Overriding Tomcat Valve to return extended login failure status

NicholasSushkin (Nicholas Sushkin) — Thu, 22 Mar 2007 22:25:21 GMT

See Shade Grown Code for more information.

ExtendedStatusSetter.java



package com.ofc.tomcat;



import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;



/**

 * Interface flagging that the implementing Realm can set request

 * headers providing additional information about an authentication

 * failure.

 *

 * @author Nicholas Sushkin

 */

public interface ExtendedStatusSetter

{



    /**

     * The request attribute under which we forward an extended failure status message

     * (as an object of type String) to a login error page.

     */

    public static String LOGIN_FAILURE_MESSAGE_ATTR = 

        "com.ofc.tomcat.LOGIN_FAILURE_MESSAGE";

    

    public void setExtendedStatus(String username, HttpServletRequest request, HttpServletResponse response);

}

ExtendedStatusFormAuthenticator.java



package com.ofc.tomcat;



import org.apache.catalina.authenticator.Constants;

import org.apache.catalina.authenticator.FormAuthenticator;

import org.apache.catalina.Realm;

import org.apache.catalina.connector.Request;

import org.apache.catalina.connector.Response;

import org.apache.catalina.deploy.LoginConfig;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import javax.servlet.RequestDispatcher;



/**

 * Adds extended authentication failure status to tomcat FormAuthenticator.

 *

 * @author Nicholas Sushkin

 */

public class ExtendedStatusFormAuthenticator extends FormAuthenticator

{

    /**

     * Descriptive information about this implementation.

     */

    protected static final String info =

        "com.ofc.tomcat.ExtendedStatusFormAuthenticator/1.0";



    private static Log log = LogFactory.getLog(ExtendedStatusFormAuthenticator.class);



    // ------------------------------------------------------------- Properties

    /**

     * Return descriptive information about this Valve implementation.

     */

    @Override

    public String getInfo() 

    {

        return info;

    }



    // ------------------------------------------------------------- Overridden behavior

    /**

     * Called to forward to the error page

     * 

     * @param request Request we are processing

     * @param response Response we are creating

     * @param config    Login configuration describing how authentication

     *              should be performed

     */

    @Override

    protected void forwardToErrorPage(Request request, Response response, LoginConfig config) 

    {

        Realm realm = context.getRealm();



        if (realm instanceof ExtendedStatusSetter)

        {

            log.debug("realm implements ExtendedStatusSetter, setting extended status for error page");

            String username = request.getParameter(Constants.FORM_USERNAME);

            ((ExtendedStatusSetter) realm).setExtendedStatus(username, request.getRequest(), response.getResponse());

        }

        else

        {

            log.debug("realm does not implement ExtendedStatusSetter, NOT setting extended status for error page");

        }



        RequestDispatcher disp =

            context.getServletContext().getRequestDispatcher

            (config.getErrorPage());

        try {

            disp.forward(request.getRequest(), response.getResponse());

            response.finishResponse();

        } catch (Throwable t) {

            log.warn("Unexpected error forwarding to error page", t);

        }

    }

}

Realm implementation will include the following



public class AccountLockoutDatasourceRealm extends DataSourceRealm implements ExtendedStatusSetter

{

    // ...



    public void setExtendedStatus(String username, HttpServletRequest request, HttpServletResponse response)

    {

        setMessage(request, "Account locked");

    }



    protected void setMessage(HttpServletRequest request, String message)

    {

        request.setAttribute(ExtendedStatusSetter.LOGIN_FAILURE_MESSAGE_ATTR, message);

    }

}

DZone Snippets: java code

Overriding Tomcat Valve to return extended login failure status