How to retrieve user identity in a web service using SSO/SSL?

Question

I am using OracleAS10g Rel2 to develop a web service implemented as a java class. The web service client uses basic HTTP authentication and is to access the web service over SSL. I would like to know in general how I might access the user identity from within the java class. I am aware that it is possible to pass environment variables from the HTTP server to the OC4J container with Oc4jEnvVar, but can't sufficient documentation on this and am not sure this is the right approach.
Any help is greatly appreciated..

Answer 1

There are a couple of possible techniques--
A) Use the AccesControlContext API
You can use methods from the java.security.AccessControlContext,
java.security.AccessController, and javax.security.auth.Subject
classes to get the authenticated subject.
1. Create an AccessControlContext object by calling the
AccessController.getContext method. The getContext method takes a
"snapshot" of the current calling context and returns it in an
AccessControlContext object.
2. Get the subject of the context by using the Subject.getSubject method.
For more information on the classes and methods described in this section, see the API
for the java.security and javax.security.auth packages at the following Web
address.
http://java.sun.com/j2se/1.4.2/docs/api/index.html
For example:
java.security.AccessControlContext context =
java.security.AccessController.getContext();
javax.security.auth.Subject sub = javax.security.Subject.getSubject(context);
B) use the ServiceLifecycle API:
You can use the javax.xml.rpc.server.ServiceLifecycle and
ServletEndpointContext interfaces to obtain user information from security
tokens, such as SAML, Username, or X.509. For example, the
ServletEndpointContext.getUserPrincipal method returns the name of the
authenticated user; the ServletEndpointContext.isUserInRole method
returns whether user belongs to a specific role.
Follow these general steps:
1. Implement the ServiceLifecycle interface for the Web service.
2. In the implementation of the ServiceLifecycle.init method, cast the
context parameter to ServletEndpointContext.
3. Call methods, such as getUserPrincipal and isUserInRole, on the
ServletEndpointContext context parameter to obtain user information.
For example:
package test;
public class SecureService implements securePort,
javax.xml.rpc.server.ServiceLifecycle {
private javax.xml.rpc.server.ServletEndpointContext context;
public void init(Object obj) throws javax.xml.rpc.ServiceException {
context = (javax.xml.rpc.server.ServletEndpointContext)obj;
public String helloUser(String message) throws java.rmi.RemoteException {
java.security.Principal principal = context.getUserPrincipal();
if(principal == null) {
throw new RuntimeException("Principal not found");
String userName = principal.getName();
return "Hi "+userName+"! "+message;
public void destroy() {
context = null;
}