IBM WebSphere V5.0 Security - CGISecurity

the login process. The main difference between server-side and client-side loginis that on the server-side it is not possible to collect the login information throughuser interaction. It is not possible to pull up a graphical window orcharacter-based console to ask for user name and password. The logininformation (user name, password, realm) is passed directly to the login context.The following example is a code snippet from the ITSOBank application,performing server-side login for the TransferServlet servlet. Note that thecallback handler at this time is the WSCallbackHandlerImpl class, and the logininformation is passed to the handler as parameters.Example 8-9 Server-side login in the ITSOBank TransferServlet servlet...try {LoginContext lc=new LoginContext("WSLogin",newWSCallbackHandlerImpl(loginusername,loginrealm,loginpassword));lc.login();} catch (LoginException le) {// handling the exception}...The other difference with server-side login is that the login.properties definedunder the /properties/ directory is used to configure JAAS.Running the server-side login sampleIn order to test the server-side login function in the ITSOBank sampleapplication, launch a Web browser and access the http://localhost/itsobankapplication.Select the Modified Customer Transfer 2. - using Server-Side Login link. Fillout the provided form with the required information, and do not forget to providethe realm, for example dirsrv01:389 if you are using an LDAP directory on hostdirsrv01 at port 389.Submit the transfer, then wait for the response page. When the transfer is done,go and check out the SystemOut.log file under the/logs/server1 directory. Go to the end of the file and look forthe identities who initiatied the transfer and who invoked the bean methods.Chapter 8. Programmatic security 213