You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Ken Johanson <to...@kensystem.com> on 2006/01/15 05:54:23 UTC
Alternative Realm impl. that supports: boolean authenticate(String
user, String pass) or void doLogin(Prinicipal p)?
Is there another commonly used (perhaps not distib'd with tomcat)
implementation of Realm that allows a more programmatic type of
authentication?
I know that a couple other servers provide something like a
boolean <ServerName>.authenticate(String user, String pass), which
checks against the predefined (web.xml) datasources (allowing
pre-processing of form submitted username/password, such as username
aliases or cross-lookup against email address, etc)..
or
void <ServerName>.login(String user), which takes only the Principal and
implicitly logs that person in (leaving the password or id validation
logic to the implementor, an example being X509 client authentication
which can have widely varied rules for when to accept a cert):
if (CertValidator.validate(userCert))
{
Principal userPrincipal = CertValidator.getUserPrincipal(userCert);
TomcatReam.login(userPrincipal);
}
Just wondering if there's something already built for tomcat.. The
latter example is preferable (for me) since it's more abstract and
doesn't require the server built-in user databases.
Also, does anyone know of a JCP, etc proposal to define a
server-interface that supports something like either of these two?
Thanks very much for any suggestions,
ken
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Alternative Realm impl. that supports: boolean authenticate(String
user, String pass) or void doLogin(Prinicipal p)?
Posted by Ken Johanson <to...@kensystem.com>.
Nicholas Irving wrote:
> What class is that? I cannot find it in any of the classes I have available?
>
> I am using 5.0.28, so perhaps this is a 5.5.x thing?
>
> -----Original Message-----
> From: Ken Johanson [mailto:tomcat-user@kensystem.com]
> Sent: Monday, 16 January 2006 6:54 AM
> To: Tomcat Users List
> Cc: nirving@darkedges.com
> Subject: Re: Alternative Realm impl. that supports: boolean
> authenticate(String user, String pass) or void doLogin(Prinicipal p)?
>
> Nicholas Irving wrote:
>
>>I have been looking for a authenticate(user) method, but cannot seem to
>
> find
>
>>one, as I need to do something similar. Any ideas?
>>
>
>
> Do you mean doLogin(Principal p)?
>
>
I was meaning to ask you if you also wanted it lie myself, - not saying
that it exists. - I dont know if it exists, that's why I asked the same
question in my first post..
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Alternative Realm impl. that supports: boolean authenticate(String user, String pass) or void doLogin(Prinicipal p)?
Posted by Nicholas Irving <ni...@darkedges.com>.
What class is that? I cannot find it in any of the classes I have available?
I am using 5.0.28, so perhaps this is a 5.5.x thing?
-----Original Message-----
From: Ken Johanson [mailto:tomcat-user@kensystem.com]
Sent: Monday, 16 January 2006 6:54 AM
To: Tomcat Users List
Cc: nirving@darkedges.com
Subject: Re: Alternative Realm impl. that supports: boolean
authenticate(String user, String pass) or void doLogin(Prinicipal p)?
Nicholas Irving wrote:
> I have been looking for a authenticate(user) method, but cannot seem to
find
> one, as I need to do something similar. Any ideas?
>
Do you mean doLogin(Principal p)?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.371 / Virus Database: 267.14.18/230 - Release Date: 14/01/2006
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.371 / Virus Database: 267.14.18/230 - Release Date: 14/01/2006
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Alternative Realm impl. that supports: boolean authenticate(String
user, String pass) or void doLogin(Prinicipal p)?
Posted by Ken Johanson <to...@kensystem.com>.
Nicholas Irving wrote:
> I have been looking for a authenticate(user) method, but cannot seem to find
> one, as I need to do something similar. Any ideas?
>
Do you mean doLogin(Principal p)?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Alternative Realm impl. that supports: boolean authenticate(String user, String pass) or void doLogin(Prinicipal p)?
Posted by Nicholas Irving <ni...@darkedges.com>.
I have been looking for a authenticate(user) method, but cannot seem to find
one, as I need to do something similar. Any ideas?
-----Original Message-----
From: Ken Johanson [mailto:tomcat-user@kensystem.com]
Sent: Sunday, 15 January 2006 4:28 PM
To: Tomcat Users List
Subject: Re: Alternative Realm impl. that supports: boolean
authenticate(String user, String pass) or void doLogin(Prinicipal p)?
>
> Hmm, I see from all the org.apache.catalina.Realm implementations that
> come with Tomcat, that authenticate(user,pass) is already there - but I
> currently don't know how to gain access to the Realm service from within
> a servlet/jsp (where my controller might be)... and it seems to me that
> it may not even be allowed (by design), since there could be security
> implications to exposing all those interface methods to the servlet
> level.. but if its possible, I'll take it! :-)
>
> Thanks,
> ken
>
>
... clearing my throat, and pretending to be 3rd-person ....
"Ken, take a look at this :
http://wiki.apache.org/tomcat/HowTo#head-42e95596753a1fa4a4aa396d53010680e3d
509b5"
Many thanks to Yoav Shapira for having contributed that info!! Awesome!
ken
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.371 / Virus Database: 267.14.18/230 - Release Date: 14/01/2006
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.371 / Virus Database: 267.14.18/230 - Release Date: 14/01/2006
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Alternative Realm impl. that supports: boolean authenticate(String
user, String pass) or void doLogin(Prinicipal p)?
Posted by Ken Johanson <to...@kensystem.com>.
>
> Hmm, I see from all the org.apache.catalina.Realm implementations that
> come with Tomcat, that authenticate(user,pass) is already there - but I
> currently don't know how to gain access to the Realm service from within
> a servlet/jsp (where my controller might be)... and it seems to me that
> it may not even be allowed (by design), since there could be security
> implications to exposing all those interface methods to the servlet
> level.. but if its possible, I'll take it! :-)
>
> Thanks,
> ken
>
>
... clearing my throat, and pretending to be 3rd-person ....
"Ken, take a look at this :
http://wiki.apache.org/tomcat/HowTo#head-42e95596753a1fa4a4aa396d53010680e3d509b5"
Many thanks to Yoav Shapira for having contributed that info!! Awesome!
ken
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Alternative Realm impl. that supports: boolean authenticate(String
user, String pass) or void doLogin(Prinicipal p)?
Posted by Ken Johanson <to...@kensystem.com>.
Ken Johanson wrote:
> Is there another commonly used (perhaps not distib'd with tomcat)
> implementation of Realm that allows a more programmatic type of
> authentication?
>
> I know that a couple other servers provide something like a
>
> boolean <ServerName>.authenticate(String user, String pass), which
> checks against the predefined (web.xml) datasources (allowing
> pre-processing of form submitted username/password, such as username
> aliases or cross-lookup against email address, etc)..
>
Hmm, I see from all the org.apache.catalina.Realm implementations that
come with Tomcat, that authenticate(user,pass) is already there - but I
currently don't know how to gain access to the Realm service from within
a servlet/jsp (where my controller might be)... and it seems to me that
it may not even be allowed (by design), since there could be security
implications to exposing all those interface methods to the servlet
level.. but if its possible, I'll take it! :-)
Thanks,
ken
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org