You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Rick Mann <rm...@latencyzero.com> on 2002/05/29 00:52:44 UTC
Best way to forward to login, then re-forward to originally
requested resource?
I've got a typical struts application up and running. Certain actions check
to see if the user is logged in, and if not, forward to a login JSP. That
JSP then posts to a LoginAction. The LoginAction then forwards back to the
originally requested action.
The problem I have is that currently, this stuff is really hacked up. The
login JSP has a hidden field indicating the desired action, and the action
has to append a ".do" to that value, etc. The original action puts a request
attribute in (the result of it calling mapping.getPath()).
Surely, there is a much cleaner way to do this, one that works for both
Actions and JSPs, and that works without special code to handle the URL
mapping for actions.
TIA,
--
Rick
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Best way to forward to login, then re-forward to
originallyrequested resource?
Posted by Rick Mann <rm...@latencyzero.com>.
on 5/29/02 3:36 AM, Reinhard Nägele at reinhard.naegele@mgm-edv.de wrote:
>> session.setAttribute(REDIRECT_KEY, mapping);
>> return mapping.findForward("login");
>>
>>
>> In your login action, check if a mapping is in the session and go there:
>>
>> ActionMapping redirectMapping =
>> (ActionMapping) session.getAttribute(REDIRECT_KEY);
>> if (redirectMapping != null) {
>> session.removeAttribute(REDIRECT_KEY);
>> return new ActionForward(redirectMapping.getInput());
>> }
>
> Thank you. In retrospect, this is so incredibly obvious (storing the actual
> mapping object), I'm embarrassed to have had to ask it. Thank you very much.
Perhaps I spoke too soon. getInput() returns a null value when I type an URL
directly, and getPath() returns the path without the necessary adornments
(*.do). How can I get Struts to give me the right thing (or do the right
thing given a simple path)?
TIA,
--
Rick
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Best way to forward to login, then re-forward to
originallyrequested resource?
Posted by Rick Mann <rm...@latencyzero.com>.
on 5/29/02 3:36 AM, Reinhard Nägele at reinhard.naegele@mgm-edv.de wrote:
> session.setAttribute(REDIRECT_KEY, mapping);
> return mapping.findForward("login");
>
>
> In your login action, check if a mapping is in the session and go there:
>
> ActionMapping redirectMapping =
> (ActionMapping) session.getAttribute(REDIRECT_KEY);
> if (redirectMapping != null) {
> session.removeAttribute(REDIRECT_KEY);
> return new ActionForward(redirectMapping.getInput());
> }
Thank you. In retrospect, this is so incredibly obvious (storing the actual
mapping object), I'm embarrassed to have had to ask it. Thank you very much.
--
Rick
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Best way to forward to login, then re-forward to originallyrequested
resource?
Posted by Reinhard Nägele <re...@mgm-edv.de>.
Save mapping in session and go to login page:
session.setAttribute(REDIRECT_KEY, mapping);
return mapping.findForward("login");
In your login action, check if a mapping is in the session and go there:
ActionMapping redirectMapping =
(ActionMapping) session.getAttribute(REDIRECT_KEY);
if (redirectMapping != null) {
session.removeAttribute(REDIRECT_KEY);
return new ActionForward(redirectMapping.getInput());
}
Reinhard
Rick Mann wrote:
>on 5/28/02 11:59 PM, Adam Hardy at adam.hardy@cyberspaceroad.com wrote:
>
>
>
>>I wouild save the form bean and a mapping or action forward in the
>>session, and collect them when the in-between task is finished.
>>
>>
>
>Yeah, I was thinking of that, too.
>
>Okay, so here's the struts-specific problem: how do I get the name of the
>action in a way that I can use later to generate an ActionForward? If I call
>mapping.getPath(), I get the path used in the mapping, but it will be
>"outside" of the pattern set up in the deployment descriptor. Typically, it
>will not end in ".do".
>
>Right now, I do this:
>
>forward = new ActionForward();
>forward.setContextRelative(true);
>forward.setPath(originalResource + ".do");
>
>This works, but won't work if the original resource was a .jsp. (I'd like to
>put a tag at the top of a JSP to check for a valid login). In fact, it
>doesn't work in the general case (say the deployment action servlet mapping
>is "/action/*" instead of "*.do").
>
>Perhaps I just don't understand container-managed security well enough. How
>can I cause one of my User objects to be created in the session when the
>user gets authenticated? As far as what's provided by the server, it just
>sets a user name (and principal) available to servlets. I suppose I could
>look for the user, and if it's not found, create one based on the result of
>isUserInRole() et al., but it just seems less than elegant. I'll post a more
>general question to the Tomcat list.
