com.sun.web.security
Class WebProgrammaticLoginImpl

java.lang.Object
  com.sun.web.security.WebProgrammaticLoginImpl

All Implemented Interfaces:

WebProgrammaticLogin

@Service
public class WebProgrammaticLoginImpl
extends java.lang.Object
implements WebProgrammaticLogin

Internal implementation for servlet programmatic login.

See Also:

ProgrammaticLogin

Field Summary

static java.lang.String

WEBAUTH_PROGRAMMATIC

Constructor Summary

WebProgrammaticLoginImpl()

Method Summary

java.lang.Boolean	login(java.lang.String user, char[] password, java.lang.String realm, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Login and set up principal in request and session.
java.lang.Boolean	logout(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Logout and remove principal in request and session.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

WEBAUTH_PROGRAMMATIC

public static final java.lang.String WEBAUTH_PROGRAMMATIC

See Also:

Constant Field Values

Constructor Detail

WebProgrammaticLoginImpl

public WebProgrammaticLoginImpl()

Method Detail

login

public java.lang.Boolean login(java.lang.String user,
                               char[] password,
                               java.lang.String realm,
                               javax.servlet.http.HttpServletRequest request,
                               javax.servlet.http.HttpServletResponse response)

Login and set up principal in request and session. This implements programmatic login for servlets.

Due to a number of bugs in RI the security context is not shared between web container and ejb container. In order for an identity established by programmatic login to be known to both containers, it needs to be set not only in the security context but also in the current request and, if applicable, the session object. If a session does not exist this method does not create one.

See bugs 4646134, 4688449 and other referenced bugs for more background.

Note also that this login does not hook up into SSO.

Specified by:

login in interface WebProgrammaticLogin

Parameters:

user - User name to login.

password - User password.

request - HTTP request object provided by caller application. It should be an instance of HttpRequestFacade.

response - HTTP response object provided by called application. It should be an instance of HttpServletResponse. This is not used currently.

realm - the realm name to be authenticated to. If the realm is null, authentication takes place in default realm

Throws:

java.lang.Exception - on login failure.

See Also:

ProgrammaticLogin

logout

public java.lang.Boolean logout(javax.servlet.http.HttpServletRequest request,
                                javax.servlet.http.HttpServletResponse response)
                         throws java.lang.Exception

Logout and remove principal in request and session.

Specified by:

logout in interface WebProgrammaticLogin

Parameters:

request - HTTP request object provided by caller application. It should be an instance of HttpRequestFacade.

response - HTTP response object provided by called application. It should be an instance of HttpServletResponse. This is not used currently.

Throws:

java.lang.Exception - any exception encountered during logout operation

See Also:

ProgrammaticLogin