tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Konstantin Kolinko <knst.koli...@gmail.com>
Subject Re: FormAuthentication Valve changes fail with RequestListeners?
Date Thu, 29 Mar 2012 20:56:19 GMT
2012/3/29 Thomas Strauß <t.strauss@srs-management.de>:
> Hi,
>
> we have a web application using the FormAuthentication with Tomcat 7.0.11.
>
> The application provides it’s own realm, that is valid for the whole server
> (configured in server.xml). The realm is based on datasource realm.
>
> The application provides request listeners that rely on the
> request.getPrincipal() method to obtain the logged on user.
>
> The request listener authenticates a service framework with the principal
> from the request.
>
> Tomcat 7.0.11 as stated above works with this design.
>
>
> In Tomcat 7.0.26 this approach fails, because the requestlistener can no
> longer obtain the principal using request.getPrincipal(). The call returns
> null. A webpage (jsp) called after the listener as target of the request can
> obtain the principal from the request as expected.
>
> No configuration changes have been applied between 7.0.11 and 7.0.26.
>
> Additionally we have experimented with various valve options, but did not
> succeed.
>
> We cannot explain this behavior and think it is a bug in Tomcat.
>
> Any help appreciated, as currently we cannot upgrade Tomcat due to this
> issue.
>

> In Tomcat 7.0.26 this approach fails, because the requestlistener can no
> longer obtain the principal using request.getPrincipal().

Is there a security constraint on the resource that the user is
accessing? (I.e. is user accessing a protected resource?)

Look at configuration options for <Context>. See
"preemptiveAuthentication" there.


Best regards,
Konstantin Kolinko

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message