Re: logging a user in programmatically

On Sep 23, 2008, at 3:24 PM, Torgeir Veimo wrote:

>
> On 24 Sep 2008, at 03:47, Matthew Hixson wrote:
>
>> The reason for doing this is that I want the user to be able to
>> check a Remember Me checkbox upon login so that whenever they return
>> back, whether its a day or a week later, they can just be logged  
>> right
>> in.
>
>
> Securityfilter already has support for this built in. Did you look  
> at DefaultPersistentLoginManager?

Okay, I found the rememberme example and tried to setup my project  
accordingly.  When I check my Remember Me button on my form I see  
these cookies set in my browser:

password		1CoWZYIdTXIHzPRUwJQsQA==
validation		241a04131269d2b88a5ca0ba9813d6a4
username		Une/tPQZ7PI=
rememberme	true

When I close my browser, reopen it, and then try to hit a secured URL  
I see this in the logs:

!remember-me cookie validation hash mismatch!
!remember-me cookie has been tampered with!
!remember-me cookie is being deleted!
!remember-me cookie validation hash mismatch!
!remember-me cookie has been tampered with!
!remember-me cookie is being deleted!

Here's my config:

  	<remember-me  
className 
= 
"org 
.securityfilter.authenticator.persistent.DefaultPersistentLoginManager">
             <!-- optional settings for default persistent login  
manager -->
             <remember-me-param name="cookieLife" value="15"/>
             <remember-me-param name="protection" value="all"/>
             <remember-me-param name="useIP" value="false"/>
             <remember-me-param name="encryptionAlgorithm" value="DES"/>
             <remember-me-param name="encryptionMode" value="ECB"/>
             <!--  <remember-me-param name="encryptionPadding"  
value="PKCS5Padding"/>  -->
             <!-- encryption keys; customize for each application -->
             <!-- NOTE: these kys must be speciied AFTER other  
encryption settings -->
             <remember-me-param name="validationKey"  
value="982420983057159814989422372834204"/>
             <remember-me-param name="encryptionKey"  
value="292837924015692917250290928211935"/>
          </remember-me>

It looks like I might be running into this problem because of the =  
characters in the value of the cookies.  I am using Tomcat 6.0.14.

http://jira.xwiki.org/jira/browse/XWIKI-2119

Anyone have an idea how to work around this?  Can I change the  
configuration to produce different cookie values that don't have '='  
in them?
   Thanks,
    -M@

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/