You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Craig Edwards <ed...@au.ibm.com> on 2003/11/15 04:11:53 UTC
Redirecting after logon...
Some of my pages need the user to be logged on before they can be
viewed, so I have cobbled together some simple behaviour in my Action
superclass that forwards them to a logon page. Now, I need to send them
back to where they were originally trying to go before I redirected them
to logon. I have a couple of questions banging around in my head:
1. Should this redirection be performed by my RequestProcessor class or
by my Action superclass?
2. After they have logged on (in LogonAction), I need to return an
ActionForward object that takes them back to where they were trying to
go originally before I forced them to logon. However, I don't know how
to construct an ActionForward that contains everything it needs (for
example, what if their original request was a POST containing FORM data,
or was a URL like "/action/blah?id=123&a=b&c=d"... I want to preserve
and forward this info.)
3. I would have thought that nearly every web app would need this
behaviour, but both my struts textbooks give mickey-mouse examples, and
I can't find anything on the web that looks remotely like a real-world
example. Does anyone know of any real examples or advice that they
would care to share?
Many thanks...
--
Craig Edwards
Sydney, Australia
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Craig Edwards <ed...@au.ibm.com>.
In article <bp...@localhost.localdomain>,
cekvenich_vic@baseBeans.com says...
> You could do that... or you could do it the J2EE way, decleratively
> without any coding, letting container do it that way:
Thanks for the reply Vic. I can see how that would be the way to go if
I were starting from scratch. Unfortunately, I am using a framework
that has its own repository for users/roles and I don't think I will be
able to coerce it into operating within the J2EE Realm/LoginConfig
model.
Assuming that I have to build my own infrastructure to handle this, do
you have any more thoughts? I already have code that recognizes the
user isn't logged on and redirects them to logon... I am just missing
the step that sends back to where they were originally going.
Thanks again for the feedback.
--
Craig Edwards
Sydney, Australia
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Vic Cekvenich <ce...@baseBeans.com>.
You could do that... or you could do it the J2EE way, decleratively
without any coding, letting container do it that way:
Ex in web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure</web-resource-name>
<url-pattern>/do/loginPg/*</url-pattern>
<url-pattern>/do/newsBlgCmntAddPg/*</url-pattern>
<url-pattern>/do/userChngPg/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>VALID</role-name>
<role-name>ENHANCED</role-name>
<role-name>GUEST</role-name>
<role-name>EXPIRED</role-name>
<role-name>ADMIN</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/sLogin/login.jsp</form-login-page>
<form-error-page>/sLogin/loginBad.jsp</form-error-page>
</form-login-config>
</login-config>
Rob van Oostrum wrote:
> This might be more involved than you may think. The easy answer is to extend
> the RequestProcessor and add this functionality there. The hard answer is
> that you may not want to enable a user to just jump to any given page, only
> having to go through a login step to get there. You may very well need
> session data that gets built up in the course of a user session (think of
> multi-page forms and such). And yes I think this should on some level be
> part of Struts. It's too common for it not to be ...
>
>
> just my .02
> Rob
>
>
>>-----Original Message-----
>>From: Craig Edwards [mailto:edwardsc@au.ibm.com]
>>Sent: November 14, 2003 10:12 PM
>>To: struts-user@jakarta.apache.org
>>Subject: Redirecting after logon...
>>
>>
>>Some of my pages need the user to be logged on before they can be
>>viewed, so I have cobbled together some simple behaviour in my Action
>>superclass that forwards them to a logon page. Now, I need to send them
>>back to where they were originally trying to go before I redirected them
>>to logon. I have a couple of questions banging around in my head:
>>
>>1. Should this redirection be performed by my RequestProcessor class or
>>by my Action superclass?
>>
>>2. After they have logged on (in LogonAction), I need to return an
>>ActionForward object that takes them back to where they were trying to
>>go originally before I forced them to logon. However, I don't know how
>>to construct an ActionForward that contains everything it needs (for
>>example, what if their original request was a POST containing FORM data,
>>or was a URL like "/action/blah?id=123&a=b&c=d"... I want to preserve
>>and forward this info.)
>>
>>3. I would have thought that nearly every web app would need this
>>behaviour, but both my struts textbooks give mickey-mouse examples, and
>>I can't find anything on the web that looks remotely like a real-world
>>example. Does anyone know of any real examples or advice that they
>>would care to share?
