RE: intercepting open-amf requests in tomcat

Please correct me if I'm wrong, but my experience with Tomcat was:

 

If you just want to add roles to incoming users to call isUserInRole() I
think you can use a filter.

 

If you want to keep the J2EE declarative security model and intercept the
request before the container makes access decisions, then you can't use a
Filter or a proprietary Valve in Tomcat.  You have to write a custom
Authenticator.

 

I wrote a prototype authenticator for Tomcat 5, but I haven't tried to use
it outside of experimenting.  I've been using html forms-based login with a
separate login page, and I let the flash player pass on the session
identifier to the gateway from there.  I'd be interested to hear of any
success with a JAAS module or something that works in Jboss.

 

Regards,

 

-Ryan Rhodes

 

  _____  

From: [email protected]
[mailto:[email protected]] On Behalf Of Dan Glauser
Sent: Wednesday, October 20, 2004 7:20 PM
To: [email protected]
Subject: Re: [Openamf-user] intercepting open-amf requests in tomcat

 

Funny, we were just talking about this today.

OpenAMF uses a servlet to process requests.  Won't your servlet filter be
called before the OpenAMF servlet?  That way you can check to make sure the
user has logged in and is valid.  We are looking to do this with JAAS in a
webapp that we are working on right now.

Regards,

--
Dan Glauser
Roundbox Media
[email protected]


On Wed, 2004-10-20 at 19:06, Bhavana Ramakrishnan wrote: 

Is there a way to intercept an open-amf request in tomcat before open-amf
grabs a hold of it?

 

We need to know what the request is for permissioning purposes and would
like to use servlet filters to process the request.

 

Thanks,

Bhavana Ramakrishnan.