You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Chris Ruegger <cr...@speakeasy.net> on 2004/01/12 15:52:43 UTC

handling form based authentication w/ remember-me cookie

I am using Struts and building a logon page to do Form-based authentication
under Tomcat. I want to also have a checkbox for the user to check that says
"remember me" so that I can send them a cookie.  I'm not sure how to "intercept"
the form values because I have to post to j_security_check. How can I get the
check-box value, set up the cookie, and send them to j_security_check with
struts?

Thanks

RE: handling form based authentication w/ remember-me cookie

Posted by Richard Hightower <rh...@arc-mind.com>.
I believe this is the easiest way....

Have the form login go to your own custom action.

Have your action forward to the j_security_check, passing the correct
request parameters.

Set the foward you setup that points to j_security_check to do a
redirect=true.

Rick Hightower
Developer

Struts/J2EE training -- http://www.arc-mind.com/strutsCourse.htm

Struts/J2EE consulting --
http://www.arc-mind.com/consulting.htm#StrutsMentoring

-----Original Message-----
From: Chris Ruegger [mailto:cruegger@speakeasy.net]
Sent: Monday, January 12, 2004 7:53 AM
To: Struts Users Mailing List
Subject: handling form based authentication w/ remember-me cookie


I am using Struts and building a logon page to do Form-based authentication
under Tomcat. I want to also have a checkbox for the user to check that says
"remember me" so that I can send them a cookie.  I'm not sure how to
"intercept"
the form values because I have to post to j_security_check. How can I get
the
check-box value, set up the cookie, and send them to j_security_check with
struts?

Thanks


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

RE: handling form based authentication w/ remember-me cookie

Posted by Richard Hightower <rh...@arc-mind.com>.
I believe this is the easiest way....

Have the form login go to your own custom action.

Have your action forward to the j_security_check, passing the correct
request parameters.

Set the foward you setup that points to j_security_check to do a
redirect=true.

Rick Hightower
Developer

Struts/J2EE training -- http://www.arc-mind.com/strutsCourse.htm

Struts/J2EE consulting --
http://www.arc-mind.com/consulting.htm#StrutsMentoring

-----Original Message-----
From: Chris Ruegger [mailto:cruegger@speakeasy.net]
Sent: Monday, January 12, 2004 7:53 AM
To: Struts Users Mailing List
Subject: handling form based authentication w/ remember-me cookie


I am using Struts and building a logon page to do Form-based authentication
under Tomcat. I want to also have a checkbox for the user to check that says
"remember me" so that I can send them a cookie.  I'm not sure how to
"intercept"
the form values because I have to post to j_security_check. How can I get
the
check-box value, set up the cookie, and send them to j_security_check with
struts?

Thanks


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Templates And Modules - Please HELP !!

Posted by Renato Romano <r....@set-network.com>.
I already used the struts <template> tags successfully, but I'm having
trouble now inside a "moduled" application. The problem is that the
template tags seems to insert the module prefix before the path of the
jsp template file, which I would not, also because I thought the jsp
pages could/should not necessarily fit into a module, but could be
shared between modules. Every part of the struts framework seem to allow
this (note for example the contextRelative attribute in struts-config),
but the template tag seem not to do so. One solution is to put my jsp
inside subdirectories with the same names as modules, but as I said I'd
like to share some jsp between modules... Should I pass to tiles ??? I
don't need a complicated templating library so i'd prefer to simply use
template taglibs, but if tiles helps ...
Any help is VERY appreciated.
Thanks 

Renato

____________________________________
Renato Romano
Sistemi e Telematica S.p.A.
Calata Grazie - Vial Al Molo Giano
16127 - GENOVA

e-mail: r.romano@set-network.com
Tel.:   010 2712603
_____________________________________



---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Struts Templates And Modules - Please HELP !!

Posted by Renato Romano <r....@set-network.com>.
I'm trying to use struts templates (not tiles) tags inside a module, but
I get a completely blank page and no errors. The paths of the resources
are correct, but it seems to me struts tries to find them by prefixing
the module name!! 
Any help is very appreciated.

