?

Murphy316
  • 726
  • 2
  • 13
  • 29

2 Answers2

3

This is not possible. If you have actually a HTML <form> for login, then you should change the authentication method from BASIC to FORM.

<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
</login-config>

You also need to make sure that your HTML <form> submits to the predefinied URL j_security_check with the username and password as predefinied parameters j_username and j_password.

<form action="j_security_check" method="post">
    <input type="text" name="j_username" />
    <input type="password" name="j_password" />
    <input type="submit" value="login" />
</form>

This way the container will set the login the way you need and the username will be available by getRemoteUser(). Also, any unauthenticated user who accesses the restricted URL directly will automatically be forwarded to the login page. On successful login, it will automatically be forwarded back to the initially requested page.

Also, when using FORM authentication method on a Servlet 3.0 compatible container (Tomcat 7, Glassfish 3, etc), you will be able to programmatically login the user by the Servlet 3.0 introduced HttpServletRequest#login() method in the servlet. This allows more finer grained control over the process and validation. This isn't possible with BASIC authentication.

The BASIC authentication is a completely different thing. It shows a bare JavaScript look-a-like dialog with username/password inputs. This doesn't require/use a HTML <form> or something. It also stores the authentication information in the client side which get sent as a request header on every single subsequent request. It doesn't store the authentication information in the server side session like as FORM authentication.

See also:

Community
  • 1
  • 1
BalusC
  • 992,635
  • 352
  • 3,478
  • 3,452
0

The method HttpServletRequest.getRemoteUser() willl return null if the user has not logged in.

This is true for all types of Authentications.

Here is what the API documentation says:

java.lang.String getRemoteUser()

Returns the login of the user making this request, if the user has been 
authenticated, or null if the user has not been authenticated. Whether the user 
name is sent with each subsequent request depends on the browser and type of      
authentication. Same as the value of the CGI variable REMOTE_USER.

Returns:
    a String specifying the login of the user making this request, 
   or null if the user login is not known
Ramesh PVK
  • 14,700
  • 2
  • 43
  • 49
  • So if the user has logged on through some other method , how can i inform the container that the user has logged in and set a value for the RemoteUser – Murphy316 Jun 27 '12 at 12:03
  • Means do you have your own Authentication? – Ramesh PVK Jun 27 '12 at 12:03
  • Yes I do. However a folder of my webapplication is being safeguarded by tomcat authentication so if a user is authenticated using my mechanism i would also like him to be automatically authenticated for the folder safeguarded by the tomcat authentication – Murphy316 Jun 27 '12 at 12:05
  • If you use your custom authentication, there is no way to tell the container about your authentication mechanism. If you really want to use custom authentication, you should be doing it using JAAS Login Module. – Ramesh PVK Jun 27 '12 at 12:09
  • Thanks Ill look into that and get back here – Murphy316 Jun 27 '12 at 12:16