You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@tomcat.apache.org by ap...@dsl.pipex.com on 2011/10/04 18:43:37 UTC

Using multiple login pages

Hello

I have a realm defined as follows in my application's web.xml file:

<login-config>
       <auth-method>FORM</auth-method>
       <realm-name>Form-Based Authentication Area</realm-name>
       <form-login-config>            
           <form-login-page>/jsp/security/protected/login.jsp</form-login-page>
           <form-error-page>/jsp/security/protected/error.jsp</form-error-page>
       </form-login-config>
</login-config>

Which means that all users must log in from the page ...login.jsp.

But is it possible with Tomcat 6.0.26 for multiple login pages to be specified? And could this be 
combined with specifying several welcome pages depending upon which login page I use? 

For example:

loginPageA.jsp calls index.jsp
loginPageB.jsp calls doThis.jsp
loginPageC.jsp calls doThat.jsp

Thanks

Martin O'Shea.
-- 


-------------------------------------------------
Visit Pipex Business: The homepage for UK Small Businesses

Go to http://www.pipex.co.uk/business-services


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Using multiple login pages

Posted by Christopher Schultz <ch...@christopherschultz.net>.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

André,

On 10/4/2011 2:01 PM, André Warnier wrote:
> Christopher Schultz wrote: ...
> 
> (I agree with what precedes this)
>> 
>> So, you can sniff the original request URI and serve-up whatever 
>> flavor of login page you want.
> 
> But with declarative security, that's kind of hard to do, no ? 
> Can't do that with a Servlet Filter.

Something like this:

<form-login-page>/login.jsp</form-login-page>

login.jsp:

<%
  if(original_uri.equals("/one_thing"))
  {
    dispatcher.include("/login_form_A.jsp");
  }
  else if(original_uri.equals("/another_thing"))
  {
    dispatcher.include("/login_form_B.jsp");
  }
  else
  {
   dispatcher.include("/login_form_default.jsp");
  }
%>

That's not terribly difficult to do. You can use whatever logic you want.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6LVRAACgkQ9CaO5/Lv0PCn6QCgl/ncRiyICo1reGjEi7kK9x+S
xh4AoIdC5yS+fX6AnbUP3Z4sn5N81yLU
=jvTt
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Using multiple login pages

Posted by Christopher Schultz <ch...@christopherschultz.net>.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin,

On 10/4/2011 2:06 PM, appy74@dsl.pipex.com wrote:
> Not sure about which version of security I will use but I would
> like to accommodate MD5 verification into things.

Note that MD5 doesn't verify anything. It's just a hashing function that
can be used to fingerprint data. I highly recommend:

a. Switching to another hash function if you can: MD5 kind of sucks
b. Limit the amount of data that can be hashed by some reasonable amount
   (we use a 4096-character limit on passwords)
c. Salt your hashes in case someone steals your password database
   (Tomcat's realms are not sufficient for this: you'll have to build
    your own)

Tomcat's realms are all capable of hashing credentials based upon any
available hashing algorithm to the JVM.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6LVlAACgkQ9CaO5/Lv0PBLsgCeMfQ1lCblNw0lJwHnaK+FnmUK
zHEAn07N25ffZv5kwr679pk+zcIh6fOz
=/oVk
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org