Simple authentication and authorization with a servlet and a filter

Question

Could somebody point me to code example that do simple authentication/authorization using one servlet and one filter? (without Spring, Struts, JSF or any framework)
I’m having a lot of problems with that, apparently, easy task.
These are the rules:
- A simple login page
- Two roles (admin, registered).
- If the user loged is an admin, redirect to his entry page (private/admin/index.jsp).
- If the user loged is of role registered, redirect him to his entry page (private/registered/index.jsp).
- If it’s not a valid user, redirect again to login page.
- Admin’s users cannot go to private/registered/ area.
- Registered users cannot go to private/admin/ area.
- Non authenticated user cannot go to private/ area
Thanks a lot in advance!
Edited by: JLuis on 25-ago-2010 15:27

Answer 1

AccessControl.java:
package com.tlsformacion.security;
import java.io.IOException;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import com.tlsformacion.utils.Log;
public final class AccessControl extends HttpServlet {
     private static final long serialVersionUID = 5741058615983779764L;
     private static final String USERNAME_ATTR = "username";
     private static final String PWD_ATTR = "password";
     private static final String LOGIN_PAGE_ATTR = "login_page";
     private static final String ROL_ATTR = "role";     
     private boolean isAuthentic = false;
     private String role = null;
     private String loginPage = null;
     public AccessControl() {
        super();
     public void init(ServletConfig config) throws ServletException {
          loginPage = config.getInitParameter(LOGIN_PAGE_ATTR);
     protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          debug("Inside doGet");
          doAccessControl(request, response);
     protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          debug("Inside doPost");
          doAccessControl(request, response);
     private void doAccessControl (HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          debug("Inside doAccessControl");
          doAuthentication(request, response);     
          if (isAuthentic) { //Authentic user
               doAuthorization(request, response);                         
          } else { //User NOT authentic
               doRejection(request, response);
     private void doAuthentication(HttpServletRequest request, HttpServletResponse response) {     
          debug("Inside doAuthentication");                         
        String requestedURI = request.getRequestURI();
        if (requestedURI.contains("/AccessControl")) { //Comes from login page           
             debug("Comes from login page");
              String username = request.getParameter(USERNAME_ATTR);
            String pwd = request.getParameter(PWD_ATTR);   
             role = getRole(username, pwd);
             if (role != null) {
                  isAuthentic = true;
                  request.getSession().setAttribute(ROL_ATTR, role);
        } else { //Doesn't comes from login page
             debug("Doesn't comes from login page");
             if (isInSession(request)) {
                  debug("Rol is in session");               
                  isAuthentic = true;
             } else {
                  debug("Rol is NOT in session");
     private void doAuthorization(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {          
          debug("Inside doAuthorization");
          String requestedURI = request.getRequestURI();
          debug("requestedURI: " + requestedURI);
          if (requestedURI.contains("/AccessControl")) { //Comes from login page                                                                 
               goHomePage(request, response);
          } else if (requestedURI.contains("/private/" + role)) { //Trying to access his private area
               goRequestedPage(request, response);
          } else { //Trying to access other roles private area
               goLoginPage(request, response);
    private void doRejection(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {          
         debug("Inside goRejection");
         role = null;
          goLoginPage(request, response);         
     private void goHomePage(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          debug("Inside goHomePage");     
          String homePage = "private/" + role + "/index.jsp";
          goPage(request, response, homePage);
     private void goLoginPage(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          debug("Inside goLoginPage");
          goPage(request, response, loginPage);
     private void goRequestedPage(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          debug("Inside goRequestedPage");
          String contextPath = request.getContextPath();          
          debug("contextPath: " + contextPath);
          String requestedPage = request.getRequestURI().replace(contextPath + "/", "");
          goPage(request, response, requestedPage);
     private void goPage(HttpServletRequest request, HttpServletResponse response, String page) throws IOException, ServletException {
          debug("Inside goPage ...trying to go to: " + page);
          //Option A
          response.sendRedirect(page);
          //Option B
          //RequestDispatcher requestDispatcher = request.getRequestDispatcher(page);
          //requestDispatcher.forward(request, response);                  
     private boolean isInSession(HttpServletRequest httpRequest) {
         boolean inSession = false;
          role = (String)httpRequest.getSession().getAttribute(ROL_ATTR);
          if (role != null && !role.equals("")) {
               inSession = true;
         return inSession;
    //PENDIENTE: mock method!
    private String getRole(String username, String pwd) {         
         String role = null;
         if (username.equals("admin") && pwd.equals("admin")) {
              role = "administrator";
         } else if (username.equals("regis") && pwd.equals("regis")) {
              role = "registered";
         return role;
    private void debug(String msg) {
         Log.debug(msg);
}Proyect Folder Structure:
WebContent
     login.html
     private
          administrator
               index.jsp
          registered
               index.jspBasically, the problem is that if you try to log as admin/admin (for example) the servlet AccessControl executes infinitely
Edited by: JLuis on 26-ago-2010 8:04