Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
MIME-Version: 1.0
In-Reply-To: <58DF9A52.7050408@ice-sa.com>
References: <69ef49e9-c6a4-2d4c-9caf-97a0c5c6cf4f@602.cz> <CABzHfVmu4xb0EYGkfm2g+oF8h7zZbXVC_PadAnBjveMUvL1O4w@mail.gmail.com>
 <37562d2d-1508-2df1-1b8b-273ef76de8e2@christopherschultz.net>
 <58DD5F63.1020603@ice-sa.com> <2841f1e3-a057-392a-4455-e774b5ec16dc@christopherschultz.net>
 <58DF9A52.7050408@ice-sa.com>
From: Konstantin Kolinko <knst.kolinko@gmail.com>
Date: Sat, 1 Apr 2017 16:59:25 +0300
Message-ID: <CABzHfVkHLHXomVVsMMCW8qEV9w=9zGow7EZAYJEdae3Fdh7p-A@mail.gmail.com>
Subject: Re: how to access HTTPServletRequest in RealmBase
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
archived-at: Sat, 01 Apr 2017 13:59:33 -0000

2017-04-01 15:17 GMT+03:00 Andr=C3=A9 Warnier (tomcat) <aw@ice-sa.com>:
>
> I was also wondering why Konstantin, in his response, mentioned that it w=
as
> "by design" that the Realm has no access to the Request. Was that to avoi=
d
> some kind of problem, or to match the Specs or something ?
>

Documentation says so. E.g.:
"A Realm is a "database" of usernames and passwords"
http://tomcat.apache.org/tomcat-8.5-doc/realm-howto.html#What_is_a_Realm?


One design bit driven by the servlet spec is that an Authenticator
usually is not configured explicitly, but is created automatically,
mapping an <auth-method> onto a class name. See
Authenticators.properties file

https://svn.apache.org/viewvc/tomcat/tc8.5.x/tags/TOMCAT_8_5_13/java/org/ap=
ache/catalina/startup/Authenticators.properties?view=3Dmarkup

The web application decides, what authentication protocol to use.

Realms are configured explicitly, and we have one by default.


In a few cases where I went with Tomcat authentication (instead of
usual Spring Security library)
and had special requirements (checks by IP, preauthentication)  I
implemented a Valve,
not even an Authenticator.
I am not proud of those, but they served a specific purpose. They were
inspired by SingleSignOn valve.


BTW, there are alternative technologies, JASPIC, JAAS, GSS (GSSContext
in SpnegoAuthenticator)
http://tomcat.apache.org/tomcat-8.5-doc/config/jaspic.html
http://tomcat.apache.org/tomcat-8.5-doc/config/realm.html#JAAS_Realm_-_org.=
apache.catalina.realm.JAASRealm

JASPIC has access to request & response..

Best regards,
Konstantin Kolinko

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org