org.openi.security.tomcat
Class LoginValve

java.lang.Object
  ValveBase
      org.openi.security.tomcat.LoginValve

public class LoginValve

extends ValveBase

Version:

$Revision: 1.1.1.2 $ $Date: 2005/07/11 18:00:34 $ A Valve that hooks up j_security_check request and sets j_password in session. Reasons:

• application requires user cridential to connect with XMLA web service if basic authentication is enable
• User name can be accessed from request object but there is no such a standard way to retrieve password.
• application is using Form based authetication and authentication is done by tomcat itself. Form based authetication is done by sending "j_security_check" request with "j_username" and "j_password" parameter. The simple idea to grab password is to filter the "j_security_check" and store the j_password in some variable by using Servelt Request Filter. But in the case of "j_security_check" the servlet filter does not work at all(This is because the servlet spec strongly recommended that the "j_security_check" should not be processed by Application. The processing of this request should be implemented in Container) The other ideas like creating a simple intermidiate request filter to store the j_paswword and then redirect to j_security_check. But The problem of using this approach is that RequestDispatcher does not work for "j_security_check". Also sendRedirect() method depends on browser for redirection which creates a security hole to see j_security_check request string(with embeded j_password) from browser.

So with above constraints, the possible way is to use container to solve the above problem. With sacrifing portabily to deploy on different servlet container, we came up with the valve based solution supported by tomcat. The valve is similar as RequestFilter used in application. The container always called invoke method of each valve available in valve chain. Our valve just check the request for "j_security_check". If so, it retrieves j_password and sets in session. To use this valve :

• compile and create a jar
• copy jar to TOMCAT_ROOT/server/lib folder
• add the following property in section of server config file "TOMCAT_ROOT/conf/server.xml":

Author:

dpokhrel

See Also:

Serialized Form

Constructor Summary

LoginValve()

Method Summary

java.lang.String	getInfo() Return descriptive information about this Valve implementation.
void	invoke(Request request, Response response, ValveContext context) process the request and test whether it is j_security_check or not.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

LoginValve

public LoginValve()

Method Detail

getInfo

public java.lang.String getInfo()

Return descriptive information about this Valve implementation.

invoke

public void invoke(Request request,
                   Response response,
                   ValveContext context)
            throws java.io.IOException,
                   javax.servlet.ServletException

process the request and test whether it is j_security_check or not. If so, it stores j_password request parameter to a session variable "user.credentials". Which is later used by application to connect with XMLA web service.

Parameters:

request - Request

response - Response

context - ValveContext

Throws:

java.io.IOException

javax.servlet.ServletException