WebSphere Application Server - Express, Version 6.0.x     Operating Systems: AIX, HP-UX, Linux, Solaris, Windows

Developing with programmatic security APIs for Web applications

Before you begin

Programmatic security is used by security-aware applications when declarative security alone is not sufficient to express the security model of the application. Programmatic security consists of the following methods of the HttpServletRequest interface:
getRemoteUser
Returns the user name that the client used for authentication. Returns null if no user is authenticated.
isUserInRole
(String role name): Returns true if the remote user is granted the specified security role. If the remote user is not granted the specified role, or if no user is authenticated, it returns false.
getUserPrincipal
Returns the java.security.Principal object that contains the remote user name. If no user is authenticated, it returns null.

When the isUserInRole method is used, declare a security-role-ref element in the deployment descriptor with a role-name subelement containing the role name that is passed to this method. Because actual roles are created during the assembly stage of the application, you can use a logical role as the role name and provide enough hints to the assembler in the description of the security-role-ref element to link that role to the actual role. During assembly, the assembler creates a role-link subelement to link the role name to the actual role. Creation of a security-role-ref element is possible if an assembly tool such as Rational Application Developer (RAD) is used. You also can create the security-role-ref element during assembly stage using an assembly tool.

Steps for this task

  1. Add the required security methods in the servlet code.
  2. Create a security-role-ref element with the role-name field. If a security-role-ref element is not created during development, make sure it is created during the assembly stage.

Result

A programmatically secured servlet application.

Example

After development, a security-role-ref element can be created:

<security-role-ref>
<description>Provide hints to assembler for linking this role
name to an actual role here<\description>
<role-name>Mgr<\role-name>
</security-role-ref>

During assembly, the assembler creates a role-link element:

<security-role-ref>
<description>Hints provided by developer to map the role
name to the role-link</description>
<role-name>Mgr</role-name>
<role-link>Manager</role-link>
</security-role-ref>

You can add programmatic servlet security methods inside any servlet doGet, doPost, doPut, and doDelete service methods. The following example depicts using a programmatic security API:

public void doGet(HttpServletRequest request,
HttpServletResponse response) {

....

// to get remote user using getUserPrincipal()
java.security.Principal principal = request.getUserPrincipal();
String remoteUser = principal.getName();

// to get remote user using getRemoteUser()
remoteUser = request.getRemoteUser();

// to check if remote user is granted Mgr role
boolean isMgr = request.isUserInRole("Mgr");

// use the above information in any way as needed by
// the application
....

}

What to do next

After developing an application, use an assembly tool to create roles and to link the actual roles to role names in the security-role-ref elements. For more information, see Securing Web applications using an assembly tool.



Sub-topics
Example: Web application code
Developing servlet filters for form login processing
Configuring servlet filters

Related concepts
Role-based authorization

Related tasks
Securing Web applications using an assembly tool

Task topic    

Terms of Use | Feedback

Last updated: Jun 8, 2005 12:45:23 PM EDT
http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_web.html

© Copyright IBM Corporation 2002, 2005. All Rights Reserved.
This information center is powered by Eclipse technology. (http://www.eclipse.org)