IBM WebSphere V5.0 Security - CGISecurity

4.5.2 Custom login
There are situations when the login facility, using the j_security_check servlet
provided by WebSphere, does not fulfil all the requirements for the application. In
these cases, developers can extend the login facility and develop an extension to
the existing code.
In the earlier versions of WebSphere Application Server, developers could use
the Custom Login facility of WebSphere; which has been deprecated since
version 4 of WebSphere Application Server.
According to the new programming model, developers should use servlet filters
to implement pre-login or post-login processes.
The following section will provide a short introduction of servlet filters and a
sample filter to perform post-login processing for the application.
Using servlet filters to modify the login process
Java Servlet API V 2.3 introduces a new object called a filter which can
transform a request or modify a response or header information. Filters can be
chained together to act on the input and output of a specified resource or group
of resources. They do not usually create a response. The main role of filters is to
modify or adapt the response. Typical uses of filters include:
1. Logging information.
2. Transforming the content on the fly (image transformation, encryption, XML
transformation, compression, and so on).
3. MIME type filters (functionally equivalent to the old-style servlet chaining).
4. Customized authentication of Web resources.
5. Caching information.
A filter can be configured to act upon a certain request. A difference between
JSP/servlet and filter processing is that filter can be mapped and work across the
subset (or all) of the URLs served by the application.
A filter’s lifecycle is very similar to a servlet’s. The configuration of all filters in a
given Servlet container is kept in the FilterConfig object. Each filter can access
this object in order to get the initialization parameters and a reference to the
ServletContext and to load the information necessary for performing filter
processing (for example, the data needed for filtering functions).
62 IBM WebSphere V5.0 Security Handbook