>>
>>Many thanks...
>>
>>--
>>Craig Edwards
>>Sydney, Australia
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: struts-user-help@jakarta.apache.org
--
Victor Cekvenich,
Struts Instructor
(215) 321-9146
Advanced Struts Training
<http://basebeans.com/do/cmsPg?content=TRAINING> Server Side Java
training with Rich UI, mentoring, designs, samples and project recovery
in North East.
Simple best practice basic Portal, a Struts CMS, Membership, Forums,
Shopping and Credit processing, <http://basicportal.com> software, ready
to develop/customize; requires a db to run.
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Craig Edwards <ed...@au.ibm.com>.
In article <02...@ozzy>, max@maxcooper.com
says...
> As long as you have users that have passwords, and that might be in zero or
> more roles, it should be relatively easy to write a realm implementation
> that would access your custom user information repository. That would allow
> you to make use of the J2EE container managed security system, which solves
> your problem about keeping POSTed request parameters across a login event.
> If there is any way this would work, it seems likely to be the best (least
> work, most rubust, has some positive side effects) way to go.
It does sound like the "right" way to go... however, I have two
reservations:
1. As I understand it, have to have hard coded role names in the web.xml
file. For example:
<auth-constraint>
<role-name>XXXX</role-name>
</auth-constraint>
This means that anytime I create new roles, I have to update two places.
Given that I probably won't be doing that too often, that may not be a
problem.
2. I am only just learning Struts and the notion of writing a Realm
implementation would be yet another thing I have to come to grips with
before being able to build application functionality. I'm wary of
overengineering at this tender stage...
Having said all that, in trying to describe my problem I think I can
clarify it by saying:
- If a user requests a "private" page, the framework should authenticate
them and then redirect them to the private page.
- If a user requests a page for which they are not authorized, they will
be redirected to a static "not authorized" page.
Perhaps I can create one J2EE role called LOGGEDON and use container
managed security to handle the redirection. This way, I can use J2EE to
deal with *authentication*, but I can still manage *authorisation*
within my Action framework. Maybe...
--
Craig Edwards
Sydney, Australia
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Max Cooper <ma...@maxcooper.com>.
"Craig Edwards" <ed...@au.ibm.com> wrote in message
news:MPG.1a22f5c2ca101451989681@news.basebeans.com...
> In article <bp...@localhost.localdomain>,
> cekvenich_vic@baseBeans.com says...
> > You could do that... or you could do it the J2EE way, decleratively
> > without any coding, letting container do it that way:
>
> Thanks for the reply Vic. I can see how that would be the way to go if
> I were starting from scratch. Unfortunately, I am using a framework
> that has its own repository for users/roles and I don't think I will be
> able to coerce it into operating within the J2EE Realm/LoginConfig
> model.
As long as you have users that have passwords, and that might be in zero or
more roles, it should be relatively easy to write a realm implementation
that would access your custom user information repository. That would allow
you to make use of the J2EE container managed security system, which solves
your problem about keeping POSTed request parameters across a login event.
If there is any way this would work, it seems likely to be the best (least
work, most rubust, has some positive side effects) way to go.
-Max
PS. It is likely that my mail client sucks (Outlook Express), but your
messages show up as Newsgroup postings rather than email messages, which
makes them a pain to reply to. Are you cross-posting to a newsgroup or
something?
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Susan Bradeen <Su...@softlanding.com>.
On 11/17/2003 12:11:37 PM Adam Hardy wrote:
> Sorry, I meant post
For this application, the user must be logged in before hitting any pages,
so I needed to only cover cases for when the user types in a URL from
outside the application. I didn't give that a thought, so I perhaps this
isn't too helpful in your (and the original poster's) case.
Susan
>
> On 11/17/2003 05:58 PM Kris Schneider wrote:
> > Just a note that ActionServlet only implements doGet and doPost so I
imagine
> > you'll get some sort of method-not-supported error (inherited from
> HttpServlet)
> > if you send it a PUT request.
> >
> > Quoting Adam Hardy <ah...@cyberspaceroad.com>:
> >>Susan,
> >>what about HTTP-put, where there are request parameters that are not in
> >>the query string?
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Adam Hardy <ah...@cyberspaceroad.com>.
