Re: SecurityFilter and Cookies

Hi Steve, 

Pretty much but I also need to authorise it against a role set in a db
as well otherwise the application won't let it in which is why I was
taking a look at SecurityFilter as an option. 

Iain

-----Original Message-----
From: Stephen More [mailto:[email protected]] 
Sent: 14 July 2008 19:30
To: Emsley, I (Iain)
Cc: securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
Subject: Re: [securityfilter-user] SecurityFilter and Cookies

Are these assumptions correct:
   1. The cookie is being generated on some third party server/system
   2. You need to validate the cookie against this third party server

If so this seems like a simple Filter you can just write from scratch:

public class TPSFilter implements javax.servlet.Filter {
     public void doFilter( javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response, javax.servlet.FilterChain
chain) throws java.io.IOException, javax.servlet.ServletException
    {
          javax.servlet.http.HttpServletRequest req =
(javax.servlet.http.HttpServletRequest)request;
          javax.servlet.http.Cookie[] cookies = req.getCookies();

           < add your validation code here to check cookie >
          if( ! valid )
          {
               return();
          }

          chain.doFilter( request, response );

    }
}

-Steve

On Mon, Jul 14, 2008 at 9:23 AM, Emsley, I (Iain) <I.Ems....uk> wrote:
> Hi,
>
> I'm currently working on a project which requires that users be able 
> to login in to some resources on Tomcat using only their cookie, i.e. 
> no forms if the cookie is valid and an error page if it isn't, which 
> is derived from a system running on Apache. I'm still fairly new to 
> the worlds of Tomcat and authentication/authorisation.
>
> I've had SecurityFilter suggested to me to do this but is it an 
> appropriate solution before I get too deep into it?
>
> I've just downloaded the source files and begun working on a Cookie 
> Authenticator, derived from the Form Authenticator, which reads the 
> cookies and then sets the Principals but so far have just managed:
> java.lang.ClassCastException:
> org.securityfilter.authenticator.CookieAuthenticator cannot be cast to

> javax.servlet.Filter. I suspect that I haven't quite got it correctly 
> set up on my server.
>
> I'd be grateful for any pointers.
>
> Thanks in advance,
>
> Iain
>
> Iain Emsley
>
>
> ----------------------------------------------------------------------
> --- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project, 
> along with a healthy diet, reduces your potential for chronic lameness

> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>
>

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/