You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Larry Zappeterrini <La...@SanchezProjects.com> on 2003/06/24 23:13:20 UTC
RE: Looking for ideas for action servlet checking for logged in u
ser.
Check out http://marc.theaimsgroup.com/?t=104454850300003&r=1&w=2 for a
possible solution.
-----Original Message-----
From: henrik.bentel@teradyne.com [mailto:henrik.bentel@teradyne.com]
Sent: Tuesday, June 24, 2003 4:59 PM
To: struts-user@jakarta.apache.org
Subject: Looking for ideas for action servlet checking for logged in
user.
I have a webapp which have several pages which require the user to be
logged in(have a httpSession with a "usercontainer" object stored) , and a
few pages that doesn't require a log in(the log-in page, references,
indexes...). All pages are fronted by actions.
My current solution is to check for valid login in every action class that
needs to protect its invocation. That seems tedious. I though about
extending the action servlet to do it, but then it would check for all
requests.
And I do want to distinguish between if the user is
authorized(isUSerInRole) and if he/she is even logged in, so I can't use
the role parameter in the action element.
My next idea is extending the action servlet pluss adding parameters that
can go into the action element in the struts-config.xml file.
(some thing like <action path="/doImportantAction" type="my.actionClass"
usersession="true"> )
This would require my action servlet to know about my userContainer stored
in the httpsession. Pluss modifying the struts-config file.
I haven't looked into how hard this is, figure I'd ask someone who's run
into this before.
Any other good approaches, or should I just stick with what I got?(check
individually in every action)
thanks,
Henrik Bentel
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
***************************************************************************
This electronic mail transmission contains confidential and/or privileged
information intended only for the person(s) named. Any use, distribution,
copying or disclosure by another person is strictly prohibited.
***************************************************************************
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Looking for ideas for action servlet checking for logged in user.
Posted by Erik Price <ep...@ptc.com>.
Adam Hardy wrote:
> Erik Price wrote:
>
>>> I would use container-managed security. All the secured pages should
>>> go in a directory which is the target of a security constraint in the
>>> deployment descriptor. This forces the user to log in when trying to
>>> access any secured pages. In the actions where a user-object is
>>> required, this can be retrieved on demand using the user-name from
>>> the login, and then stored in the session.
>>
>>
>>
>> I don't think you even have to store the username in the session, you
>> can grab it using request.getUserPrincipal().
>>
>
> Oh yes, sure, but what I meant was some bean or other containing info
> about the user, more than just the login name. Like ID or date-of-birth.
Oh I see what you mean, a User object of some sort. Right.
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Looking for ideas for action servlet checking for logged in user.
Posted by Adam Hardy <ah...@cyberspaceroad.com>.
Erik Price wrote:
>> I would use container-managed security. All the secured pages should
>> go in a directory which is the target of a security constraint in the
>> deployment descriptor. This forces the user to log in when trying to
>> access any secured pages. In the actions where a user-object is
>> required, this can be retrieved on demand using the user-name from the
>> login, and then stored in the session.
>
>
> I don't think you even have to store the username in the session, you
> can grab it using request.getUserPrincipal().
>
Oh yes, sure, but what I meant was some bean or other containing info
about the user, more than just the login name. Like ID or date-of-birth.
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Looking for ideas for action servlet checking for logged in user.
Posted by Erik Price <ep...@ptc.com>.
Adam Hardy wrote:
> I would use container-managed security. All the secured pages should go
> in a directory which is the target of a security constraint in the
> deployment descriptor. This forces the user to log in when trying to
> access any secured pages. In the actions where a user-object is
> required, this can be retrieved on demand using the user-name from the
> login, and then stored in the session.
I don't think you even have to store the username in the session, you
can grab it using request.getUserPrincipal().
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Looking for ideas for action servlet checking for logged in user.
Posted by Jing Zhou <ji...@netspread.com>.
----- Original Message -----
From: "Adam Hardy" <ah...@cyberspaceroad.com>
To: "Struts Users Mailing List" <st...@jakarta.apache.org>
Sent: Wednesday, June 25, 2003 4:13 AM
Subject: Re: Looking for ideas for action servlet checking for logged in
user.
> I would use container-managed security. All the secured pages should go
> in a directory which is the target of a security constraint in the
> deployment descriptor. This forces the user to log in when trying to
> access any secured pages. In the actions where a user-object is
> required, this can be retrieved on demand using the user-name from the
> login, and then stored in the session.
