You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Neeraj Sinha <ne...@gmail.com> on 2014/03/06 10:34:28 UTC
Passing additional parameters using j_security_check (Form based authentication)
I have a jsp application and my tomcat version is 7.0.34. Authentication is
done using *Form based authentication.*
My requirement is as follows:
When user's account gets locked, he has to send a unlock request and he
gets a link in his registered email id clicking on which takes him to
unlocking page(let's say *unlock.jsp*) which has 3 fields namely*username*,
*password* and *unlock_code* and a submit button. After submission, once
unlocked successfully the user should land to home page of the application.
Just to let you know, the main login page of the application is
*login.jsp* which
is configured in *web.xml *and it is called whenever any protected resource
is requested. It has username and password fields and it's action is
*j_security_check*.
Now my problem is how to pass unlock_code, the 3rd parameter of *unlock.jsp*
to *FormAuthenticator *using the action *j_security_check*?
I have implementations of *authenticate* method in *LockOutRealm* where I
would have liked to first check if unlock_code is not null and then if yes
then would have called backend service to unlock the user first(which would
have also checked the password matching part) and then would have made a
call to instantiate *UserPrincipal*. I have the implementation of
*getPrincipal* method in another custom realm.
Is there anyway to pass other parameters apart from username and password
to *FormAuthenticator*(org.apache.catalina.authenticator.FormAuthenticator)?
Quick help/Any reference related to this scenario would be appreciated.
Re: Passing additional parameters using j_security_check (Form based authentication)
Posted by Neeraj Sinha <ne...@gmail.com>.
On 12 March 2014 20:40, Christopher Schultz <ch...@christopherschultz.net>wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Neeraj,
>
> On 3/12/14, 10:47 AM, Neeraj Sinha wrote:
> Thanks. Actually in the realm implementation, I make a call to backend
> authenticate () method which validates various login rules and if any of
> them fails, it returns false and the user is not allowed to login
> (GenericPrincipal object is instantiated with an invalid role) and is
> re-directed to login page. One of the rule is user account locking rule so
> user can not be authenticated successfully unless his/her user account is
> unlocked first so this solution won't work.
>
> Then you'll have to do your own "partial" authentication, process the
> reset code, then perform *formal* authentication (using
> request.authenticate()), then forward to wherever users should go
> after they reset their passwords.
>
> - -chris
>
Chris,
Thanks. What I am doing now is that I am processing the unlock code and
re-directing the request to my login page along with get parameter as
status based on which a message is displayed if the unlock was successful
and further allows user to login. Although the earlier implementation was
not like this but I have seen in couple of applications where this approach
is followed.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJTIHjsAAoJEBzwKT+lPKRYNo4P/jOQiQWlVFVu51i5KnpBGV5W
> HtjjnpJC6qU5Bu+MNqB2qcBeCJ6lTmlFZQ9fRSjL3CmDfkgBlApIoPebICMdGEoF
> wa9rNJljfkoUtUFpeas91rUwXXPYcKrlXFxelpemCHVu6EfoEVaFQh1s71e/gZrJ
> R5pkKSy4CWJxZ1R4GjuXadry39OvB5cjlnmLz8NpaNa337HrBe8EzsK/hmFBJjGB
> fUKORbxMszctpqzrQyaaRxkPwxw5duz8VaJ8kwimYXsMP4NmiNuX1xN8cDqxzJ2Z
> J23yqq0S9tIHbpGRIg867IHhbtSSyPv6tIihXdPZoNz7YwU9d7t8I0vut5c8kOzw
> JN5/wayIacqJTMuOHdwRr+n6RMw+RDgDMnlAXI/caUbXabCbdORDoo1CQlTs3wVv
> HeR0skCsRx2qDEnrLpnxrlrFwVbQiHBOpOH2yLi414YXdT203ndkmn9nSzCjOM5X
> uLF0yS2Q3MymFmJxaJrvmZwozf+LsNSUlTeVi+VQT7TSYHpL0CM15aCK+TCoYNtm
> bDsVNXoNKbsljGQzAO5iCPKdkQ845xBpMgl7uCrBA9bZT3hQXj8GcnZyBGyfsTYr
> TfhwzZK7DsA/lWXj3Bue50cv2w7pQUeo2FGjAGqkoYn4jwIIU7YlmnhKyMhSky+x
> OZXFwWvSplgE5F9zLBIP
> =iCrm
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Regards,
Neeraj
Re: Passing additional parameters using j_security_check (Form based
authentication)
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Neeraj,
On 3/12/14, 10:47 AM, Neeraj Sinha wrote:
Thanks. Actually in the realm implementation, I make a call to backend
authenticate () method which validates various login rules and if any of
them fails, it returns false and the user is not allowed to login
(GenericPrincipal object is instantiated with an invalid role) and is
re-directed to login page. One of the rule is user account locking rule so
user can not be authenticated successfully unless his/her user account is
unlocked first so this solution won't work.
