Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (herse.apache.org: domain of barry.l.propes@citigroup.com
 designates 192.193.221.104 as permitted sender)
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: RE: a question about user athentication
Date: Thu, 5 Jul 2007 15:22:21 -0400
Message-ID: <3A55348B50FD2A40AAA40ABA16C6B6D60B70C830@EXNJMB23.nam.nsroot.net>
Thread-Topic: a question about user athentication
Thread-Index: Ace8dMhmOpRx6EalQLycDTmE6JNsHACxA+EA
From: "Propes, Barry L " <barry.l.propes@citi.com>
To: "Tomcat Users List" <users@tomcat.apache.org>

to "prevent the other users to be signed on?"

Do you mean prevent from locking them out?

I've got a similar deal in my db with the users table, a column called =
user_dbflag, which, like your status column, uses a simple int value of =
-1 or 0 to see who's "active." Actually, it also has a timestamp column =
to verify who has changed their password and when they change it the =
dbflag column value changes from -1 to 0.

In one of my SQL statements, I have the condition to allow the user to =
see (and submit/enact on) the JSP in question.
If they're allowed, they can see the whole thing. If not, Tomcat will =
throw a 500 (specifically Exhausted ResultSet) error.
In that case, I catch the exception and notify the user by printing to =
the browser a message telling them their user role does not properly =
match or their password has been "deactivated." In reality, the user =
account or password is never deleted from the db table.

Let me know if you need more info on this.


-----Original Message-----
From: is_maximum [mailto:mnrz57@gmail.com]
Sent: Monday, July 02, 2007 1:46 AM
To: users@tomcat.apache.org
Subject: a question about user athentication


Hi experts

I am using Tomcat 5.5 and struts framework and security filter
in order to authenticate users like the others I am using =
j_security_check
action=20
but my problem is that I have a field in my user table namely status =
which
represent whether the user is available or deleted by administrator

the problem is even if it is deleted the tomcat will authenticate and =
let
that user to sign in, how can I put a condition like "where status =3D =
0" to
prevent the other users to be signed in?

in secirity filter we only specify field names of the table as follows:

<realm-param name=3D"userNameCol" value=3D"userName" />
<realm-param name=3D"userCredCol" value=3D"password" />


any comment would be of a great help

thanks
--=20
View this message in context: =
http://www.nabble.com/a-question-about-user-athentication-tf4010274.html#=
a11388743
Sent from the Tomcat - User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org