You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by David Thexton <da...@consultants.co.nz> on 2000/05/03 12:45:27 UTC
Broken req.getUserPrincipal().getName() with form based authentication?
When using form based authentication the user principal appears not to
be properly assigned. As far as I can make out from the spec's it
should be.
The work unencoding the response appears to have already been done in
the SecurityCheck class and so the easiest way would seem to be to
return that response. The code currently repeats the section for basic
authentication from SecurityCheck only.
I may well be wrong... Please let me know if I am.
And am I correct in assuming the form login error page doesn't work
yet? If so, is it something likely to be easy to fix or will someone
else fix it soon :)
Regards,
David Thexton.
Index:
src/share/org/apache/tomcat/core/SimpleRequestSecurityProviderImpl.java
===================================================================
RCS file:
/home/cvspublic/jakarta-tomcat/src/share/org/apache/tomcat/core/SimpleRequestSecurityProviderImpl.java,v
retrieving revision 1.1
diff -r1.1 SimpleRequestSecurityProviderImpl.java
149,154c149
< Principal principal = null;
< String remoteUser = getUserName(req);
< if (remoteUser != null) {
< principal = new SimplePrincipal(remoteUser);
< }
< return principal;
---
> return new SimplePrincipal(getUserName(req));
178,188c173
< String userName = null;
< String authorization = req.getHeader("Authorization");
< if (authorization != null && authorization.startsWith("Basic
")) {
< authorization = authorization.substring(6).trim();
< String unencoded = base64Decode(authorization);
< int colon = unencoded.indexOf(':');
< if (colon > 0) {
< userName = unencoded.substring(0, colon);
< }
< }
< return userName;
---
> return req.getRemoteUser();
Re: Fixed form-error-page - was "Broken req.getUserPrincipal().getName()
with form based authentication?"
Posted by David Thexton <da...@consultants.co.nz>.
As I received no replies here I was forced to do the investigation and
work myself!
I came up with the following patches, which may or may not be sensible,
but sort-of appear to work...
Index: src/share/org/apache/tomcat/request/SecurityCheck.java
===================================================================
RCS file:
/home/cvspublic/jakarta-tomcat/src/share/org/apache/tomcat/request/SecurityCheck.java,v
retrieving revision 1.15
diff -r1.15 SecurityCheck.java
228a229
> req.setAttribute("error_page", new Boolean(true));
Index: src/share/org/apache/tomcat/servlets/AuthServlet.java
===================================================================
RCS file:
/home/cvspublic/jakarta-tomcat/src/share/org/apache/tomcat/servlets/AuthServlet.java,v
retrieving revision 1.6
diff -r1.6 AuthServlet.java
90c90,97
< String page=ctx.getFormLoginPage();
---
> String page=null;
> Boolean errorPage=(Boolean)(req.getAttribute("error_page"));
> if((errorPage!=null) && errorPage.booleanValue()) {
> page=ctx.getFormErrorPage();
> req.removeAttribute("error_page");
> } else {
> page=ctx.getFormLoginPage();
> }
Index: src/share/org/apache/tomcat/servlets/JSecurityCheck.java
===================================================================
RCS file:
/home/cvspublic/jakarta-tomcat/src/share/org/apache/tomcat/servlets/JSecurityCheck.java,v
retrieving revision 1.2
diff -r1.2 JSecurityCheck.java
92,93c92,95
< session.setAttribute( "j_username", username );
< session.setAttribute( "j_password", password );
---
> if(username!=null)
> session.setAttribute( "j_username", username );
> if(password!=null)
> session.setAttribute( "j_password", password );
Seems simple enough (the first patch setting a flag to indicate an error
on login has occurred, the second deciding between the login and error
page and the third fixing a lack of of checking whether the j_username
and j_password fields have been supplied), but I'm not sure if the
Request object is the appropriate place for me to be placing such
information.
Help (although the patches seem to be good...)!?
Please either use these patches or let me know where to investigate
further. I'm doing this for a project that requires a stable reference
servlet engine - so I need the fixes implemented eventually - well
fairly
soon actually...
This allows the error page to act as a login page too. I haven't
figured out if Tomcat or the servlet specifications allow the
already supplied username and password (from the login page) to
be optionally reused (without requiring re-entry on the error page)
yet.
> When using form based authentication the user principal appears not to
> be properly assigned. As far as I can make out from the spec's it
> should be.
>
> Index:
> src/share/org/apache/tomcat/core/SimpleRequestSecurityProviderImpl.java
> ===================================================================
> RCS file:
> /home/cvspublic/jakarta-tomcat/src/share/org/apache/tomcat/core/SimpleRequestSecurityProviderImpl.java,v
> retrieving revision 1.1
> diff -r1.1 SimpleRequestSecurityProviderImpl.java
> 149,154c149
> < Principal principal = null;
> < String remoteUser = getUserName(req);
> < if (remoteUser != null) {
> < principal = new SimplePrincipal(remoteUser);
> < }
> < return principal;
> ---
> > return new SimplePrincipal(getUserName(req));
> 178,188c173
> < String userName = null;
> < String authorization = req.getHeader("Authorization");
> < if (authorization != null && authorization.startsWith("Basic
> ")) {
> < authorization = authorization.substring(6).trim();
> < String unencoded = base64Decode(authorization);
> < int colon = unencoded.indexOf(':');
> < if (colon > 0) {
> < userName = unencoded.substring(0, colon);
> < }
> < }
> < return userName;
> ---
> > return req.getRemoteUser();
>
> The work unencoding the response appears to have already been done in
> the SecurityCheck class and so the easiest way would seem to be to
> return that response. The code currently repeats the section for basic
> authentication from SecurityCheck only.
>
> I may well be wrong... Please let me know if I am.
>
> And am I correct in assuming the form login error page doesn't work
> yet? If so, is it something likely to be easy to fix or will someone
> else fix it soon :)
> Regards,
> David Thexton.