Followup to Valve As Custom Authenticator

[Scott Kelley <sk...@biomail.ucsd.edu>]

I just wanted to follow up on my earlier post, and thank Tim Funk and 
Bill Barker for leading me in the right direction.

It turned out that my Valve code was in fact mostly correct; I was 
just installing it in the wrong place! I had it installed at the 
Engine level, where all sorts of weird things happened. Once I moved 
it to the Host level, everything seemed to start working a whole lot 
better.

For the benefit of anyone who ends up trying to take the same custom 
valve approach to authentication and authorization that we are using, 
here's a short list of "things I wish I'd known when starting out" 
that would have made things go more quickly:

- Write a Valve that extends ValveBase

- implement Authenticator and Lifecycle in your valve

- implement invoke()

     - if the request needs to be logged in, do a redirect

           hres.sendRedirect(hres.encodeRedirectURL(loginPage))

       or, alternately, you can output the login page html
       code directly from the valve

     - when the request should be allowed, call

           hrequest.setUserPrincipal(new YourPrincipal(username))
           hrequest.setAuthType("BASIC")

       Other authenticators will see this and not request redundant logins.

- Write your own implementation of Principal.

- To handle authorization, write a Realm.

- To allow a Valve and a Realm to exchange information, use the 
Principal. If both your Realm and your Valve are installed, the 
Principal seen by the Realm will be the one attached to the request 
by your Valve.

- Install both the Valve and the Realm at the top of the Host section 
of server.xml.

- Tomcat uses introspection to handle Valve properties, so you can 
create arbitrary bean-style getters and setters to configure your 
Valve via server.xml.

- Tip: the start() method of the Lifecycle interface is a good place 
to check to see if your Valve has been properly configured. If not, 
you can throw LifecycleException and keep the server from starting up.

Please note that this is NOT a tutorial! You will have to look at the 
Tomcat docs and source code to figure out how to do all this. But the 
above list might make it clearer where to start looking. (And before 
writing to ask me to explain how to do this; please be aware that 
pretty much everything *I* know is in the list above, and even that 
may not be entirely correct! Everything else is in the Tomcat 
source...)

And this list only considers how to talk to Tomcat, not how you 
should be actually authenticating and authorizing requests-- that's a 
separate issue.

Also, for anyone considering this approach, be aware that it's 
reasonably straightforward once you understand Tomcat's architecture, 
but the learning curve is somewhat steep at first! At least that's 
been our experience.

Hope this helps someone,

Scott



---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org