>
>
>
>
--
Reinhard Nägele
MGM EDV-Beratung GmbH
Frankfurter Ring 105 a
80807 München
Tel.: +49 89 358680-817
Fax: +49 89 358680-88
E-Mail: reinhard.naegele@mgm-edv.de
Web: www.mgm-edv.de
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Best way to forward to login,
then re-forward to originally requested resource?
Posted by Alex Paransky <ap...@standardset.com>.
Rick,
I recently had a similar problem. Using J2EE security, I was not sure how
to "detect" a user login. After all, a user can go into ANY protected page,
and I did not want to put the same tag in to EVERY single .JSP page that was
protected.
The solution, at least in my case, came in a form a filter. I installed a
filter, which checks every single request to the server. For each request,
I check to see if the user is authenticated by retrieving the principal.
When I detect that the user has logged in, I perform some action, and note
in the session that this has been done before.
This works for me....
Here is my doFilter code:
final HttpServletRequest
request = (HttpServletRequest) req;
final HttpSession
session = request.getSession(false);
if (session != null && session.getAttribute(USER_LOGIN_CHECK) == null) {
final Principal principal = request.getUserPrincipal();
if (principal != null) {
session.setAttribute(USER_LOGIN_CHECK, new Boolean(true));
action.userLoggedIn(principal.getName(), req, res);
}
}
chain.doFilter(req, res);
-AP_
http://www.myprofiles.com/member/profile/apara_personal
-----Original Message-----
From: Rick Mann [mailto:rmann@latencyzero.com]
Sent: Wednesday, May 29, 2002 1:02 AM
To: Struts Users Mailing List
Subject: Re: Best way to forward to login, then re-forward to originally
requested resource?
on 5/28/02 11:59 PM, Adam Hardy at adam.hardy@cyberspaceroad.com wrote:
> I wouild save the form bean and a mapping or action forward in the
> session, and collect them when the in-between task is finished.
Yeah, I was thinking of that, too.
Okay, so here's the struts-specific problem: how do I get the name of the
action in a way that I can use later to generate an ActionForward? If I call
mapping.getPath(), I get the path used in the mapping, but it will be
"outside" of the pattern set up in the deployment descriptor. Typically, it
will not end in ".do".
Right now, I do this:
forward = new ActionForward();
forward.setContextRelative(true);
forward.setPath(originalResource + ".do");
This works, but won't work if the original resource was a .jsp. (I'd like to
put a tag at the top of a JSP to check for a valid login). In fact, it
doesn't work in the general case (say the deployment action servlet mapping
is "/action/*" instead of "*.do").
Perhaps I just don't understand container-managed security well enough. How
can I cause one of my User objects to be created in the session when the
user gets authenticated? As far as what's provided by the server, it just
sets a user name (and principal) available to servlets. I suppose I could
look for the user, and if it's not found, create one based on the result of
isUserInRole() et al., but it just seems less than elegant. I'll post a more
general question to the Tomcat list.
--
Rick
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Best way to forward to login, then re-forward to originally
requested resource?
Posted by Rick Mann <rm...@latencyzero.com>.
on 5/28/02 11:59 PM, Adam Hardy at adam.hardy@cyberspaceroad.com wrote:
> I wouild save the form bean and a mapping or action forward in the
> session, and collect them when the in-between task is finished.
Yeah, I was thinking of that, too.
Okay, so here's the struts-specific problem: how do I get the name of the
action in a way that I can use later to generate an ActionForward? If I call
mapping.getPath(), I get the path used in the mapping, but it will be
"outside" of the pattern set up in the deployment descriptor. Typically, it
will not end in ".do".
Right now, I do this:
forward = new ActionForward();
forward.setContextRelative(true);
forward.setPath(originalResource + ".do");
This works, but won't work if the original resource was a .jsp. (I'd like to
put a tag at the top of a JSP to check for a valid login). In fact, it
doesn't work in the general case (say the deployment action servlet mapping
is "/action/*" instead of "*.do").
Perhaps I just don't understand container-managed security well enough. How
can I cause one of my User objects to be created in the session when the
user gets authenticated? As far as what's provided by the server, it just
sets a user name (and principal) available to servlets. I suppose I could
look for the user, and if it's not found, create one based on the result of
isUserInRole() et al., but it just seems less than elegant. I'll post a more
general question to the Tomcat list.