Sorry, I meant post
On 11/17/2003 05:58 PM Kris Schneider wrote:
> Just a note that ActionServlet only implements doGet and doPost so I imagine
> you'll get some sort of method-not-supported error (inherited from HttpServlet)
> if you send it a PUT request.
>
> Quoting Adam Hardy <ah...@cyberspaceroad.com>:
>>Susan,
>>what about HTTP-put, where there are request parameters that are not in
>>the query string?
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Kris Schneider <kr...@dotech.com>.
Just a note that ActionServlet only implements doGet and doPost so I imagine
you'll get some sort of method-not-supported error (inherited from HttpServlet)
if you send it a PUT request.
Quoting Adam Hardy <ah...@cyberspaceroad.com>:
> On 11/17/2003 02:31 PM Susan Bradeen wrote:
> > I have been using the following for returning the user to their intended
> > URL after a login, and have had good luck with it ...
> >
> > ----- In the Base Action class -----
> > if (someCheckFor.loggedInUser() == null) {
> > StringBuffer goToPath = new StringBuffer(request.getServletPath());
> > if (request.getQueryString() != null) {
> > goToPath.append("?" + request.getQueryString()); }
> > request.setAttribute("userPath", goToPath.toString());
> > return mapping.findForward("login");
> > }
>
> Susan,
> what about HTTP-put, where there are request parameters that are not in
> the query string?
>
>
> Adam
> --
> struts 1.1 + tomcat 5.0.12 + java 1.4.2
> Linux 2.4.20 RH9
--
Kris Schneider <ma...@dotech.com>
D.O.Tech <http://www.dotech.com/>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Adam Hardy <ah...@cyberspaceroad.com>.
On 11/17/2003 02:31 PM Susan Bradeen wrote:
> I have been using the following for returning the user to their intended
> URL after a login, and have had good luck with it ...
>
> ----- In the Base Action class -----
> if (someCheckFor.loggedInUser() == null) {
> StringBuffer goToPath = new StringBuffer(request.getServletPath());
> if (request.getQueryString() != null) {
> goToPath.append("?" + request.getQueryString()); }
> request.setAttribute("userPath", goToPath.toString());
> return mapping.findForward("login");
> }
Susan,
what about HTTP-put, where there are request parameters that are not in
the query string?
Adam
--
struts 1.1 + tomcat 5.0.12 + java 1.4.2
Linux 2.4.20 RH9
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Susan Bradeen <Su...@softlanding.com>.
I have been using the following for returning the user to their intended
URL after a login, and have had good luck with it ...
----- In the Base Action class -----
if (someCheckFor.loggedInUser() == null) {
StringBuffer goToPath = new StringBuffer(request.getServletPath());
if (request.getQueryString() != null) {
goToPath.append("?" + request.getQueryString()); }
request.setAttribute("userPath", goToPath.toString());
return mapping.findForward("login");
}
----- In the LoginSetup Action -----
loginForm.setPreviousAction((String)request.getAttribute("userPath"));
----- In the Login.jsp -----
<html:hidden property="userPath"/>
----- In the LoginSave Action -----
if ((loginForm.getUserPath() != null) &&
((loginForm.getUserPath().length()) > 0)) {
return new ActionForward(loginForm.getUserPath());
}
You can change the last line "return new ActionForward" to be a redirect.
Hope that helps,
Susan
On 11/17/2003 07:36:48 AM Adam Hardy wrote:
> On 11/17/2003 05:29 AM Craig Edwards wrote:
> > To complete process X, the user has to perform 5 steps. The user can
> > perform steps 1, 2 and 3 with or without being logged on, but they must
> > be logged on to perform steps 4 and 5. Obviously, I can have a
specific
> > check in step 4, but I would like, say, easily change the logon
> > requirement to instead be in step 3. Basically, I would like to be
able
> > to specify for each page whether the user has to be logged in.
> >
>
> Craig,
> I thought about this myself for implementing more or less the same
> thing, and decided but haven't yet tried saving the user's ActionForm
> that has all the request parameters already.
>
> I would put it in the session under a particular key, and then check
> whether the key contains a valid form at the start of each action, and
> if so, i.e. after the login & redirect back to the originally requested
> destination, take the ActionForm out of the session and overwrite the
> new one.
>
> bear in mind I haven't tried it so there might be some gotcha lurking
> there to prevent this from working.