What I am doing is, yes, everything is under security constraints and when
the user logins, an action tracking object is created to maintain the user
related objects. The action tracking is stored in the user's session. When
the user logout, the action tracking is cleared and removed from the
user's session. The action tracking has a lot other responsibilities.
>
> hth
> Adam
>
Jing
> Jing Zhou wrote:
> > ----- Original Message -----
> > From: "Larry Zappeterrini" <La...@SanchezProjects.com>
> > To: "'Struts Users Mailing List'" <st...@jakarta.apache.org>
> > Sent: Tuesday, June 24, 2003 4:13 PM
> > Subject: RE: Looking for ideas for action servlet checking for logged in
> > user.
> >
> >
> >
> >>Check out http://marc.theaimsgroup.com/?t=104454850300003&r=1&w=2 for a
> >>possible solution.
> >>
> >>-----Original Message-----
> >>From: henrik.bentel@teradyne.com [mailto:henrik.bentel@teradyne.com]
> >>Sent: Tuesday, June 24, 2003 4:59 PM
> >>To: struts-user@jakarta.apache.org
> >>Subject: Looking for ideas for action servlet checking for logged in
> >>user.
> >>
> >>
> >>I have a webapp which have several pages which require the user to be
> >>logged in(have a httpSession with a "usercontainer" object stored) , and
a
> >>few pages that doesn't require a log in(the log-in page, references,
> >>indexes...). All pages are fronted by actions.
> >>My current solution is to check for valid login in every action class
that
> >>needs to protect its invocation. That seems tedious. I though about
> >>extending the action servlet to do it, but then it would check for all
> >>requests.
> >>And I do want to distinguish between if the user is
> >>authorized(isUSerInRole) and if he/she is even logged in, so I can't use
> >>the role parameter in the action element.
> >>
> >>My next idea is extending the action servlet pluss adding parameters
that
> >>can go into the action element in the struts-config.xml file.
> >>(some thing like <action path="/doImportantAction" type="my.actionClass"
> >>usersession="true"> )
> >>This would require my action servlet to know about my userContainer
stored
> >>in the httpsession. Pluss modifying the struts-config file.
> >>I haven't looked into how hard this is, figure I'd ask someone who's run
> >>into this before.
> >>
> >>Any other good approaches, or should I just stick with what I got?(check
> >>individually in every action)
> >
> >
> > Yes. So far so good. One possible improvement is that you put all of
> > the checking codes into a base class of your action classes. Then you
> > extend the action mapping to provide additional attributes that allow
> > the checking codes to configure themselves dynamically for the
> > corresponding actions, e.g. the usersession attribute.
> >
> >
> >>thanks,
> >>Henrik Bentel
> >>
> >>
> >
> >
> > Jing
> >
> >
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: struts-user-help@jakarta.apache.org
> >>
> >>
> >>
> >
> >
***************************************************************************
> >
> >>This electronic mail transmission contains confidential and/or
privileged
> >>information intended only for the person(s) named. Any use,
distribution,
> >>copying or disclosure by another person is strictly prohibited.
> >>
> >
> >
***************************************************************************
> >
> >>
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: struts-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: struts-user-help@jakarta.apache.org
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Looking for ideas for action servlet checking for logged in user.
Posted by Adam Hardy <ah...@cyberspaceroad.com>.
I would use container-managed security. All the secured pages should go
in a directory which is the target of a security constraint in the
deployment descriptor. This forces the user to log in when trying to
access any secured pages. In the actions where a user-object is
required, this can be retrieved on demand using the user-name from the
login, and then stored in the session.
hth
Adam
Jing Zhou wrote:
> ----- Original Message -----
> From: "Larry Zappeterrini" <La...@SanchezProjects.com>
> To: "'Struts Users Mailing List'" <st...@jakarta.apache.org>
> Sent: Tuesday, June 24, 2003 4:13 PM
> Subject: RE: Looking for ideas for action servlet checking for logged in
> user.
>
>
>
>>Check out http://marc.theaimsgroup.com/?t=104454850300003&r=1&w=2 for a
>>possible solution.
>>
>>-----Original Message-----
>>From: henrik.bentel@teradyne.com [mailto:henrik.bentel@teradyne.com]
>>Sent: Tuesday, June 24, 2003 4:59 PM
>>To: struts-user@jakarta.apache.org
>>Subject: Looking for ideas for action servlet checking for logged in
>>user.
