IBM WebSphere V5.0 Security - CGISecurity

Each object that will be used as a filter should implement the Filter interface. This
interface defines three methods:
► public void init(FilterConfig filterConfig)
A method called by Web container to initialize the FilterConfig object for the
filter and to ensure that the filter is being instantiated.
►
►
public void doFilter(final ServletRequest request, final
ServletResponse response, FilterChain chain)
A method called every time the request/response pair is passed through the
filters.
public void destroy()
A method called by the container to clear the instance of the filter. This
method can be used to clean up all the resources that were kept for filter
processing tasks.
When planning a scenario for filters, you need to take into account the way filters
work.
Actions performed by servlet filters maybe executed before and/or after the
actual servlet, or JavaServer Page. When thinking about the login process, a
servlet filter may perform some pre-login functions before sending the request to
the authentication servlet. On the other hand, it may take the result of the
authentication servlet and perform additional checking, for example in external
databases in order to send customized response to the client’s browser.
As mentioned in 4.5.1, “Form-based login” on page 59, WebSphere Application
Server uses the special j_security_check servlet to perform authentication when
form-based authentication is selected for the Web application.
This section will present a sample filter that is assigned to the j_security_check
servlet to perform additional LDAP lookup and to retrieve attributes for the user
who logged in.
This scenario assumes the following:
1. WebSphere Application Server is configured with security enabled. The type
of user registry used for that scenario does not make any difference to this
implementation; any user registry can be used with the sample, but when a
user registry other than LDAP is used, make sure that each user from the
user registry of your choice exists in the LDAP directory for the additional
lookup.
2. The servlet filter will communicate with the LDAP server in order to get certain
user attributes. The user description in LDAP server contains the employee
type attribute that will be checked by servlet filter. The value of the
Chapter 4. Securing Web components 63