Programmatic authentication...

[kpseal]

I've implemented a custom LoginModule that seems to work fine through form-based auth.
However, after quite a lot of reading and trawling through source code I've found no clues as to how I can authenticate a user programmatically :(

I'd like to be able to implement the following functionality (for starters) in the web app for my enterprise app:
* login of user at end of registration
* automatic login of user from cookie

If anyone's got any ideas on how to go about these using JBoss 3.0.0 (+Tomcat) I'd love to hear them!
Many thanks in advance.

[dgood]

You can do it this way (but only from a servlet)

response.sendRedirect("j_security_check?j_username=&j_password=");

I'm not sure how well this would work if there is no redirect URL stored on the session - but that might be something you could fake.

David

[kpseal]

That's not particularly practical since, as you point out, it'll probably be a direct reference to the login action.

I've tried using this (refers to my application policy called "Users" using a custom LoginModule):
[pre]
new LoginContext("Users", new UsernamePasswordHandler(username, password.toCharArray()).login();
[/pre]
It seems to work (ie, doesn't throw a LoginException) but subsequent HttpServletRequests still have a null user Principal. Presumably access to secured EJBs will work, though.

Can someone tell me how to set the Principal that the Servlet container (in this case Catalina) associates with a particular session?

Many thanks in advance.

[mattvincent]

...Just asked a similar question (currently unanswered)

http://www.jboss.org/modules/bb/index.html?module=bb&op=viewtopic&t=forums/

[simon.nicholls]

It definitely works, but I use two redirects - one within the "login" page to a protected resource for post-login processing etc, and one sneakily inside the login page. It can be done using POST as well as GET.

http://www.jboss.org/modules/bb/index.html?module=bb&op=viewtopic&t=forums/ way, the container does all the work it's supposed to, and there's little risk of losing portability.