1 Reply Latest reply on Nov 13, 2003 4:24 PM by ebdr

    struts login action, getRoles() in EJB and getUserPrincipal(

    ebdr Newbie

      Hi,

      Using jboss-3.2.0_tomcat-4.1.24.
      1. I am using a struts login action which does the following:

      SecurityAssociationHandler handler = new SecurityAssociationHandler();
      Principal user = new SimplePrincipal(form.getUser());
      handler.setSecurityInfo(user, form.getPassword().toCharArray());
      LoginContext loginContext = new LoginContext("dynassetRealm", (CallbackHandler) handler);
      loginContext.login();

      2. in my EJB, I can then call the getRoles():

      Subject subject = SecurityAssociation.getSubject();
      Set principals = subject.getPrincipals(Group.class);
      // iterate to find the group named 'Roles'
      Iterator it = principals.iterator();
      while (it.hasNext()) {
      Group group = (Group) it.next();
      if ("Roles".equals(group.getName())) {
      Enumeration enum = group.members();
      while (enum.hasMoreElements()) {
      Principal role = (Principal) enum.nextElement();
      roles.add(role.getName());
      }
      }
      }

      3. in order to make all this work I need to setup a servlet filter which will perform the login each time. Please refer to:
      http://www.jboss.org/modules/bb/index.html?module=bb&op=viewtopic&t= my question is: In my servlet container, I need to call the HttpServletRequest's getUserPrincipal() and isUserInRole(...) methods. The above setup gives me getUserPrincipal() == null.

      Do I need to perform a login at the servlet container as well?

      Thank you for your help.

      -Eric

        • 1. JAAS server and client side
          ebdr Newbie

          Hi,

          Since I did not get an answer yet, I will try rephrasing my question!

          I would like to find a mechanism that will allow me to get the user principal both in my server (EJB Container) and my client (servlet container).

          When using form based login, I can get the user principal in my jsp but not in my EJBs. Reversely, when I use the JAAS login as stated above, I cannot get the principal from by jsp, but I can from my EJBs (given the filter).

          I cannot get my filter to work when using a form based login, because I have no way of getting the user name and password...

          thank you,

          Eric