Renato

____________________________________
Renato Romano
Sistemi e Telematica S.p.A.
Calata Grazie - Vial Al Molo Giano
16127 - GENOVA

e-mail: r.romano@set-network.com
Tel.:   010 2712603
_____________________________________



---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Re: handling form based authentication w/ remember-me cookie

Posted by Martin Gainty <mg...@hotmail.com>.
Add 1 Nota Bene:
"objects in request scope are lost on a redirect, but remain in scope after
a forward..."
-Martin

----- Original Message -----
From: "Matt Raible" <li...@raibledesigns.com>
To: "Struts Users Mailing List" <st...@jakarta.apache.org>
Sent: Tuesday, January 13, 2004 7:05 AM
Subject: Re: handling form based authentication w/ remember-me cookie


>
> On Jan 13, 2004, at 12:42 AM, Craig R. McClanahan wrote:
> >
> > Filters are *not* required to be invoked on j_security_check
> > invocations.  In
> > fact, Tomcat won't even enable the "j_security_check" url unless an
> > unauthenticated user accesses a protected resource.  Basically, I
> > believe there
> > is no guaranteed-to-be-portable way to implement "remember me"
> > functionality on
> > the server using container managed security.
> >
> > Craig
>
> The Filter I use is mapped to the location of the <form-login-page>.
> The solution I use does work on both Tomcat 4/5 and Resin, which is
> portable enough for me!  I did have to add
> <dispatcher>FORWARD</dispatcher> for Tomcat 5 and Resin, where the
> login page is displayed using a forward instead of a redirect.
>
> Matt
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Re: handling form based authentication w/ remember-me cookie

Posted by Matt Raible <li...@raibledesigns.com>.
On Jan 13, 2004, at 12:42 AM, Craig R. McClanahan wrote:
>
> Filters are *not* required to be invoked on j_security_check 
> invocations.  In
> fact, Tomcat won't even enable the "j_security_check" url unless an
> unauthenticated user accesses a protected resource.  Basically, I 
> believe there
> is no guaranteed-to-be-portable way to implement "remember me" 
> functionality on
> the server using container managed security.
>
> Craig

The Filter I use is mapped to the location of the <form-login-page>.  
The solution I use does work on both Tomcat 4/5 and Resin, which is 
portable enough for me!  I did have to add 
<dispatcher>FORWARD</dispatcher> for Tomcat 5 and Resin, where the 
login page is displayed using a forward instead of a redirect.

Matt


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Re: handling form based authentication w/ remember-me cookie

Posted by "Craig R. McClanahan" <cr...@apache.org>.
Quoting Matt Raible <li...@raibledesigns.com>:

> Remember Me functionality with j_security_check has worked fine for me. 
>   I just go to a LoginServlet from my loginForm, which sets cookies and 
> redirects to j_security_check.  Then I map a Filter to check for those 
> cookies and logs the user in appropriately.  More with code at:
> 
> http://www.mail-archive.com/tomcat-user@jakarta.apache.org/msg86636.html
> 
> Complete code is available in my AppFuse application at:
> 
> http://raibledesigns.com/wiki/Wiki.jsp?page=AppFuse
> 
> HTH,
> 
> Matt
> 

Filters are *not* required to be invoked on j_security_check invocations.  In
fact, Tomcat won't even enable the "j_security_check" url unless an
unauthenticated user accesses a protected resource.  Basically, I believe there
is no guaranteed-to-be-portable way to implement "remember me" functionality on
the server using container managed security.

Craig



> On Jan 12, 2004, at 8:41 PM, Max Cooper wrote:
> 
> > Dipak,
> >
> > Are you certain that the filter will be invoked on the 
> > /j_security_check
> > request when container-based security is used? I have not tested this, 
> > but
> > it would not surprise me to find that some containers do not execute 
> > filters
> > on /j_security_check requests. I don't know if the Servlet Spec says
> > anything about this case.
> >
> > Chris,
> >
> > Another alternative to the original problem of security with "remember 
> > me"
> > functionality will be available soon. A patch has been submitted to my
> > SecurityFilter project (http://www.securityfilter.org/) to support 
> > "remember
> > me" functionality. The integration should be complete soon, and a beta
> > release will be made available once the integration is complete.
> > SecurityFilter works very much like container-managed security 
> > otherwise,
> > including the configuration format (except that you declare the 
> > constraints
> > in a separate config file rather than web.xml).
> >
> > -Max
> >
> > ----- Original Message -----
> > From: "Parmar, Dipakkumar" <dp...@comcast.net>
> > To: "Struts Users Mailing List" <st...@jakarta.apache.org>
> > Sent: Monday, January 12, 2004 7:43 AM
> > Subject: RE: handling form based authentication w/ remember-me cookie
> >
> >
> >> Hi Chris,
> >>
> >> You can do this using Servlet Filter.  What you need to do is write
> >> postLoginFilter that maps to the j_security_check url.
> >>
> >> In doFilter method, you can write your post login code after
> >> j_security_check done is work.
> >>
> >> Something like:
> >> public void doFilter(.....)
> >>
> >> // let the j_security_check to do it's work
> >> chain.doFilter(request, response)
> >>
> >> // do you post login stuff here
> >>
> >> Regards,
> >> Dipak Parmar
> >>
> >>
> >>
> >> -----Original Message-----
> >> From: Chris Ruegger [mailto:cruegger@speakeasy.net]
> >> Sent: Monday, January 12, 2004 9:53 AM
> >> To: Struts Users Mailing List
> >> Subject: handling form based authentication w/ remember-me cookie
> >>
> >>
> >> I am using Struts and building a logon page to do Form-based
> > authentication
> >> under Tomcat. I want to also have a checkbox for the user to check 
> >> that
> > says
> >> "remember me" so that I can send them a cookie.  I'm not sure how to
> >> "intercept"
> >> the form values because I have to post to j_security_check. How can I 
> >> get
> >> the
> >> check-box value, set up the cookie, and send them to j_security_check 
> >> with
> >> struts?
> >>
> >> Thanks
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> >> For additional commands, e-mail: struts-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: struts-user-help@jakarta.apache.org
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
> 




