java - Servlet - isUserInRole() -

java - Servlet - isUserInRole() -

spec:

servlet: 3.0 java: 7 tomcat: 7.0.54

intro:

it possible check programatically if user has specific role using method httpservletrequest.isuserinrole()

for example:

class="lang-java prettyprint-override">public void doget(httpservletrequest request, httpservletresponse response) throws ioexception, servletexception{ string username = null; string password = null; //get username , password manually authorization header //... request.login(username, password); if (request.isuserinrole("boss")) { //do } else { //do else } request.logout(); }

this works fine, solution requires manually retrieve username , password authorization header , login using these credentials.

questions:

is possible that? no retrieving info header , manually login()?

class="lang-java prettyprint-override">public void doget(httpservletrequest request, httpservletresponse response) throws ioexception, servletexception{ if (request.isuserinrole("boss")) { //do } else { //do else } }

trying reply myself:

from understanding code requires proper configuration in web.xml. illustration works configuration in web.xml file, example:

<web-app ...> ... <security-constraint> <web-resource-collection> <url-pattern>/helloworld</url-pattern> </web-resource-collection> <auth-constraint> <role-name>boss</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>basic</auth-method> <realm-name>defaultrealm</realm-name> </login-config> </web-app>

but means programatically checking roles not required since configuration in web.xml need restrict access.

summary:

is possible programatically checking roles without specifing restrictions (auth-constraint) in web.xml? if not, mean, using iscallerinrole() performing checking additional roles, becouse main required role specified in web.xml?

thanks.

edit 1: since first reply suggest adding login-config element web.xml, must have it. added code snippet, didn't include when posting question. , illustration works configuration. when remove auth-constraint or whole security-constraint, presence of login-config not enought. added info container: tomcat 7.0.54.

question1:

is possible programatically checking roles without specifing restrictions (auth-constraint) in web.xml?

answer:

yes, possible. there no need specify restrictions in web.xml. there no need set scurity-contraint in web.xml.

in add-on there no need manually retrieve credentials header authorization , manually login().

solution:

here working example:

class="lang-java prettyprint-override">public void doget(httpservletrequest request, httpservletresponse response) throws ioexception, servletexception{ request.authenticate(response); //solution if (request.isuserinrole("boss")) { //do } else { //do else } }

web.xml:

<web-app ...> ... <login-config> <auth-method>basic</auth-method> <realm-name>defaultrealm</realm-name> </login-config> </web-app>

and works.

as see method httpservletrequest.authenticate() used nad trick. documentation says:

triggers same authentication process triggered if request resource protected security constraint.

that need. hope helps in future.

java security java-ee servlet-3.0