Custom Realm and Authenticator

[Zoltan Grose <zg...@pacbell.net>]

I've been working on a custom realm and have that working rather well 
but have run into an issue described earlier in this list ("Realm 
classes and ClassLoaders" - Mar 6, 2001). The following was the 
suggestion from Craig McClanahan. This sounds like a great solution 
except that FormAuthenticator is a final class. I could not find any 
follow-up articles on the subject in the archive. Any suggestions?

-zoltan

 > You would need to sublcass whichever authenticator
 > class you are using (such as
 > org.apache.catalina.authenticator.FormAuthenticator)
 > and override the authenticate() method, something
 > like this:
 >
 >     public boolean authenticate(HttpRequest request,
 >         HttpResponse response, LoginConfig config) {
 >
 >         if (!super.authenticate(request, response, config))
 >             return (false);
 >         MyPrincipal principal =
 >           (MyPrincipal) request.getUserPrincipal();
 >         if (principal == null) {
 >             // We are asking for the form login page
 >             return (true);
 >         } else {
 >             // Copy the stuff we need into the session
 >             HttpSession session =
 >               ((HttpServletRequest)request.getRequest).getSession();
 >             session.setAttribute("userStatus", principal.getStatus());
 >             ...
 >             return (true);
 >         }
 >
 >     }
 >
 > Note that the attributes you save need to be JDK
 > classes like String, because the user classes you store
 > in the server directory are not visible to web apps.

Pls fix JDBCRealm.java for CLIENT-CERT auth-method

[Kar YEOW <ka...@apir.com.au>]

Hi, after looking thru the source code I discovered that the JDBCRealm's
getPrincipal method is hard-coded to return null.  This has cause the
CLIENT-CERT with JDBCRealm to failed!  I have sucessfully do it the
MemoryRealm cause it return a user that match the certificate's subject
name.  I am just wondering if someone who have access to the source could
implement something similar to MemoryRealm.  TIA.
Kar

Re: How to set up multiple auth-method in single webapps

["Craig R. McClanahan" <cr...@apache.org>]

If you are using container-managed security, that is not possible -- you
must pick one and only one login method.

Craig


On Mon, 22 Oct 2001, Kar YEOW wrote:

> Date: Mon, 22 Oct 2001 12:45:10 +1000
> From: Kar YEOW <ka...@apir.com.au>
> Reply-To: tomcat-user@jakarta.apache.org, Kar YEOW <ka...@apir.com.au>
> To: tomcat-user@jakarta.apache.org
> Subject: How to set up multiple auth-method in single webapps
>
> Anyone?  TIA.
> Kar
>
>
>

How to set up multiple auth-method in single webapps

[Kar YEOW <ka...@apir.com.au>]

Anyone?  TIA.
Kar

401 - Cannot authenticate with the provided credentials

[Kar YEOW <ka...@apir.com.au>]

Hi, I am trying to use CLIENT-CERT auth-method and got the above error.
I have got SSL and client authentication working by pointing the browser to
https://blah.  I want to use CLIENT-CERT auth method so that I can use the
user and role specified in the web.xml.  Exactly how CLIENT-CERT auth-method
has to be setup?  Do I need to "match" the user name and the subject name in
the certificate?  Any help is appreciated.
Kar

Re: Custom Realm and Authenticator

["Craig R. McClanahan" <cr...@apache.org>]

On Thu, 18 Oct 2001, Zoltan Grose wrote:

> Date: Thu, 18 Oct 2001 23:52:01 -0700
> From: Zoltan Grose <zg...@pacbell.net>
> Reply-To: tomcat-user@jakarta.apache.org
> To: tomcat-user@jakarta.apache.org
> Subject: Custom Realm and Authenticator
>
> I've been working on a custom realm and have that working rather well
> but have run into an issue described earlier in this list ("Realm
> classes and ClassLoaders" - Mar 6, 2001). The following was the
> suggestion from Craig McClanahan. This sounds like a great solution
> except that FormAuthenticator is a final class. I could not find any
> follow-up articles on the subject in the archive. Any suggestions?
>

The "final" modifier does make things kind of tough ...

I just committed a patch to remove the "final" modifier on the HEAD branch
(i.e. what goes in to the nightly builds).  For 4.0, you could make a copy
of the existing source class and remove "final" yourself until you migrate
to a version where this has been fixed.

> -zoltan
>

Craig