---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Re: handling form based authentication w/ remember-me cookie

Posted by Matt Raible <li...@raibledesigns.com>.
Remember Me functionality with j_security_check has worked fine for me. 
  I just go to a LoginServlet from my loginForm, which sets cookies and 
redirects to j_security_check.  Then I map a Filter to check for those 
cookies and logs the user in appropriately.  More with code at:

http://www.mail-archive.com/tomcat-user@jakarta.apache.org/msg86636.html

Complete code is available in my AppFuse application at:

http://raibledesigns.com/wiki/Wiki.jsp?page=AppFuse

HTH,

Matt

On Jan 12, 2004, at 8:41 PM, Max Cooper wrote:

> Dipak,
>
> Are you certain that the filter will be invoked on the 
> /j_security_check
> request when container-based security is used? I have not tested this, 
> but
> it would not surprise me to find that some containers do not execute 
> filters
> on /j_security_check requests. I don't know if the Servlet Spec says
> anything about this case.
>
> Chris,
>
> Another alternative to the original problem of security with "remember 
> me"
> functionality will be available soon. A patch has been submitted to my
> SecurityFilter project (http://www.securityfilter.org/) to support 
> "remember
> me" functionality. The integration should be complete soon, and a beta
> release will be made available once the integration is complete.
> SecurityFilter works very much like container-managed security 
> otherwise,
> including the configuration format (except that you declare the 
> constraints
> in a separate config file rather than web.xml).
>
> -Max
>
> ----- Original Message -----
> From: "Parmar, Dipakkumar" <dp...@comcast.net>
> To: "Struts Users Mailing List" <st...@jakarta.apache.org>
> Sent: Monday, January 12, 2004 7:43 AM
> Subject: RE: handling form based authentication w/ remember-me cookie
>
>
>> Hi Chris,
>>
>> You can do this using Servlet Filter.  What you need to do is write
>> postLoginFilter that maps to the j_security_check url.
>>
>> In doFilter method, you can write your post login code after
>> j_security_check done is work.
>>
>> Something like:
>> public void doFilter(.....)
>>
>> // let the j_security_check to do it's work
>> chain.doFilter(request, response)
>>
>> // do you post login stuff here
>>
>> Regards,
>> Dipak Parmar
>>
>>
>>
>> -----Original Message-----
>> From: Chris Ruegger [mailto:cruegger@speakeasy.net]
>> Sent: Monday, January 12, 2004 9:53 AM
>> To: Struts Users Mailing List
>> Subject: handling form based authentication w/ remember-me cookie
>>
>>
>> I am using Struts and building a logon page to do Form-based
> authentication
>> under Tomcat. I want to also have a checkbox for the user to check 
>> that
> says
>> "remember me" so that I can send them a cookie.  I'm not sure how to
>> "intercept"
>> the form values because I have to post to j_security_check. How can I 
>> get
>> the
>> check-box value, set up the cookie, and send them to j_security_check 
>> with
>> struts?
>>
>> Thanks
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

RE: handling form based authentication w/ remember-me cookie

Posted by "Parmar, Dipakkumar" <dp...@comcast.net>.
Hi Max,

I haven't tested it either.  I read it about this in "IBM WebSphere V5.0
Security handbook (page 64)".

Regards,
Dipak Parmar


-----Original Message-----
From: Max Cooper [mailto:max@maxcooper.com]
Sent: Monday, January 12, 2004 10:42 PM
To: Struts Users Mailing List; dparmar@comcast.net
Subject: Re: handling form based authentication w/ remember-me cookie


Dipak,

Are you certain that the filter will be invoked on the /j_security_check
request when container-based security is used? I have not tested this, but
it would not surprise me to find that some containers do not execute filters
on /j_security_check requests. I don't know if the Servlet Spec says
anything about this case.

Chris,

Another alternative to the original problem of security with "remember me"
functionality will be available soon. A patch has been submitted to my
SecurityFilter project (http://www.securityfilter.org/) to support "remember
me" functionality. The integration should be complete soon, and a beta
release will be made available once the integration is complete.
SecurityFilter works very much like container-managed security otherwise,
including the configuration format (except that you declare the constraints
in a separate config file rather than web.xml).