Then you'll have to do your own "partial" authentication, process the
reset code, then perform *formal* authentication (using
request.authenticate()), then forward to wherever users should go
after they reset their passwords.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTIHjsAAoJEBzwKT+lPKRYNo4P/jOQiQWlVFVu51i5KnpBGV5W
HtjjnpJC6qU5Bu+MNqB2qcBeCJ6lTmlFZQ9fRSjL3CmDfkgBlApIoPebICMdGEoF
wa9rNJljfkoUtUFpeas91rUwXXPYcKrlXFxelpemCHVu6EfoEVaFQh1s71e/gZrJ
R5pkKSy4CWJxZ1R4GjuXadry39OvB5cjlnmLz8NpaNa337HrBe8EzsK/hmFBJjGB
fUKORbxMszctpqzrQyaaRxkPwxw5duz8VaJ8kwimYXsMP4NmiNuX1xN8cDqxzJ2Z
J23yqq0S9tIHbpGRIg867IHhbtSSyPv6tIihXdPZoNz7YwU9d7t8I0vut5c8kOzw
JN5/wayIacqJTMuOHdwRr+n6RMw+RDgDMnlAXI/caUbXabCbdORDoo1CQlTs3wVv
HeR0skCsRx2qDEnrLpnxrlrFwVbQiHBOpOH2yLi414YXdT203ndkmn9nSzCjOM5X
uLF0yS2Q3MymFmJxaJrvmZwozf+LsNSUlTeVi+VQT7TSYHpL0CM15aCK+TCoYNtm
bDsVNXoNKbsljGQzAO5iCPKdkQ845xBpMgl7uCrBA9bZT3hQXj8GcnZyBGyfsTYr
TfhwzZK7DsA/lWXj3Bue50cv2w7pQUeo2FGjAGqkoYn4jwIIU7YlmnhKyMhSky+x
OZXFwWvSplgE5F9zLBIP
=iCrm
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Passing additional parameters using j_security_check (Form based authentication)
Posted by Neeraj Sinha <ne...@gmail.com>.
Hi Chris,
On 12 March 2014 00:37, Christopher Schultz <ch...@christopherschultz.net>wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Neeraj,
>
> On 3/8/14, 2:06 AM, Neeraj Sinha wrote:
> > Chris,
> >
> > On 7 March 2014 21:43, Christopher Schultz
> > <ch...@christopherschultz.net>wrote:
> >
> > Neeraj,
> >
> > On 3/6/14, 4:34 AM, Neeraj Sinha wrote:
> >>>> I have a jsp application and my tomcat version is 7.0.34.
> >>>> Authentication is done using *Form based authentication.*
> >>>>
> >>>> My requirement is as follows:
> >>>>
> >>>> When user's account gets locked, he has to send a unlock
> >>>> request and he gets a link in his registered email id
> >>>> clicking on which takes him to unlocking page(let's say
> >>>> *unlock.jsp*) which has 3 fields namely*username*, *password*
> >>>> and *unlock_code* and a submit button. After submission, once
> >>>> unlocked successfully the user should land to home page of
> >>>> the application.
>
> How are you checking the username and password? If you are letting
> Tomcat check that, you could make unlock.jsp protected so that the URL
> points to https://..../unlock.jsp?code=[unlock_code]. After
> authentication, Tomcat will redirect the user to the original URL --
> which will include the unlock code.
