IBM WebSphere V5.0 Security - CGISecurity

employeeType will be stored as a session attribute and used by other Web
components. Specify the employeeType attribute for the application users in
the LDAP directory.
3. LDAP is configured to accept anonymous access.
4. The example implemented in this book has the users defined in both local
operating system user registry and in the LDAP server. Users are registered
under the o=itso suffix.
Developing the LDAP query code
The example filter included in the application code contains the following Java
files.
►
►
LDAPAttr.java is utilized to connect to the LDAP server and retrieve user
attributes. Parameters that are passed to the class are set up in the filter
configuration section in Web deployment descriptor and are passed to the
constructor of the class while it is created. The class implements the simplest
way to read user attributes from the LDAP server.
PostLoginFilter.java is the actual filter code that uses the LDAPAttr to
access certain attributes in the LDAP directory. This class implements the
doFilter(request, response, filterchain) method. In this method, the actual
filter action is performed, which is also the method that the upstream filter
calls in order to pass the processing to the next filter in a chain. FilterChain
object provides the information about the next filter to call.
The sample doFilter method does the following:
a. Checks if the Web container successfully initialized the filter. The Web
container calls the init method of the filter to instantiate it.
b. Reads the init parameters of the filter that have been provided in the
section of the Web deployment descriptor.
c. Gets the user name from the HTTP request object and creates the session
attribute in the HttpSession object. This attribute is initially set to
UNDEFINED.
d. The filter lets the j_security_check perform the actions by calling the
doFilter method.
e. After returning from j_security_check, the PostLoginFilter performs an
LDAP search for the user name that was provided in the HTTP request to
the login form.
f. After a successful search for the user in the LDAP directory, the
employeeType attribute is read for the user and the session object is
updated with the result.
64 IBM WebSphere V5.0 Security Handbook