-Max

----- Original Message -----
From: "Parmar, Dipakkumar" <dp...@comcast.net>
To: "Struts Users Mailing List" <st...@jakarta.apache.org>
Sent: Monday, January 12, 2004 7:43 AM
Subject: RE: handling form based authentication w/ remember-me cookie


> Hi Chris,
>
> You can do this using Servlet Filter.  What you need to do is write
> postLoginFilter that maps to the j_security_check url.
>
> In doFilter method, you can write your post login code after
> j_security_check done is work.
>
> Something like:
> public void doFilter(.....)
>
> // let the j_security_check to do it's work
> chain.doFilter(request, response)
>
> // do you post login stuff here
>
> Regards,
> Dipak Parmar
>
>
>
> -----Original Message-----
> From: Chris Ruegger [mailto:cruegger@speakeasy.net]
> Sent: Monday, January 12, 2004 9:53 AM
> To: Struts Users Mailing List
> Subject: handling form based authentication w/ remember-me cookie
>
>
> I am using Struts and building a logon page to do Form-based
authentication
> under Tomcat. I want to also have a checkbox for the user to check that
says
> "remember me" so that I can send them a cookie.  I'm not sure how to
> "intercept"
> the form values because I have to post to j_security_check. How can I get
> the
> check-box value, set up the cookie, and send them to j_security_check with
> struts?
>
> Thanks
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

Re: handling form based authentication w/ remember-me cookie

Posted by Max Cooper <ma...@maxcooper.com>.
Dipak,

Are you certain that the filter will be invoked on the /j_security_check
request when container-based security is used? I have not tested this, but
it would not surprise me to find that some containers do not execute filters
on /j_security_check requests. I don't know if the Servlet Spec says
anything about this case.

Chris,

Another alternative to the original problem of security with "remember me"
functionality will be available soon. A patch has been submitted to my
SecurityFilter project (http://www.securityfilter.org/) to support "remember
me" functionality. The integration should be complete soon, and a beta
release will be made available once the integration is complete.
SecurityFilter works very much like container-managed security otherwise,
including the configuration format (except that you declare the constraints
in a separate config file rather than web.xml).

-Max

----- Original Message ----- 
From: "Parmar, Dipakkumar" <dp...@comcast.net>
To: "Struts Users Mailing List" <st...@jakarta.apache.org>
Sent: Monday, January 12, 2004 7:43 AM
Subject: RE: handling form based authentication w/ remember-me cookie


> Hi Chris,
>
> You can do this using Servlet Filter.  What you need to do is write
> postLoginFilter that maps to the j_security_check url.
>
> In doFilter method, you can write your post login code after
> j_security_check done is work.
>
> Something like:
> public void doFilter(.....)
>
> // let the j_security_check to do it's work
> chain.doFilter(request, response)
>
> // do you post login stuff here
>
> Regards,
> Dipak Parmar
>
>
>
> -----Original Message-----
> From: Chris Ruegger [mailto:cruegger@speakeasy.net]
> Sent: Monday, January 12, 2004 9:53 AM
> To: Struts Users Mailing List
> Subject: handling form based authentication w/ remember-me cookie
>
>
> I am using Struts and building a logon page to do Form-based
authentication
> under Tomcat. I want to also have a checkbox for the user to check that
says
> "remember me" so that I can send them a cookie.  I'm not sure how to
> "intercept"
> the form values because I have to post to j_security_check. How can I get
> the
> check-box value, set up the cookie, and send them to j_security_check with
> struts?
>
> Thanks
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

RE: handling form based authentication w/ remember-me cookie

Posted by "Parmar, Dipakkumar" <dp...@comcast.net>.
Hi Chris,

You can do this using Servlet Filter.  What you need to do is write
postLoginFilter that maps to the j_security_check url.

In doFilter method, you can write your post login code after
j_security_check done is work.

Something like:
	public void doFilter(.....)

		// let the j_security_check to do it's work
		chain.doFilter(request, response)

		// do you post login stuff here

Regards,
Dipak Parmar



-----Original Message-----
From: Chris Ruegger [mailto:cruegger@speakeasy.net]
Sent: Monday, January 12, 2004 9:53 AM
To: Struts Users Mailing List
Subject: handling form based authentication w/ remember-me cookie


I am using Struts and building a logon page to do Form-based authentication
under Tomcat. I want to also have a checkbox for the user to check that says
"remember me" so that I can send them a cookie.  I'm not sure how to
"intercept"
the form values because I have to post to j_security_check. How can I get
the
check-box value, set up the cookie, and send them to j_security_check with
struts?

Thanks


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org