Authenticating Users Programmatically
This section contains detailed description on 'authenticating users programmatically' which was introduced in Servlet 3.0.
Java EE Security
In a multitier enterprise application, several containers are needed to deploy various components of Enterprise tiers. These container also provide security to these components. Two types of security is provided by the container :
- Declarative security
It uses deployment descriptor (web.xml) or annotations , to define security essentials of application's components. - Programmatic security
When declarative security is not enough to hold the application's security model, programmatic security is employed.
Programmatic Authentication
Programmatic authentication is the part of programmatic security. Programmatic security is used, when declarative security is not enough to hold the application's security model.
In Servlet 3.0, using following methods of HttpServletRequest provide us ability to authenticate users of a web application programmatically :
- authenticate(HttpServletResponse response) : Using
authenticate method, application container can do requested caller
authentication by collecting username and password
through login dialog box. It is an alternative of form-based login.
- login(java.lang.String username, java.lang.String password) :
Using authenticate method, application container collect username and
password using login dialog box. It is an alternative of form-based login.
- logout() :Using this method an application can reset
the caller identity of a request.
The following example code shows how to use the login and logout methods :
MySecurityServlet.java
package roseindia;
import java.io.IOException;
import java.io.PrintWriter;
import javax.annotation.security.DeclareRoles;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
//Annotation for defining the Servlet name and its URL pattern
@WebServlet(name = "MySecurityServlet", urlPatterns = { "/MySecurityServlet" })
// Annotation for declaring roles
@DeclareRoles("manager")
public class MySecurityServlet extends HttpServlet {
protected void processRequest(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
try {
String myUsername = request.getParameter("UserName");
String myPassword = request.getParameter("Password");
try {
request.login(myUsername, myPassword);
} catch (ServletException ex) {
out.println("Login Failed" + ex.getMessage());
return;
}
out.println("The authenticated user is in Role: "
+ request.isUserInRole("securityguy"));
out.println("The authenticated remote username: "
+ request.getRemoteUser());
out.println("The authenticated Principal name: "
+ request.getUserPrincipal());
out.println("The authentication type: " + request.getAuthType());
} catch (Exception e) {
throw new ServletException(e);
} finally {
request.logout();
out.close();
}
}
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
}
The following example code shows how to use the authenticate method:
MyAuthServlet.java
package roseindia;
import java.io.*;
import javax.servlet.*;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.*;
@WebServlet(name="MyAuthServlet", urlPatterns={"/MyAuthServlet"})
public class MyAuthServlet extends HttpServlet {
protected void processRequest(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
try {
// Launch the BASIC authentication dialog
request.authenticate(response);
out.println("Authenticate Successful");
} finally {
out.close();
}
}
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
public void doPost(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
processRequest(request, response);
}
}