How to use ServletAuthentication.weak(...)

Question

In order to have my application (behind a servlet) decide when to collect
user credentials and when to login (authenticate), it appeared from the
javadoc
and from other postings and responses I've seen that I should be able to use
the
weblogic.servlet.security.ServletAuthentication class
Well, I tried it last night and was sure it was working, but now the ONLY
time it's returning AUTHENTICATED status is if I'm already logged in, via
that browser/session using HTTP Basic Auth (I setup a security constraint
for SnoopServlet that requires basic auth login, and I added the following
code to a copy - SnoopServlet2 that does not require authentication (no
security constraint)). Only if I login via basic auth for SnoopServlet can
I then run SnoopServlet2 and have the below weak() authentication call
succeed. If I start up a new browser (thus no authentication) and try
SnoopServlet2 first I get FAILED_AUTHENTICATION every time,
until I login via SnoopServlet (even via a different account) and then come
back and try SnoopServlet2 with the below weak() call with either the same
user as I used for SnoopServlet or a different user.
Should I be able to programatically authenticate (and have the WebLogic
session treat me as authenticated after that) like this or is that not
supported?
If it should work, what am I doing wrong? Do I need to call some other
setup first if I'm programatically authenticating within a servlet that's
not
forcing authentication via security constraint? NOTE: I'm doing this
through
a caching realm which is using the WL6.0SP1 LDAP realm, which are working
through HTTP Basic Auth for servlets with security constraints.
// Call the password based (weak) authentication method
int status =
weblogic.servlet.security.ServletAuthentication.weak(user,pwd,
req);
switch (status) {
case
weblogic.servlet.security.ServletAuthentication.AUTHENTICATED:
out.println("<h3>AUTHENTICATED</h3>");
break;
case
weblogic.servlet.security.ServletAuthentication.FAILED_AUTHENTICATION:
out.println("<h3>FAILED AUTHENTICATION</h3>");
break;
default:
out.println("<h3>Unknown Authentication Status: " + status +
"</h3>");
Thanks,
..Mike
[email protected]

Answer 1

I believe I have this working better now (but could still use some info on
whether
this is a supported method of authenticating instead of using HTTP Basic
Auth
or Forms support, where my servlet authenticates a user based on info it
retrieves
and then that user (based on their WL authenticated session) is
automatically
authenticated for other servlets that are protected by security
constraints... The
javadoc says a bit about how to use this API, but not much about it's
intended
use, behavior, gotchas...
Anyway, what I did to get it working (without previously having
authenticated) was:
weblogic.servlet.security.ServletAuthentication.weak(user,pwd,
req.getSession(true));
instead of:
weblogic.servlet.security.ServletAuthentication.weak(user,pwd,
req);
It looks like the latter call (that I tried first) doesn't set up the
session for you if
you don't already have one... The first call above, makes sure you have a
session
and passes that in instead of the request.
"Mike" <[email protected]> wrote in message
news:[email protected]...
In order to have my application (behind a servlet) decide when to collect
user credentials and when to login (authenticate), it appeared from the
javadoc
and from other postings and responses I've seen that I should be able touse
the
weblogic.servlet.security.ServletAuthentication class
Well, I tried it last night and was sure it was working, but now the ONLY
time it's returning AUTHENTICATED status is if I'm already logged in, via
that browser/session using HTTP Basic Auth (I setup a security constraint
for SnoopServlet that requires basic auth login, and I added the following
code to a copy - SnoopServlet2 that does not require authentication (no
security constraint)). Only if I login via basic auth for SnoopServletcan
I then run SnoopServlet2 and have the below weak() authentication call
succeed. If I start up a new browser (thus no authentication) and try
SnoopServlet2 first I get FAILED_AUTHENTICATION every time,
until I login via SnoopServlet (even via a different account) and thencome
back and try SnoopServlet2 with the below weak() call with either the same
user as I used for SnoopServlet or a different user.
Should I be able to programatically authenticate (and have the WebLogic
session treat me as authenticated after that) like this or is that not
supported?
If it should work, what am I doing wrong? Do I need to call some other
setup first if I'm programatically authenticating within a servlet that's
not
forcing authentication via security constraint? NOTE: I'm doing this
through
a caching realm which is using the WL6.0SP1 LDAP realm, which are working
through HTTP Basic Auth for servlets with security constraints.
// Call the password based (weak) authentication method
int status =
weblogic.servlet.security.ServletAuthentication.weak(user,pwd,
req);
switch (status) {
case
weblogic.servlet.security.ServletAuthentication.AUTHENTICATED:
out.println("<h3>AUTHENTICATED</h3>");
break;
case
weblogic.servlet.security.ServletAuthentication.FAILED_AUTHENTICATION:
out.println("<h3>FAILED AUTHENTICATION</h3>");
break;
default:
out.println("<h3>Unknown Authentication Status: " + status+
"</h3>");
Thanks,
..Mike
[email protected]