>>
>>
>>I have a webapp which have several pages which require the user to be
>>logged in(have a httpSession with a "usercontainer" object stored) , and a
>>few pages that doesn't require a log in(the log-in page, references,
>>indexes...). All pages are fronted by actions.
>>My current solution is to check for valid login in every action class that
>>needs to protect its invocation. That seems tedious. I though about
>>extending the action servlet to do it, but then it would check for all
>>requests.
>>And I do want to distinguish between if the user is
>>authorized(isUSerInRole) and if he/she is even logged in, so I can't use
>>the role parameter in the action element.
>>
>>My next idea is extending the action servlet pluss adding parameters that
>>can go into the action element in the struts-config.xml file.
>>(some thing like <action path="/doImportantAction" type="my.actionClass"
>>usersession="true"> )
>>This would require my action servlet to know about my userContainer stored
>>in the httpsession. Pluss modifying the struts-config file.
>>I haven't looked into how hard this is, figure I'd ask someone who's run
>>into this before.
>>
>>Any other good approaches, or should I just stick with what I got?(check
>>individually in every action)
>
>
> Yes. So far so good. One possible improvement is that you put all of
> the checking codes into a base class of your action classes. Then you
> extend the action mapping to provide additional attributes that allow
> the checking codes to configure themselves dynamically for the
> corresponding actions, e.g. the usersession attribute.
>
>
>>thanks,
>>Henrik Bentel
>>
>>
>
>
> Jing
>
>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: struts-user-help@jakarta.apache.org
>>
>>
>>
>
> ***************************************************************************
>
>>This electronic mail transmission contains confidential and/or privileged
>>information intended only for the person(s) named. Any use, distribution,
>>copying or disclosure by another person is strictly prohibited.
>>
>
> ***************************************************************************
>
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: struts-user-help@jakarta.apache.org
>>
>>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Looking for ideas for action servlet checking for logged in user.
Posted by Jing Zhou <ji...@netspread.com>.
----- Original Message -----
From: "Larry Zappeterrini" <La...@SanchezProjects.com>
To: "'Struts Users Mailing List'" <st...@jakarta.apache.org>
Sent: Tuesday, June 24, 2003 4:13 PM
Subject: RE: Looking for ideas for action servlet checking for logged in
user.
> Check out http://marc.theaimsgroup.com/?t=104454850300003&r=1&w=2 for a
> possible solution.
>
> -----Original Message-----
> From: henrik.bentel@teradyne.com [mailto:henrik.bentel@teradyne.com]
> Sent: Tuesday, June 24, 2003 4:59 PM
> To: struts-user@jakarta.apache.org
> Subject: Looking for ideas for action servlet checking for logged in
> user.
>
>
> I have a webapp which have several pages which require the user to be
> logged in(have a httpSession with a "usercontainer" object stored) , and a
> few pages that doesn't require a log in(the log-in page, references,
> indexes...). All pages are fronted by actions.
> My current solution is to check for valid login in every action class that
> needs to protect its invocation. That seems tedious. I though about
> extending the action servlet to do it, but then it would check for all
> requests.
> And I do want to distinguish between if the user is
> authorized(isUSerInRole) and if he/she is even logged in, so I can't use
> the role parameter in the action element.
>
> My next idea is extending the action servlet pluss adding parameters that
> can go into the action element in the struts-config.xml file.
> (some thing like <action path="/doImportantAction" type="my.actionClass"
> usersession="true"> )
> This would require my action servlet to know about my userContainer stored
> in the httpsession. Pluss modifying the struts-config file.
> I haven't looked into how hard this is, figure I'd ask someone who's run
> into this before.
>
> Any other good approaches, or should I just stick with what I got?(check
> individually in every action)
Yes. So far so good. One possible improvement is that you put all of
the checking codes into a base class of your action classes. Then you
extend the action mapping to provide additional attributes that allow
the checking codes to configure themselves dynamically for the
corresponding actions, e.g. the usersession attribute.
>
> thanks,
> Henrik Bentel
>
>
Jing
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>
>
***************************************************************************
> This electronic mail transmission contains confidential and/or privileged
> information intended only for the person(s) named. Any use, distribution,
> copying or disclosure by another person is strictly prohibited.
>
***************************************************************************
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org