Eclipse Community Forums: Remote Application Platform (RAP) » How to access user Principal without requiring authentication

Home » Eclipse Projects » Remote Application Platform (RAP) » How to access user Principal without requiring authentication

How to access user Principal without requiring authentication [message #1061246]

Thu, 30 May 2013 14:31

Eclipse User

I have a RAP app that runs in Tomcat with an SSL connector that requires client authentication. I'd like to access the user principal from the client cert, but I find that it's null unless I also implement an <auth-constraint> in the web.xml. For our application, we want to use the client cert for identification of the user, but we don't want to authenticate the user beyond requiring a valid cert.

Is there a way to get the user Principal without requiring authentication?

Here is my code which retrieves the user Principle:

RWT.requestThreadExec(new Runnable() {

        public void run() {
	        if (RWT.getRequest() != null) {
			RWT.getRequest().getUserPrincipal();
		}
	}
			
});

Here is a web.xml snippet which results in the Principal being null:

<security-constraint>
	<web-resource-collection>
		<web-resource-name>My App</web-resource-name>
		<url-pattern>/*</url-pattern>
	</web-resource-collection>
</security-constraint>

<login-config>
	<auth-method>CLIENT-CERT</auth-method>
	<realm-name>My Realm</realm-name>
</login-config>

If I add the following to the web.xml, the Principal is not null, but I'd like to avoid this:

<security-constraint>
         ...
        <auth-constraint>
	        <role-name>someRole</role-name>
        </auth-constraint>
</security-constraint>
<security-role>
       <role-name>secureconn</role-name>
</security-role>

Re: How to access user Principal without requiring authentication [message #1061270 is a reply to message #1061246]

Thu, 30 May 2013 17:19

Eclipse User

The Principal is also null if I launch the app in the IDE with jetty configured for SSL.

Re: How to access user Principal without requiring authentication [message #1070774 is a reply to message #1061270]

Thu, 18 July 2013 12:28

Eclipse User

It turns out that

RWT.getRequest().getAttribute("javax.servlet.request.X509Certificate")

Returns an X509Certificate array, containing the cert of the authenticated user, even if the user has not been authorized for a specific role. This is the behavior I expected from

 HttpServletRequest#getuserPrincipal()

so this is an acceptable workaround.

Previous Topic:	Toolbar height
Next Topic:	RAP Client Scripting extension

Goto Forum:

-=] Back to Top [=-

Current Time: Sun Jul 06 10:39:40 EDT 2025

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter