Client IP in LoginModule

[prateek_n]

I have the same login-module for ejb/web layer.
I want to retrieve the clientIP in the login module.

Is there anyway to do it ?
I used the PolicyContext to retrieve it when the request type is http.

Object request = PolicyContext.getContext("javax.servlet.http.HttpServletRequest");
remoteIP = ((javax.servlet.http.HttpServletRequest)request)
.getRemoteHost();

Is there anyway to get it when the call is for a ejb ?

[prateek_n]

Is there a non portable way to retrieve the client IP for an EJB request for Jboss 4.2.2.GA ?

[ragavgomatam]

I assume that client is calling the ejb directly like a java client, which would be using jndi to look up the ejb & connecting to the bean. Usually there is no straight forward way, except to use java.net.ServerSocket and other java.net API. But if you read the ejb spec, this is one of the DO NOT DO LIST & is certainly not recommended. You can try however.

Try to use the following method:
java.rmi.server.RemoteServer.getClientHost().

See if you have any luck. Mostly ejb's use RMI over IIOP so above call may or maynot work depending on container

[prateek_n]

I tried java.rmi.server.RemoteServer.getClientHost().
But that doesn't work.
It gives an exception.

Any other suggestions ?

[ragavgomatam]

Socket API

[anil.saldhana]

What is needed is a interceptor pair (one on the client side to pick up the IP and one on the server side to place it in a static context for pick up by the login module).

[prateek_n]

But the problem with having an interceptor pair is that there is no guarantee that the client will be using the interceptor to call the EJB

[prateek_n]

Ragav,
Can you please expand on Socket API ?

[anil.saldhana]

It will work. If you want to muck around with something else, then be my guest.

[ragavgomatam]

I agree with what anil says...Its probably cleaner way than Socket API...When I mentioned Socket API, I had in mind java.net.ServerSocket API..You could perhaps hack it & use it to get IP...But once again not at all an elegant way & is frowned by specs....If you are still interested, I can post the code

[prateek_n]

It is definitely cleaner. But how can we guarantee that all clients will use the interceptor on the client end ?

[prateek_n]

It is definitely cleaner. But how can we guarantee that all clients will use the interceptor on the client end ?

[hedinant]

I use the first way in my login module works fine.

HttpServletRequest request = null;
try {
request = (HttpServletRequest) PolicyContext.getContext("javax.servlet.http.HttpServletRequest");
} catch (PolicyContextException e) {
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
throw new RuntimeException("PolicyContext.getContext(javax.servlet.http.HttpServletRequest) failed");
}

String ip = request.getRemoteHost();
Map map = request.getParameterMap();
Host host = new Host(ip, hostKey);// TODO put registry key
return host;

[prateek_n]

This is what I did. But it only works for some client accessing web.
When a client is calling an EJB directly , then you do not get the HttpServletRequest in the PolicyContext .
The issue is retrieving the client IP in a direct EJB call.