JSP/SERVLETS NOT UNDERSTANDING JAAS SECURITY CONTEXT

Question

Hi ,
Instead of using the default form action "j_security_check" for form based authentication
.I have a custom JAAS loginmodule which is a servlet that gets calls when the
user clicks on "OK" in the login form..
Scenario1:
I have a servlet(unprotected) which calls a EJB(which is protected).
Depending on who has privileges to execute methods on the EJB bean , the authentication
happens correctly..
Scenario2:
I have a PROTECTED servlet.
When I execute the servlet in the browser , the login-form comes up .Once I click
on OK,what is happening is I call my
custom-loginmodule servlet which then calls the protected servlet.
Now ..from the custom-loginmodule servlet when the request goes to the PROTECTED
servlet ,the login-page again comes up...for some reason the servlets or JSPs'
don't understand that the security context has already been created..
But if the currently protected servlet is made unprotected and if it is made to
call a protected EJB, the EJB bean gets the security context.
I am thinking that security context is propagating but for some reason the JSP/servlet
domain does not seem to get the already created security context.
Another thing I noticed was with the default approach of using form-auth as "j_security_check"
does not seem to work with URL rewriting.
Any hints is greatly appreciated..
Thanx,
krish.
Krishnan.Venkataraman
Symphoni Interactive
Technical Lead.
[email protected]
412 414 5385(mobile)
412 446 2219(Work)
1 800 439 7757 (# 2219) (Work)
412 343 6549(Res)
WEB:http://members.123india.com/krishnan

Answer 1

hi,
you may set a <servlet-mapping> in web.xml or you may use
<form action="/servlet/HelloWorldExample" method=post>
instead of
<form action="/HelloWorldExample" method=post>
the <servlet-mapping> should be:
<web>
<servlet>
<servlet-name>HelloWorldExample</servlet-name>
</servlet>
<servlet-mapping>
<servlet-name>HelloWorldExample</servlet-name>
<url-pattern>/helloWorld.html<url-pattern>
<servlet-mapping>
</web>
after you add the servlet-mapping, you can access the servlet with the url-pattearn, that is:
<form action="/helloWorld.html" method=post>
the internal operation of the first and second methods are different, and you should use second one(user servlet-mapping), and the <url-pattern> has may way to use, if you want learn more, see servlet spec. for more.