IBM WebSphere V5.0 Security - CGISecurity

Each object that will be used as a filter should implement the Filter interface. Thisinterface defines three methods:► public void init(FilterConfig filterConfig)A method called by Web container to initialize the FilterConfig object for thefilter and to ensure that the filter is being instantiated.►►public void doFilter(final ServletRequest request, finalServletResponse response, FilterChain chain)A method called every time the request/response pair is passed through thefilters.public void destroy()A method called by the container to clear the instance of the filter. Thismethod can be used to clean up all the resources that were kept for filterprocessing tasks.When planning a scenario for filters, you need to take into account the way filterswork.Actions performed by servlet filters maybe executed before and/or after theactual servlet, or JavaServer Page. When thinking about the login process, aservlet filter may perform some pre-login functions before sending the request tothe authentication servlet. On the other hand, it may take the result of theauthentication servlet and perform additional checking, for example in externaldatabases in order to send customized response to the client’s browser.As mentioned in 4.5.1, “Form-based login” on page 59, WebSphere ApplicationServer uses the special j_security_check servlet to perform authentication whenform-based authentication is selected for the Web application.This section will present a sample filter that is assigned to the j_security_checkservlet to perform additional LDAP lookup and to retrieve attributes for the userwho logged in.This scenario assumes the following:1. WebSphere Application Server is configured with security enabled. The typeof user registry used for that scenario does not make any difference to thisimplementation; any user registry can be used with the sample, but when auser registry other than LDAP is used, make sure that each user from theuser registry of your choice exists in the LDAP directory for the additionallookup.2. The servlet filter will communicate with the LDAP server in order to get certainuser attributes. The user description in LDAP server contains the employeetype attribute that will be checked by servlet filter. The value of theChapter 4. Securing Web components 63