How to use my own Principal class?

[alxll]

Hi everybody!

I've developed my own MyLoginModule class implementing javax.security.auth.spi.LoginModule. Within the MyLoginModule I'm using MyPrincipal class implementing java.security.Principal.

This working fine with my servlet/struts based web application but when I try to get the Principal from HttpServletRequest using theRequest.getUserPrincipal() it return org.jboss.security.SimplePrincipal instance...

The question is: what I gonna do to get instance of MyPrincipal from HttpServletRequest?

The main idea I wish go keep some additional info in Principal like USER_ID, First & Last names etc. (in other words all user info I keep in database) to avoid looking this info every time I'm procesing HTTPRequest - I'd like to get full user info when user logging in and keep it in session

I'll very appreciate for any help or advice

Regards,

Alex Chesnokov

[tcherel]

I do not believe this is possible at this point with JBoss.
You can have a cusotm principal in your EJB code (custom principal returned by EJBContext.getCallerPrincipal), but not in the web container code.
See http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3878558 for more details, especially the last few posts of the thread referencing the http://jira.jboss.com/jira/browse/JBAS-1802 JIRA issue which is what you need in order to have your own custom principal in the web container.

Thomas

[tcherel]

You can probably "workaround" the problem by creating a servlet interceptor or tomcat valve to collect the user data you need and cache it as part of the HTTP session.
Not as elegant as the custom principal, I think, but that should work.

Thomas

[alxll]

We've solved the problem by creating java.security.acl.group with name CallerPrincipal and value MyPrincipal instance:

Group callerPrincipal = new SimpleGroup("CallerPrincipal");
callerPrincipal.addMember(caller);

So, currently getUserPrincipal() of HttpServletRequest returns MyPrincipal instance as it required...

Anyway thanks a lot for answers!

Regards,
Alex Chesnokov

[tcherel]

This is definitely the way to make it work to get the custom principal in the session code, but I did not think that this was also working for the web container.
Which JBoss version are you using?

Thomas

[starksm64]

The custom principal recepie works in both the ejb and web container provided that the container is doing the authentication.
http://wiki.jboss.org/wiki/Wiki.jsp?page=UsingCustomPrincpalsWith

[alxll]

"tcherel" wrote:
This is definitely the way to make it work to get the custom principal in the session code, but I did not think that this was also working for the web container.
Which JBoss version are you using?

Thomas

I'm using JBoss AS 4.0.2