>
> Thanks. Actually in the realm implementation, I make a call to backend
> authenticate () method which validates various login rules and if any of
> them fails, it returns false and the user is not allowed to login
> (GenericPrincipal object is instantiated with an invalid role) and is
> re-directed to login page. One of the rule is user account locking rule so
> user can not be authenticated successfully unless his/her user account is
> unlocked first so this solution won't work.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJTH18KAAoJEBzwKT+lPKRYXLQP/AzuccE3pEzq5yF4zCWnAZLf
> VFdzsBJSbIt+C0CJyAffQ7UCRzVEZDJuAFVF12AhRcfdOUbn3N85QLUHPJoWHo0y
> +EbwSc951iRgzeMexp6EgB9DfdltelxCt9gXmAdvpZ91jPAldyVPA6spAdlkUixh
> +hcz9JqVMcILhN0tU35NilqbxYMRRQiserGHXffyRoH5KkWyeACLDrYICLgW8ylg
> 2yIPtAkKv+Qr3CRintvGnBHVxf5WCQ76e4vo8dd81PC0Ds/KfNJ5qeSFPnIVND6V
> KmA46lfpxezT0BOFV3OSRzsTDRJ2T7ZeyjPcbSknm+2SqLIhS0L0zLLF9S/4FFr2
> qxIXeZV+AnVqPZBHCNhgCMGoK71recUULRqPcrWPpowgwom/rGyuzyuHD1epADa4
> 2Uumcw6DcbK6bhkDTFC+5wzeIFdddVKMP546FL3QeY6OlfnUyR8RE7WjqxXgVDOO
> Opti4wN7CHhEo9CzS4+IAOkJsghqXiiemuZvUgKcAuS5O5DiBiEtuc6uiDpT4H3S
> CaVEvhLX5VrJhD2ZkM2vZQS3v45BTSEmhr5EswE3n9/vknrRV1Vyh+nuyx/RoiIc
> M5id1+Gm/bS/3wVfcVrEyIavgwdj9gK9Lwl0DhexlWq4HCUVqRCsaNBcRR9qY/Tc
> jEU85sGWpjuH1N8vhhLJ
> =HOx2
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Regards,
Neeraj
Re: Passing additional parameters using j_security_check (Form based
authentication)
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Neeraj,
On 3/8/14, 2:06 AM, Neeraj Sinha wrote:
> Chris,
>
> On 7 March 2014 21:43, Christopher Schultz
> <ch...@christopherschultz.net>wrote:
>
> Neeraj,
>
> On 3/6/14, 4:34 AM, Neeraj Sinha wrote:
>>>> I have a jsp application and my tomcat version is 7.0.34.
>>>> Authentication is done using *Form based authentication.*
>>>>
>>>> My requirement is as follows:
>>>>
>>>> When user's account gets locked, he has to send a unlock
>>>> request and he gets a link in his registered email id
>>>> clicking on which takes him to unlocking page(let's say
>>>> *unlock.jsp*) which has 3 fields namely*username*, *password*
>>>> and *unlock_code* and a submit button. After submission, once
>>>> unlocked successfully the user should land to home page of
>>>> the application.
How are you checking the username and password? If you are letting
Tomcat check that, you could make unlock.jsp protected so that the URL
points to https://..../unlock.jsp?code=[unlock_code]. After
authentication, Tomcat will redirect the user to the original URL --
which will include the unlock code.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTH18KAAoJEBzwKT+lPKRYXLQP/AzuccE3pEzq5yF4zCWnAZLf
VFdzsBJSbIt+C0CJyAffQ7UCRzVEZDJuAFVF12AhRcfdOUbn3N85QLUHPJoWHo0y
+EbwSc951iRgzeMexp6EgB9DfdltelxCt9gXmAdvpZ91jPAldyVPA6spAdlkUixh
+hcz9JqVMcILhN0tU35NilqbxYMRRQiserGHXffyRoH5KkWyeACLDrYICLgW8ylg
2yIPtAkKv+Qr3CRintvGnBHVxf5WCQ76e4vo8dd81PC0Ds/KfNJ5qeSFPnIVND6V
KmA46lfpxezT0BOFV3OSRzsTDRJ2T7ZeyjPcbSknm+2SqLIhS0L0zLLF9S/4FFr2
qxIXeZV+AnVqPZBHCNhgCMGoK71recUULRqPcrWPpowgwom/rGyuzyuHD1epADa4
2Uumcw6DcbK6bhkDTFC+5wzeIFdddVKMP546FL3QeY6OlfnUyR8RE7WjqxXgVDOO
Opti4wN7CHhEo9CzS4+IAOkJsghqXiiemuZvUgKcAuS5O5DiBiEtuc6uiDpT4H3S
CaVEvhLX5VrJhD2ZkM2vZQS3v45BTSEmhr5EswE3n9/vknrRV1Vyh+nuyx/RoiIc
M5id1+Gm/bS/3wVfcVrEyIavgwdj9gK9Lwl0DhexlWq4HCUVqRCsaNBcRR9qY/Tc
jEU85sGWpjuH1N8vhhLJ
=HOx2
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Passing additional parameters using j_security_check (Form based authentication)
Posted by Neeraj Sinha <ne...@gmail.com>.
