Return-Path: 
 <users-return-237595-apmail-tomcat-users-archive=tomcat.apache.org@tomcat.apache.org>
X-Original-To: apmail-tomcat-users-archive@www.apache.org
Delivered-To: apmail-tomcat-users-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 5B353D9B7
	for <apmail-tomcat-users-archive@www.apache.org>;
 Fri,  2 Nov 2012 13:43:44 +0000 (UTC)
Received: (qmail 91042 invoked by uid 500); 2 Nov 2012 13:43:40 -0000
Delivered-To: apmail-tomcat-users-archive@tomcat.apache.org
Received: (qmail 90990 invoked by uid 500); 2 Nov 2012 13:43:40 -0000
Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:users-help@tomcat.apache.org>
List-Unsubscribe: <mailto:users-unsubscribe@tomcat.apache.org>
List-Post: <mailto:users@tomcat.apache.org>
List-Id: <users.tomcat.apache.org>
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Delivered-To: mailing list users@tomcat.apache.org
Received: (qmail 90958 invoked by uid 99); 2 Nov 2012 13:43:39 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 02 Nov 2012 13:43:39 +0000
X-ASF-Spam-Status: No, hits=1.5 required=5.0
	tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: domain of lyallex@gmail.com designates
 209.85.212.171 as permitted sender)
Received: from [209.85.212.171] (HELO mail-wi0-f171.google.com)
 (209.85.212.171)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 02 Nov 2012 13:43:30 +0000
Received: by mail-wi0-f171.google.com with SMTP id hj13so968928wib.0
        for <users@tomcat.apache.org>; Fri, 02 Nov 2012 06:43:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:date:message-id:subject:from:to:content-type;
        bh=DUEwnTgG0N27jtFjAJY1HKRsyGUFHPdmHOVJmGc+pxY=;
        b=FfG8BwJrhWPHRmBs7pLsWRdwb0ekPZ4sNnTmmeEq/657ExF1ILeImvhTCn9zTlOadQ
         VnoaQhbYm3ioANhUuI261RcCfx6+Me4+owRta3AeMCSeUNleDsRAD3ASWRIXdNiP177+
         O3tOx8J1hSfR0ci34Huq17Ygc8jkIraLLC/m9/DH4f+/TqiUnG/l2R7KlQr19LOTUFaL
         JF/UzaZvKBhN8r2gp+tPUmteEI4OCIEgu2zNyc7KF0ckpmIM9saWTkxiQV5xXC5oEImU
         gpn9vCUjbcuLt1FB3xA9Rr9PDj4NafLZ4FF+wOaE1mJxY5ay8DreOsypkc1StIT2YwFq
         2qVw==
MIME-Version: 1.0
Received: by 10.216.141.93 with SMTP id f71mr570766wej.125.1351863790418; Fri,
 02 Nov 2012 06:43:10 -0700 (PDT)
Received: by 10.227.196.6 with HTTP; Fri, 2 Nov 2012 06:43:10 -0700 (PDT)
Date: Fri, 2 Nov 2012 13:43:10 +0000
Message-ID: 
 <CAMqzz4TBmc0gJPhnOxkqiMSuLijCVQwS73hwxa1m=86jcdAScg@mail.gmail.com>
Subject: Redirecting from unprotected resource to a protected one
From: Lyallex <lyallex@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=0016e6dd961e033d1f04cd8351c2
X-Virus-Checked: Checked by ClamAV on apache.org

--0016e6dd961e033d1f04cd8351c2
Content-Type: text/plain; charset=ISO-8859-1

Java 1.6
Tomcat 6.0.35
Ubuntu Linux 12.04

I have an application that uses container managed security
I have set things up like this

<security-constraint>
    <display-name>Standard user constraint used for checkout and account
modification</display-name>
    <web-resource-collection>
      <web-resource-name>StandardUserConstraint</web-resource-name>
      <url-pattern>/account/*</url-pattern>
      ...
    </web-resource-collection>
    <auth-constraint>
      <role-name>stdbuyer</role-name>
    </auth-constraint>
</security-constraint

There are two concepts
A User and an Account
A User 'has an' Account

I start by setting up a user by getting username and password
and saving them to a database along with the relevant role

If I now try to access a protected resource
by making a direct request (e,g /account/somepage.jsp) the login page
appears as expected.
I can enter the relevant credentials and log in

The second phase of setting up an account is capturing the primary address
I do this by accessing an unprotected resource servlet (e.g
/common/FooServlet)
When I have validated the data I want to forward to a protected resource
like this

forwardTarget = "/account/accountView.jsp";

RequestDispatcher rd =
getServletContext().getRequestDispatcher(forwardTarget);
rd.forward(request, response);

What I was hoping would happen is that the user would be required to login
but we get to the protected resource without the login screen appearing.
I realise that I am forwarding an existing (unauthenticated) request

I could simply redirect to an 'account created log in now page' but that's
a bit naff.

Is it possible to redirect to a protected resource from an unprotected one ?

thanks

Lyallex

--0016e6dd961e033d1f04cd8351c2--