Hi, I have a proprietary client which sends a hardware ID in the http request for authenticating the device.
But we want to use the standard J2EE security mechanisms in our application and use the vendor neutral api request.isUserInRole() and getRemoteUser(). So I deveolped an Authenticator extending AuthenticatorBase. This authenticator takes the device identifier from the request and looks up a username and password in a device table in the database. So I have a mapping from the device id to a username and password. These credentials are used to authenticate the user to the jboss security modules: Principal principal = realm.authenticate(username, password); | if (principal == null) { | response.sendError(HttpServletResponse.SC_FORBIDDEN); | return false; | } | | //Save the authenticated Principal in our session | session.setNote(Constants.SESS_USERNAME_NOTE, principal); | request.setUserPrincipal(principal); | request.setAuthType("PENSERIAL"); | return true; This approach works, if the device id comes in the request headers of the http request. But unfortunately the device identifier is stored in a multipart request body. So I would have to access the body of the request in the authenticator. But if I access the body in the authenticator the servlet will get streaming errors accessing the body after the authenticator was executed. So the aproach with the authenticator does not help me. Is there a possibility to execute a login to the jboss container from inside the servlet so that the request is modified from the container to contain the principal and the isUserInRole method succeeds? Something like JBossAPI.getSecurityRealm().authenticate(username,password); Regards Jochen View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3956529#3956529 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3956529 ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user