Chris,
On 7 March 2014 21:43, Christopher Schultz <ch...@christopherschultz.net>wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Neeraj,
>
> On 3/6/14, 4:34 AM, Neeraj Sinha wrote:
> > I have a jsp application and my tomcat version is 7.0.34.
> > Authentication is done using *Form based authentication.*
> >
> > My requirement is as follows:
> >
> > When user's account gets locked, he has to send a unlock request
> > and he gets a link in his registered email id clicking on which
> > takes him to unlocking page(let's say *unlock.jsp*) which has 3
> > fields namely*username*, *password* and *unlock_code* and a submit
> > button. After submission, once unlocked successfully the user
> > should land to home page of the application.
> >
> > Just to let you know, the main login page of the application is
> > *login.jsp* which is configured in *web.xml *and it is called
> > whenever any protected resource is requested. It has username and
> > password fields and it's action is *j_security_check*.
> >
> > Now my problem is how to pass unlock_code, the 3rd parameter of
> > *unlock.jsp* to *FormAuthenticator *using the action
> > *j_security_check*?
> >
> > I have implementations of *authenticate* method in *LockOutRealm*
> > where I would have liked to first check if unlock_code is not null
> > and then if yes then would have called backend service to unlock
> > the user first(which would have also checked the password matching
> > part) and then would have made a call to instantiate
> > *UserPrincipal*. I have the implementation of *getPrincipal* method
> > in another custom realm.
> >
> > Is there anyway to pass other parameters apart from username and
> > password to
> > *FormAuthenticator*(org.apache.catalina.authenticator.FormAuthenticator)?
> >
> > Quick help/Any reference related to this scenario would be
> > appreciated.
>
> This is not possible using Tomcat's built-in authenticators.
>
> This is something that is possible using securityfilter (a separate,
> open-source product you can find here:
> http://securityfilter.sourceforge.net/)
>
> It's a bit out of date but it works quite well. You can handle
> drive-by logins (those without an initial request to a protected page)
> and you can allow pass-through request parameters that will be sent-on
> to the "post-login" page as you are requesting.
>
> - -chris
>
Thanks. Actually I knew about the Securityfilter but probably it doesn't
support single sign-on several web application contexts. I need
to have single sign-on feature as well.
- - Neeraj
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJTGfAnAAoJEBzwKT+lPKRYk54QAKEM5C7qdy8ClEabhE3JmUIY
> B/7N6cABjoSXM41NutlxPKydlS09rTaYwKsDjb79m+K5RwH2r0Czd71DIZ6gyLxK
> X1UTrpxttZaiD/X83mngT4aYj+Rna/3zpJDLSXkdG3Ey0Od8SL8WAQEFP81VRD9x
> xHos3FHca/NzrzPvVx4Vm49OhItntAHjOxQce788r6HGDLvYMbbOH/s8M0nFel2v
> zd5YckVk/pxuGnVPBoXCLKjHw1CyOVZPlSCmjzBOgQWvfaTZtSCkU3CrF1EY5kdj
> i9wl/QEgWZYDSTxD8YFHe1ciZXsGGtNc2lo+6pvm7jJ9fpnTZ71oIj7PB0atpv0O
> 79iTzHjnDx1TNM3TTrsCqGy9vFG7X3+F2hCwo9a/C8F1hdVgQvMdt/3ICMh4PWT7
> +r5ZcikBW+SgW3RWepaE2WLEmlXicWsuyTp5oMu3lcczjxw0terXItjH5vB26ahE
> 04aw9VIOwxX1JMvvIKXDDirZZ4J6ngcZcvxBMEG5p1J1CVm0lnt/8DteNDolxhpk
> PVSm3I8j/CsRRoQDqEJn7kAti1tgnC85Noh+XEVyjdkPsAau4xr5dZR4fPc00Qby
> b3/B08nCHAKfywM67ZUiJS0F2AA+n7IW+Mufs1ClM1qUkjD8xtjadtbijeiD/1xa
> yhv59uhy1sYcBs7PmYan
> =XzKe
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Passing additional parameters using j_security_check (Form based
authentication)
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Neeraj,
On 3/6/14, 4:34 AM, Neeraj Sinha wrote:
> I have a jsp application and my tomcat version is 7.0.34.