>
> HTH
> Adam
>
> --
> struts 1.1 + tomcat 5.0.12 + java 1.4.2
> Linux 2.4.20 RH9
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Redirecting after logon...
Posted by Adam Hardy <ah...@cyberspaceroad.com>.
On 11/17/2003 05:29 AM Craig Edwards wrote:
> To complete process X, the user has to perform 5 steps. The user can
> perform steps 1, 2 and 3 with or without being logged on, but they must
> be logged on to perform steps 4 and 5. Obviously, I can have a specific
> check in step 4, but I would like, say, easily change the logon
> requirement to instead be in step 3. Basically, I would like to be able
> to specify for each page whether the user has to be logged in.
>
Craig,
I thought about this myself for implementing more or less the same
thing, and decided but haven't yet tried saving the user's ActionForm
that has all the request parameters already.
I would put it in the session under a particular key, and then check
whether the key contains a valid form at the start of each action, and
if so, i.e. after the login & redirect back to the originally requested
destination, take the ActionForm out of the session and overwrite the
new one.
bear in mind I haven't tried it so there might be some gotcha lurking
there to prevent this from working.
HTH
Adam
--
struts 1.1 + tomcat 5.0.12 + java 1.4.2
Linux 2.4.20 RH9
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
RE: Redirecting after logon...
Posted by Craig Edwards <ed...@au.ibm.com>.
In article <CO...@springwellfarms.ca>,
lists@springwellfarms.ca says...
> This might be more involved than you may think. The easy answer is to extend
> the RequestProcessor and add this functionality there. The hard answer is
> that you may not want to enable a user to just jump to any given page, only
> having to go through a login step to get there. You may very well need
> session data that gets built up in the course of a user session (think of
> multi-page forms and such).
You raise a good point, however, jumping to an arbitrary page of a
process (even if they are already logged on) is something I have to
handle in any case. A more specific scenario might be something along
the lines of:
To complete process X, the user has to perform 5 steps. The user can
perform steps 1, 2 and 3 with or without being logged on, but they must
be logged on to perform steps 4 and 5. Obviously, I can have a specific
check in step 4, but I would like, say, easily change the logon
requirement to instead be in step 3. Basically, I would like to be able
to specify for each page whether the user has to be logged in.
As Vic suggested, web.xml provides some assistance in this area via
<login-config>, but I am reusing an existing framework that already has
user/role behaviour that I need to plug in. Thanks again.
--
Craig Edwards
Sydney, Australia
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
RE: Redirecting after logon...
Posted by Rob van Oostrum <li...@springwellfarms.ca>.
This might be more involved than you may think. The easy answer is to extend
the RequestProcessor and add this functionality there. The hard answer is
that you may not want to enable a user to just jump to any given page, only
having to go through a login step to get there. You may very well need
session data that gets built up in the course of a user session (think of
multi-page forms and such). And yes I think this should on some level be
part of Struts. It's too common for it not to be ...
just my .02
Rob
> -----Original Message-----
> From: Craig Edwards [mailto:edwardsc@au.ibm.com]
> Sent: November 14, 2003 10:12 PM
> To: struts-user@jakarta.apache.org
> Subject: Redirecting after logon...
>
>
> Some of my pages need the user to be logged on before they can be
> viewed, so I have cobbled together some simple behaviour in my Action
> superclass that forwards them to a logon page. Now, I need to send them
> back to where they were originally trying to go before I redirected them
> to logon. I have a couple of questions banging around in my head:
>
> 1. Should this redirection be performed by my RequestProcessor class or
> by my Action superclass?
>
> 2. After they have logged on (in LogonAction), I need to return an
> ActionForward object that takes them back to where they were trying to
> go originally before I forced them to logon. However, I don't know how
> to construct an ActionForward that contains everything it needs (for
> example, what if their original request was a POST containing FORM data,
> or was a URL like "/action/blah?id=123&a=b&c=d"... I want to preserve
> and forward this info.)
>
> 3. I would have thought that nearly every web app would need this
> behaviour, but both my struts textbooks give mickey-mouse examples, and
> I can't find anything on the web that looks remotely like a real-world
> example. Does anyone know of any real examples or advice that they
> would care to share?
>
> Many thanks...
>
> --
> Craig Edwards
> Sydney, Australia
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org