WebSphere Application Server - IBM Redbooks

Tip: If you are using Internet Explorer, once you have authenticated with basic
authentication, the Web browser remembers this. There is no logout
mechanism. You will not be challenged on subsequent accesses to secure
resources. This is OK if you are accessing a resource that requires the same
user ID and password, but may cause a problem if you need a second
challenge to enter a new user ID/password. The only way to force a new
challenge is to close the browser and reopen it.
With form-based authentication, the user has the option to log out of one user
ID and log in with another.
16.4.2 Programmatic security
The declarative J2EE security provided by WebSphere provides a security
infrastructure for application security that is transparent to the application
developer. That is, the developer does not need to code for security, since it will
all be handled at deployment and runtime.
Having said that, when developing servlets there are a few security calls
available if the developer wants greater control of what the end user is allowed to
do than is provided by the infrastructure. Programmatic security can be used as
an extension of declarative security.
The Servlet 2.3 specification defines three methods that allow programmatic
access to the caller’s security information of the HttpServletRequest interface:
► String getRemoteUser()
The getRemoteUser method returns the user name that the client used to log
in.
String user = request.getRemoteUser()
► Boolean isUserInRole(String roleName)
The isUserInRole method allows the developer to perform additional checks
on the authorization rights of a user, which is not possible (or is more difficult)
to perform through the deployment descriptor of the servlet.
if (request.isUserInRole("Manager")) {
// the user is in the manager role
// ...
}
568 IBM WebSphere Application Server - Express V5.0.2 Developer Handbook