IBM WebSphere V5.0 Security - CGISecurity

8.2.2 Servlet security methodsThe Servlet 2.3 specification defines three methods that allow programmaticaccess to the caller’s security information of HttpServletRequest interface.Important: The methods getRemoteUser() and getUserPrincipal() returnnull as a result even if the user is logged in, unless the servlet or the JSPitself is secured.►►►String getRemoteUser()The getRemoteUser method returns the user name that the client used to login.String user = request.getRemoteUser()Boolean isUserInRole(String roleName)The isUserInRole method allows the developer to perform additional checkson the authorization rights of a user which are not possible, or more difficult,to perform through the deployment descriptor of the servlet.if (request.isUserInRole("Manager")) {// the user is in the manager role// ...}java.security.Principal getUserPrincipal()The getUserPrincipal method allows the developer to get the name of thecurrent caller. To do this, you need to call getName() on thejava.security.Principal object returned.Principal principal=request.getUserPrincipal();String username=principal.getName();Sample usage of security methodsThe following example is a modified code snippet from the ITSOBank sampleapplication. You can find similar code in the TransferServlet.java in the doPost()method. For more details, check the comments in the source below or in thesample application.Example 8-2 Sample code using the servlet security methods// getting the environment variables for restricted role// and for maximum transferable amountrestrictedRole=(String)environment.lookup("RestrictedRole");maxWebTransferAmount=(Integer)environment.lookup("MaximumWebTransferAmount");// checking if the user is restricted to a certain amount of transfer182 IBM WebSphere V5.0 Security Handbook