WebSphere Application Server - IBM Redbooks

► java.security.Principal getUserPrincipal()
The getUserPrincipal method allows the developer to get the name of the
current caller. To do this, you need to call getName() on the
java.security.Principal object returned.
Principal principal=request.getUserPrincipal();
String username=principal.getName();
Important: getRemoteUser() and getUserPrincipal() return null as a result,
even if the user is logged in, unless the servlet or the JSP itself is secured.
If you opt to program J2EE calls into your application, you need to do the
following:
1. Define users and groups to the Express Application Server operating system.
2. Define roles for the application in the Web module deployment descriptor.
3. Define constraints (optional).
4. Assign users or groups to roles in the Web module deployment descriptor.
5. Define the authentication method.
6. Code the servlets to retrieve and check the user role.
7. Enable global security on the Express Application Server.
Note that the first four steps are the same as those needed to implement
declarative security. The difference is that you do not need to enable WebSphere
global security and you must add code into your application to provide
authorization.
Sample usage of security methods
Example 16-2 shows a sample of implementing programmatic security. In the
following code the servlet checks to see if the principal attempting to execute the
code is in the proper role before allowing the code to be executed.
Example 16-2 Sample code using the servlet security methods
// getting the environment variables for restricted role
// and for maximum transferable amount
restrictedRole=(String)environment.lookup("RestrictedRole");
maxWebTransferAmount=(Integer)environment.lookup("MaximumWebTransferAmount");
// checking if the user is restricted to a certain amount of transfer
if(request.isUserInRole(restrictedRole) &&
transferAmount>maxWebTransferAmount.intValue()) {
// create an error message
// the user cannot transfer the requested amount
// forward the request to the response page with the message
Chapter 16. Security 569