--
Rick
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Best way to forward to login, then re-forward to originally requested
resource?
Posted by Adam Hardy <ad...@cyberspaceroad.com>.
I wouild save the form bean and a mapping or action forward in the
session, and collect them when the in-between task is finished.
Rick Mann wrote:
>on 5/28/02 5:19 PM, Alex Paransky at apara@standardset.com wrote:
>
>
>
>>Why not use J2EE/WEB standard container authentication? It will do what you
>>want. In fact, it was designed to do what you want, which is called Lazy,
>>or just in time, authentication. The user can surf your page, however, when
>>he links to a protected item, a login page (of your choosing) will be
>>displayed. After the user is authenticated, the proceeds to the protected
>>resource.
>>
>>
>
>Well, let's say for the sake of argument, that it's not authentication we're
>talking about. Let's say, instead, that in order to perform some Action B,
>some other Action A must be done first. However, doing A does not
>necessarily mean you'll do B next. What's the best way to "remember" that B
>was what the user wanted to do, but forward them to A first?
>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Best way to forward to login, then re-forward to originally
requested resource?
Posted by Rick Mann <rm...@latencyzero.com>.
on 5/28/02 5:19 PM, Alex Paransky at apara@standardset.com wrote:
> Why not use J2EE/WEB standard container authentication? It will do what you
> want. In fact, it was designed to do what you want, which is called Lazy,
> or just in time, authentication. The user can surf your page, however, when
> he links to a protected item, a login page (of your choosing) will be
> displayed. After the user is authenticated, the proceeds to the protected
> resource.
Well, let's say for the sake of argument, that it's not authentication we're
talking about. Let's say, instead, that in order to perform some Action B,
some other Action A must be done first. However, doing A does not
necessarily mean you'll do B next. What's the best way to "remember" that B
was what the user wanted to do, but forward them to A first?
--
Rick
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Best way to forward to login,
then re-forward to originally requested resource?
Posted by Alex Paransky <ap...@standardset.com>.
Why not use J2EE/WEB standard container authentication? It will do what you
want. In fact, it was designed to do what you want, which is called Lazy,
or just in time, authentication. The user can surf your page, however, when
he links to a protected item, a login page (of your choosing) will be
displayed. After the user is authenticated, the proceeds to the protected
resource.
-AP_
http://www.myprofiles.com/member/profile/apara_personal
-----Original Message-----
From: Rick Mann [mailto:rmann@latencyzero.com]
Sent: Tuesday, May 28, 2002 3:53 PM
To: Struts Users Mailing List
Subject: Best way to forward to login, then re-forward to originally
requested resource?
I've got a typical struts application up and running. Certain actions check
to see if the user is logged in, and if not, forward to a login JSP. That
JSP then posts to a LoginAction. The LoginAction then forwards back to the
originally requested action.
The problem I have is that currently, this stuff is really hacked up. The
login JSP has a hidden field indicating the desired action, and the action
has to append a ".do" to that value, etc. The original action puts a request
attribute in (the result of it calling mapping.getPath()).
Surely, there is a much cleaner way to do this, one that works for both
Actions and JSPs, and that works without special code to handle the URL
mapping for actions.
TIA,
--
Rick
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Best way to forward to login, then re-forward to originallyrequested resource?
Posted by Kevin Henrikson <ke...@henrikson.com>.
I'm looking at the same problem now as well. I'm looking into the possibility
of using a Servlet Filter. So every request JSPs, Actions, and even images will
be checked for auth. Basically see if a session is there and valid otherwise
forward to a login page.
Has anybody else tried this?
-kevin
> -----Original Message-----
> From: Rick Mann [mailto:rmann@latencyzero.com]
> Sent: Tuesday, May 28, 2002 3:53 PM
> To: Struts Users Mailing List
> Subject: Best way to forward to login, then re-forward to
> originallyrequested resource?
>
>
> I've got a typical struts application up and running. Certain actions check
> to see if the user is logged in, and if not, forward to a login JSP. That
> JSP then posts to a LoginAction. The LoginAction then forwards back to the
> originally requested action.
>
> The problem I have is that currently, this stuff is really hacked up. The
> login JSP has a hidden field indicating the desired action, and the action
> has to append a ".do" to that value, etc. The original action puts a request
> attribute in (the result of it calling mapping.getPath()).
>
> Surely, there is a much cleaner way to do this, one that works for both
> Actions and JSPs, and that works without special code to handle the URL
> mapping for actions.
>
> TIA,
>
> --
> Rick
>
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>