IBM WebSphere V5.0 Security - CGISecurity

if(request.isUserInRole(restrictedRole) &&transferAmount>maxWebTransferAmount.intValue()) {// create an error message// the user cannot transfer the requested amount// forward the request to the response page with the message}// get the principal from the requestPrincipal principal=req.getUserPrincipal();// print out the user information about the servlet invocationSystem.out.println("Transfer Servlet was invoked by user:"+req.getRemoteUser()+", principal: "+principal.getName());With the security methods, the servlet will not let the user in a restricted role tosubmit a transfer greater than the maximum transferable amount.8.3 CustomRegistry SPIWebSphere supports the use of user registries in order to look up user and groupdetails for authentication purposes. Three registries are provided by default,although only two are likely to be commonly used. These are the local OSregistry, an LDAP server and a filesystem-based registry calledFileRegistrySample. The FileRegistrySample registry is not to be used inproduction environments due to its lack of scalability, but is included as anexample of how a custom registry might operate. In fact, it is possible to developintegration with any type of custom registry that supports the notion of users andgroups by implementing WebSphere’s UserRegistry interface. The UserRegistryinterface is provided so that the application server may make use of a userregistry that would otherwise be inaccessible. This interface is defined in thecom.ibm.websphere.security package.The provision of this interface ensures that a variety of user registries may beused such as relational databases, files stored on directly on the filesystem orintegration products such as WebSphere MQ. A combination of multipleregistries may be used such as LDAP and RACF. A demonstration customregistry that uses flat files as the data store is supplied with the applicationserver.The UserRegistry interface defines a general set of methods to allow theapplication server to obtain user and group information from the regsitry. Theregistry can operate as a process running remotely to the application server andso it is necessary for each registry to implement the java.rmi.Remote interface.Chapter 8. Programmatic security 183