mjschehl
asked on
Tomcat programmed authentication
How can I programmatically set a user in the Tomcat container? My scenario is that I want to send a 1024-bit key to a user. That user will give that key to a specific servlet. That servlet will take that key and lookup user information. I want to then let Tomcat know who the user is so that request.getRemoteUser() will work on subsequent page loads.
There's no way to programmatically set the user (e.g. request.setRemoteUser), but if you need to, you can just use a session variable to let yourself know that this user is "ok."
For a servlet container, with Tomcat 3.2.1 It
provides the ability to create custom "request interceptors" which allow you
to substitute your own security model into the servlet framework. Tomcat
comes with two pre-built request interceptors already:
SimpleRealm -- which uses a tomcat-users.xml file found in
<tomcat-root>/conf to statically load users, groups, and roles upon Tomcat
startup.
JDBCRealm -- which works in a similar fashion but uses a JDBC data source as
a back-end.
provides the ability to create custom "request interceptors" which allow you
to substitute your own security model into the servlet framework. Tomcat
comes with two pre-built request interceptors already:
SimpleRealm -- which uses a tomcat-users.xml file found in
<tomcat-root>/conf to statically load users, groups, and roles upon Tomcat
startup.
JDBCRealm -- which works in a similar fashion but uses a JDBC data source as
a back-end.
ASKER
How would I set the Remote User in a filter when I use custom "request interceptor"?
I actually already programmed my own realm, so that would be great if I can just update it to set the remote user programmatically.
ASKER
Rama,
I looked at that pdf. I couldn't find anything that applies to my question, though. What page or section does it say how to programmatically login a user into Tomcat?
Thanks,
Micah
ASKER
Well, I found out how to do it by asking on the Tomcat User mailing list. The answer is to use a Tomcat Valve.
Thanks,
Micah
No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
I will leave the following recommendation for this question in the Cleanup topic area:
PAQ - refund
Any objections should be posted here in the next 4 days. After that time, the question will be closed.
Periwinkle
EE Cleanup Volunteer
I will leave the following recommendation for this question in the Cleanup topic area:
PAQ - refund
Any objections should be posted here in the next 4 days. After that time, the question will be closed.
Periwinkle
EE Cleanup Volunteer
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.