JAAS: how to login / logout programmatically?

Question

Dear All,
i am writing a web application.
i have created a JSF login form for authentication. the application use JASS mechanism for pages protection.
i want to use the oracle's prebuild loginmodule (class name is
"oracle.security.jazn.login.module.LDAPLoginModule") to authenticate user from LDAP server.
to authenticate the user, my code in the backing bean for the login are:
public String authenticate()
MyCallbackHandler callback = new MyCallbackHandler();
callback.setName("name");
callback.setPassword("password");
//create a logoncontext for specific login module, and callbackhandler
LoginContext ctx = new LoginContext("name of configuration", callback );
//login
ctx.login();
callback handler code:
public class MyCallbackHandler implements javax.security.auth.callback.CallbackHandler
private String name = "";
private String password = "";
public void setName(String name)
this.name = name;
public void setPassword(String password)
this.password = password;
public void handle(Callback[] callbacks)
for(Callback c : callbacks)
if (c instanceof NameCallback)
((NameCallback)c).setName(name);
else if(c instanceof PasswordCallback)
((PasswordCallback)c).setPassword(password.toCharArray());
the login method SEEMS succeed as no exception thrown.
but the HttpServletRequest.getUserPrincipal() return null and whenever i visit other
protected page (after calling the logincontext.login())...i was redirected to the login page ...
do anyone know what the problem is??
thanks

Answer 1

Hi Frank,
I am also facing the same problem getting the container to recognize the user using login/logout programmatically. I cannot use j_security_check as my authentication module requires three fields for authenticating the user and also I have a jsf login form.
I have attempted the container to recognize the user by writing a filter to field all request with url-pattern "/" to get the user information from the session(saved by login action) and wrapped the request with an implementation of HttpRequestWrapper where I have overridden the methods - getRemoteUser(), getUserPrincipal(), isUserInRole().
It is the first mapping in the web.xml and I am unable to understand if the redirect is happening before/after it reaches my AuthenticationFilter and my user is never recognized by the container since my method implementations are not called. The AuthenticationFilter is being called and I think it is something to do with the ordering of the filter-mapping. Any help would be appreciated.
I have pasted my code below
AuthenticationFilter
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain fc) throws IOException, ServletException {
if (request instanceof HttpServletRequest) {
HttpServletRequest httpRequest = (HttpServletRequest)request;
HttpSession session = httpRequest.getSession();
if (session != null &&
session.getAttribute(SESSION_ATTR_USER) != null &&
session.getAttribute(SESSION_ATTR_ROLES) != null) {
String username =
(String)session.getAttribute(SESSION_ATTR_USER);
Set roleSet = (Set)session.getAttribute(SESSION_ATTR_ROLES);
AuthRequestWrapper wrapper =
new AuthRequestWrapper(httpRequest, username, roleSet);
fc.doFilter(wrapper, response);
} else {
fc.doFilter(request, response);
AuthRequestWrapper
public class AuthRequestWrapper extends HttpServletRequestWrapper {
private String username;
private Set roleSet;
private Principal principal;
public AuthRequestWrapper(HttpServletRequest request, String username,
Set roleSet) {
super(request);
this.username = username;
this.roleSet = roleSet;
this.principal = new UserPrincipal(username);
public String getRemoteUser() {
return username;
public Principal getUserPrincipal() {
return principal;
public boolean isUserInRole(String roleName) {
return roleSet.contains(roleName);
web.xml
<filter-mapping>
<filter-name>AuthFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>trinidad</filter-name>
<servlet-name>Faces Servlet</servlet-name>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>