• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Jeanne Boyarsky
  • Ron McLeod
  • Paul Clapham
  • Liutauras Vilda
Sheriffs:
  • paul wheaton
  • Rob Spoor
  • Devaka Cooray
Saloon Keepers:
  • Stephan van Hulst
  • Tim Holloway
  • Carey Brown
  • Frits Walraven
  • Tim Moores
Bartenders:
  • Mikalai Zaikin

How do this? (Own type of login, but associate with container)?

 
Ranch Hand
Posts: 585
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I want to define my own login method (i.e. there's the built-in form-login which uses j_security_check for example). How would I do this? Is there a J2EE standard for this?

I originally was OK with using j_security_check because I thought I could put a filter on it (I need to hash the password passed in for comparison to the hashed password in the database), but that's not possible. Ideally I want to require a certificate and username and password (and I'll hash the password) but I can't do this with built-in J2EE security (WHY?! it wouldn't have been hard to make a generic interface that gave flexibility). Anyone know how I would do this?

I know how to get the user/pass, etc but I don't know how to associate it with the container - which is the big hang up here. I want to be able to tie it in. Argh!

Thanks!
 
Greenhorn
Posts: 26
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
have you tried using Realms?

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html
 
Robert Paris
Ranch Hand
Posts: 585
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
yeah, but it's non-portable across containers. I'm really dissapointed by the poor security api for web apps in java.
 
Ranch Hand
Posts: 783
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hi Robert,

You are right in that implementing a JAAS module tends to be rather container specific. Usually you have to extend a container provided login module class instead of implementing LoginModule yourself. This can be frustrating when you are working on a more global solution.

There are two ways I can think of around this.

1) Develop a business class that performs the authentication work, and build caller classes that extend the classes provided by the container but call the business class to do all of the work. This way you can keep all of the logic out of the container specific code. This will also give you the flexibility to change the type of authentication (i.e. jdbc, ldap...) at run time if you use a factory. This solution, while useful, can also be quite complex and time consuming.

2) Have you considered using a client side hash instead? I faced the same problem you did in a project, and chose instead to hash the password using a JavaScript function before sending it across the network. This way I could still use the j_security_check if I wanted to.
 
Consider Paul's rocket mass heater.
reply
    Bookmark Topic Watch Topic
  • New Topic