cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

form based Login Authentication scheme

Go to solution
Former Member

on ‎05-04-2006 1:11 PM

0 Kudos

Hello All,

I have a question on using form based login authentication scheme. And I am using this (<a href="http://help.sap.com/saphelp_nw04/helpdata/en/fa/253d408ae01f24e10000000a1550b0/frameset.htm">link</a>) but instead of BASIC, I am trying to use FORM. What I don't know if what to put in the jsp for <form action=????>. I just tried without having the action attribute for form and if I try to access any JSP in my web app, I am taken to the login.html which works as expected.. ..but what do I put as value for "action" attribute in order to succesfully login?

Thanks,

Kiran

Show replies
Show replies
Answer

Accepted Solutions (1)

Accepted Solutions (1)

Former Member
‎05-04-2006 1:43 PM
0 Kudos

Hello Kiran,

Refer to the Servlet specification the part for Form Based Authentication (11.5.3). There is a simple example in it as well.

Regards

Vyara

Show replies
Show replies
Former Member
‎05-04-2006 2:08 PM
0 Kudos

Vyara,

Thanks for pointing me in the right direction.

The answer is 


<form method=”POST” action=”j_security_check”>
<input type=”text” name=”j_username”>
<input type=”password” name=”j_password”>
</form>

Thanks,

Kiran

Former Member
‎05-09-2006 2:00 PM
0 Kudos

Hi all,

I have a login.jsp that point to home.jsp:

In login.jsp:

<FORM action='<%= response.encodeURL("j_security_check") %>' name="FRM_LOG" method="post">.....

In home.jsp:;

<%@ page import="javax.servlet.http.HttpServletRequest,amis.util.,amis.svc.user., amis.IDAMServer., java.io., amis.svc.cache.*" %>

<%! amis.svc.user.IAmisUser au;%>

<% au = amis.svc.user.AmisUser.getInstance(request,session);

%>

<html>

<head>

<%

String user = request.getUserPrincipal().getName();

session.setAttribute("idamUser",user);

if (request.isUserInRole( "xxxxx" )) { %>...

When I logon the login.jsp, then the browser go to http://milds2004:50100/HKN/jsp/j_security_check and this error:

404 Not Found

SAP J2EE Engine/7.00

The requested resource does not exist.

Details: Go to main page of this application!

What is worng? I hope in you help. thx

Vito

Former Member
‎05-09-2006 2:30 PM
0 Kudos

Hello Vito,

What exactly do you mean by login.jsp points to home.jsp? Can you please give a code snippet?

What is the html source of the form that is generated when you request the login.jsp?

Regards

Vyara

Former Member
‎05-09-2006 2:50 PM
0 Kudos

Hi Vyara,

the user insert login and password using the form in login.jsp page. The he has to view the home.jsp page.

I call directly the login.jsp.

Thanks,

Vito

Former Member
‎05-09-2006 2:52 PM
0 Kudos

Now I changed the <FORM action='<%= response.encodeURL("j_security_check") %>' name="FRM_LOG" method="post">

with

<%

String home = "home.jsp";

%>

<FORM action='<%= home %>' name="FRM_LOG" method="post">

<tr class="contentTop">

former_member185706
Participant
‎05-10-2006 8:23 AM
0 Kudos

Vito,

could you please check my response in the similar topic that you post :

Regards

Bojidar

Former Member
‎05-10-2006 3:56 PM
0 Kudos

Bojidar,

I am using a custom login module and a login page with a form (taking user/pwd) whose action points to a servlet. This servlet does the following



try {
			LoginContext lc = new LoginContext("MyLoginStack");
			lc.login();
				} catch (LoginException le) {
					}

When I try to access a protected resource in my web application, I am correctly taken to the login page and once I get authenticated (by my login module), I can see the protected page, which works perfect.

But, the problem comes when I try to go to the login page directly (not by accessing a protected resource and then getting the login page), I get an exception at lc.login().. I found the problem by debugging that the CallbackHandler in my login module is null (obviously, as I am not passing any callback handler).

The question is "How do I create and pass a callbackhandler (HttpCallbackHandlerImpl) to new LoginContext ("MyLoginStack", ..http call back handler.. )?"

Any pointers appreciated.

Thanks,

Kiran

former_member185706
Participant
‎05-15-2006 9:23 AM
0 Kudos

You can use 


LoginContext lc = new LoginContext("My login stack", new HttpCallbackHandlerImpl(request, response))

But why do you need this? If you declare login page as protected, it should works the same way.

Reagrads

Bojidar

Former Member
‎05-15-2006 1:41 PM
0 Kudos

Hi Bojidar,

Thanks for the response. I tried that but HttpCallbackHandlerImpl doesn't have a (request, response) constructor. It has just one parameter of type 'HttpRequestClientInfo'.

Let me know if there's a different version of sp we are using. I am on sp13.

The reason I wanted to make it work is, I want to see if there's a way to protect a web application using custom login modules and with users not in UME. As I see when I create a security role I can only add users from UME in visual administrator to my security role. I don't see that's possible but trying to confirm.

Thanks,

Kiran

Former Member
‎05-16-2006 1:09 PM
0 Kudos

Bojidar,

Thanks for the links but I have already looked at them before (Please refer to the link in the first post in this thread). The declarative security (concepts of security role in web.xml) is tied with UME. There is no way to add a userid/pwd to a security role without that user id belonging to the UME.

Thanks for your time,

Kiran

Former Member
‎06-07-2006 7:18 AM
0 Kudos

hi kiran have you managed to use HttpCallbackHandlerImpl in your LoginContext?

like kiran, the HttpCallbackHandlerImpl in my library only contains a constructor that accepts HttpRequestClientInfo which in turns requires HttpParameters, ApplicationContext which in turn require ... it just goes on and on.

can anyone tell me how else my servlet should pass the CallbackHandler from LoginContext?

Former Member
‎06-07-2006 12:32 PM
0 Kudos

Chee,

Sorry. I did not find a way. I have not researched on this more. But please do let us know if you find a way.

Thanks,

Kiran

Former Member
‎06-08-2006 4:36 AM
0 Kudos

i finally got it to work.

i created my own callbackhandler:


package test;

import javax.security.auth.callback.*;
import com.sap.engine.lib.security.http.HttpGetterCallback;
import com.sap.engine.lib.security.http.HttpCallback;
import javax.servlet.http.HttpServletRequest;

class MyCallbackHandler implements CallbackHandler {
	private HttpServletRequest request;

	public MyCallbackHandler(HttpServletRequest req) {
		this.request = req;
	}

	public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
		for (int i = 0; i < callbacks.length; i++) {
		    if (callbacks<i> instanceof HttpGetterCallback) {
				HttpGetterCallback cb = (HttpGetterCallback)callbacks<i>;
				cb.setType(HttpCallback.REQUEST_PARAMETER);
				cb.setName("user_name");
				cb.setValue(new String[]{(String)request.getParameter("user_name")});
	 	    } else {
		 		throw new UnsupportedCallbackException(callbacks<i>, "Unrecognized Callback");
	 	    }
		}
	}
}

cheechoong

acceval pte ltd

Former Member
‎06-08-2006 12:37 PM
0 Kudos

Hey Chee,

Thanks for sharing with us.

Regards,

Kiran

Answers (0)

Ask a Question