access httpsession from jaas loginmodule ?

[cpage]

hi,

I've made my own implementation of the jaas loginmodule to authenticate my users.

this loginmodule ask an LDAP to authenticate the user and then i ask the user's roles to an other service.

after that, i build an user object which contains all informations about user identity and user roles.

then, i have to "give" this user object to the portal.
so i put it in the session like this :

HttpServletRequest request = (HttpServletRequest) PolicyContext.getContext("javax.servlet.http.HttpServletRequest"); request.getSession(true).setAttribute(userCpage.getUserId(),userCpage);

the problem is that i can't get this object back from a tag in my jsp :

public void doTag() throws JspException, IOException {
 PageContext app = (PageContext)getJspContext();
 HttpServletRequest request = (HttpServletRequest)app.getRequest();
 userCpageId= request.getRemoteUser();

 userCpage=(UserCpage)request.getSession(false).getAttribute(userCpageId);

this return a null object.


i read something about valve, but i don't understand how it can resolve my problem.
http://wiki.jboss.org/wiki/Wiki.jsp?page=CustomizingSecurityUsingValves


thanks for help ;)
lionel

[mholzner]

and what's wrong with using the Subject ?

Why do it any other way then the default login modules handle this case?
they create Groups and Principals and populate the Subject with them.

[cpage]

ok, i'll take a look on what informations i can add to the subject.

and after, how can i get these informations in the portal ?
how can i retrieve the subject ?

[mholzner]

 Subject currentSubject = (Subject)PolicyContext.getContext("javax.security.auth.Subject.container");

but note that this call is subject to security manager access checks.

Not sure if there is any better way ....

[cpage]

it works fine ;)

i can retrieve the jaas subject and my specific object too.

thank you