Login changes from WLCS 3.2 vs WLCS 3.5

Question

I am upgrading my current prototype using WLCS3.2 to 3.5. I use the
exampleportal demo and plug in a few JSP's from my web application.
In 3.2, after you enter your login information the request object that all
portlets have access to contains 3 parameters: loginAction, username and
password. I use this information in order to log into my application which
allows me to have a single signon.
In 3.5, things have changed and the only parameter that I have access to
through the request object is 'dest' which has the path to
/something/loginSuccess.jsp. How do I now get access to login information
from the portal similar to what was available to me in 3.2?
thank you
shane

Answer 1

Peter,
Thanks for the quick reply. I'll let you know how I make out.
thanks
shane
"Peter Laird" <[email protected]> wrote in message
news:[email protected]...
>
Shane,
Excellent question. Let me point you to some reading:
1. There is a brand new security guide for 3.5 athttp://edocs.bea.com/wlcs/docs35/secguide/index.htm
>
2. Read the Security chapter of the Servlet 2.2 spec, found athttp://java.sun.com/products/servlet/index.html
>
>
Realize that the 3.2 portal's implementation of the security mechanismpredated
the standard J2EE declarative security model. The 3.5 release of portalreimplemented
security to adhere to the standard. So the missing attributes is aside-effect
of this change.
In 3.2, the portal was responsible for doing its own user authentication.Therefore
the username and password was available to the portal code. In 3.5, theservlet
container (WLS) performs the authentication on behalf of the portal. Asyou see
in the Servlet spec, the methods available to a servlet afterauthentication allow
you to get the username via request.getUserPrincipal(). But there is nostandard
way to get the password. So if you require the password to propagate theidentity
to another application, you are out of luck.
All is not lost though. I can think of three avenues for you.
1. Reread section 11.6 of the Servlet 2.2 spec. It declares that thecontainer
must maintain authentication at the container-scope, and not the web-appscope.
Know that the portal is deployed as a webapp. If your secondaryapplication can
be deployed as a J2EE web-app on the same server, authentication can bemaintained
across web-apps.
2. If you cannot deploy your app as a web-app, there is still anotheroption.
WLS supports an "Authentication Filter" which is invoked both immediatelyprior
and immediately after the j_security_check authentication mechanism. Thisallows
you to provide a callback which accepts the HttpRequest. Therefore, youshould
be able to stash the j_password into the Session before WLS clears it outof the
Request. I don't have time to try this today, but if you do please postyour results!
Read here for more info on the AuthFilterhttp://e-docs.bea.com/wls/docs60//javadocs/weblogic/servlet/security/AuthFil
ter.html
>
>
3. If the above options don't work for you, you may wish to implement acustom
WLS security realm which will provide passwords for users upon request.
Post back to the newsgroup with your thoughts/results.
PJL
"Shane Daniels" <[email protected]> wrote:
I am upgrading my current prototype using WLCS3.2 to 3.5. I use the
exampleportal demo and plug in a few JSP's from my web application.
In 3.2, after you enter your login information the request object that
all
portlets have access to contains 3 parameters: loginAction, username
and
password. I use this information in order to log into my application
which
allows me to have a single signon.
In 3.5, things have changed and the only parameter that I have access
to
through the request object is 'dest' which has the path to
/something/loginSuccess.jsp. How do I now get access to login
information
from the portal similar to what was available to me in 3.2?
thank you
shane