IBM WebSphere V5.0 Security - CGISecurity

8.2.2 Servlet security methods
The Servlet 2.3 specification defines three methods that allow programmatic
access to the caller’s security information of HttpServletRequest interface.
Important: The methods getRemoteUser() and getUserPrincipal() return
null as a result even if the user is logged in, unless the servlet or the JSP
itself is secured.
►
►
►
String getRemoteUser()
The getRemoteUser method returns the user name that the client used to log
in.
String user = request.getRemoteUser()
Boolean isUserInRole(String roleName)
The isUserInRole method allows the developer to perform additional checks
on the authorization rights of a user which are not possible, or more difficult,
to perform through the deployment descriptor of the servlet.
if (request.isUserInRole("Manager")) {
// the user is in the manager role
// ...
}
java.security.Principal getUserPrincipal()
The getUserPrincipal method allows the developer to get the name of the
current caller. To do this, you need to call getName() on the
java.security.Principal object returned.
Principal principal=request.getUserPrincipal();
String username=principal.getName();
Sample usage of security methods
The following example is a modified code snippet from the ITSOBank sample
application. You can find similar code in the TransferServlet.java in the doPost()
method. For more details, check the comments in the source below or in the
sample application.
Example 8-2 Sample code using the servlet security methods
// getting the environment variables for restricted role
// and for maximum transferable amount
restrictedRole=(String)environment.lookup("RestrictedRole");
maxWebTransferAmount=(Integer)environment.lookup("MaximumWebTransferAmount");
// checking if the user is restricted to a certain amount of transfer
182 IBM WebSphere V5.0 Security Handbook