Access to HttpServletRequest in custom LoginModule

[cmoesel]

I need to access the request object in a custom LoginModule using JBoss 3.2.3. I cannot figure out, however, how to get access to the request object. Is this possible?

I need this because I would like to use Yale's CAS (Central Authentication Service) to provide single sign-on among several different JBoss servers.

[cmoesel]

Does the lack of replies mean this is not possible (something I don't understand about the JAAS spec), or that no one knows how to do it? Just wondering if this is worth pursuing.

[phantom]

I think it will be greate to add a new callbackhandler which can save parameters from request.


But in your case I can advise you to use filters to implement logic whcih you want.

[cmoesel]

Will/Can the filters push the authentication down to the EJB level though? I need to be able to access the user principal and roles in the EJB tier as well. The Yale CAS actually works by default with servlet filters, so that would be great-- if I can figure out how to get the authentication to be recognized in the EJBs as well.

[ceasaros]

In a javax.servlet.Filter you can acces the authenticated/authorizated Principal where you can add your own values to the Principal. The Principal will travel to the ejb context where you can retrieve the values you put in the Principal. For this you probably need to define your own Principal.