> Authentication is done using *Form based authentication.*
>
> My requirement is as follows:
>
> When user's account gets locked, he has to send a unlock request
> and he gets a link in his registered email id clicking on which
> takes him to unlocking page(let's say *unlock.jsp*) which has 3
> fields namely*username*, *password* and *unlock_code* and a submit
> button. After submission, once unlocked successfully the user
> should land to home page of the application.
>
> Just to let you know, the main login page of the application is
> *login.jsp* which is configured in *web.xml *and it is called
> whenever any protected resource is requested. It has username and
> password fields and it's action is *j_security_check*.
>
> Now my problem is how to pass unlock_code, the 3rd parameter of
> *unlock.jsp* to *FormAuthenticator *using the action
> *j_security_check*?
>
> I have implementations of *authenticate* method in *LockOutRealm*
> where I would have liked to first check if unlock_code is not null
> and then if yes then would have called backend service to unlock
> the user first(which would have also checked the password matching
> part) and then would have made a call to instantiate
> *UserPrincipal*. I have the implementation of *getPrincipal* method
> in another custom realm.
>
> Is there anyway to pass other parameters apart from username and
> password to
> *FormAuthenticator*(org.apache.catalina.authenticator.FormAuthenticator)?
>
> Quick help/Any reference related to this scenario would be
> appreciated.
This is not possible using Tomcat's built-in authenticators.
This is something that is possible using securityfilter (a separate,
open-source product you can find here:
http://securityfilter.sourceforge.net/)
It's a bit out of date but it works quite well. You can handle
drive-by logins (those without an initial request to a protected page)
and you can allow pass-through request parameters that will be sent-on
to the "post-login" page as you are requesting.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTGfAnAAoJEBzwKT+lPKRYk54QAKEM5C7qdy8ClEabhE3JmUIY
B/7N6cABjoSXM41NutlxPKydlS09rTaYwKsDjb79m+K5RwH2r0Czd71DIZ6gyLxK
X1UTrpxttZaiD/X83mngT4aYj+Rna/3zpJDLSXkdG3Ey0Od8SL8WAQEFP81VRD9x
xHos3FHca/NzrzPvVx4Vm49OhItntAHjOxQce788r6HGDLvYMbbOH/s8M0nFel2v
zd5YckVk/pxuGnVPBoXCLKjHw1CyOVZPlSCmjzBOgQWvfaTZtSCkU3CrF1EY5kdj
i9wl/QEgWZYDSTxD8YFHe1ciZXsGGtNc2lo+6pvm7jJ9fpnTZ71oIj7PB0atpv0O
79iTzHjnDx1TNM3TTrsCqGy9vFG7X3+F2hCwo9a/C8F1hdVgQvMdt/3ICMh4PWT7
+r5ZcikBW+SgW3RWepaE2WLEmlXicWsuyTp5oMu3lcczjxw0terXItjH5vB26ahE
04aw9VIOwxX1JMvvIKXDDirZZ4J6ngcZcvxBMEG5p1J1CVm0lnt/8DteNDolxhpk
PVSm3I8j/CsRRoQDqEJn7kAti1tgnC85Noh+XEVyjdkPsAau4xr5dZR4fPc00Qby
b3/B08nCHAKfywM67ZUiJS0F2AA+n7IW+Mufs1ClM1qUkjD8xtjadtbijeiD/1xa
yhv59uhy1sYcBs7PmYan
=XzKe
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org