« Bend, Oregon | Main | Browser/Plugin Detec... »
20021126 Tuesday November 26, 2002

Form-Based Authentication I posted the following message to the tomcat-user group yesterday:

On Tomcat 4/5, I am able to use the following configuration in my 
web.xml:

<login-config>
  <auth-method>FORM</auth-method>
  <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/login.jsp?error=true</form-error-page>
  </form-login-config>
</login-config>

However, I know that there are app servers out there that do not support
this - the form-error-page MUST be a different JSP.  So I'm wondering,
is there a value I can grab in my login.jsp that tells me the URL of the
protected resource the user is trying to get to?

I tried <%=request.getRequestURL()%>, but that gives me .../login.jsp -
and I am expecting welcome.do.

I know iPlanet used to set a cookie and I could use that as described
here.

Thanks,

Matt

Craig McClanahan responded with the following answer - which was just the information I was looking for:

There is no portable mechanism to acquire the request URL that was originally requested, nor any guarantee that this is even possible. All you know is that the container has detected that a protected URL was requested, and that there was no currently authenticated user.

So the lesson learned is that if you want to make your webapp portable across different app servers, use two separate pages for the login and login-error pages. Posted in Java at Nov 26 2002, 05:38:44 AM MST 2 Comments

Comments:

I'm not clear on how "you 'must' have a different login error page" relates to "what page was the user refused access to"? On a side-note, we use the BreadCrumbFilter in Roller to get the "what page did they ask for" information. It's rather a work-around, but I noticed Dave found a use for it elsewhere in Roller (I forget where).

Posted by Lance on November 26, 2002 at 07:43 AM MST #

Your posting saved me alot of trouble chasing dead-ends. Thanks :) I was having a similar problem using JRun 4 (my app is Struts-based). I solved it by calling request.getRequestURL() in my action class (i.e. before any forwards occur), and passing the value to a request attribute. I then retrieve the request attribute in my JSP page.

Posted by V. Bilton on February 12, 2003 at 12:06 PM MST #

Post a Comment:
  • HTML Syntax: Allowed
Click me to subscribe
Matt Raible is a Web Architect who enjoys developing applications with open source technologies. Contact me for rates.
« January 2009
SunMonTueWedThuFriSat
    
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
       
Today

Recent Entries

Tag Cloud

abbie acegi appfuse denver grails gwt hibernate jack java jsf linkedin maven myfaces oscon rails skiing spring springmvc stripes struts struts2 tapestry travel webframeworks wicket