Java Web应用程序，tomcat 6

Question

I have my web.xml like this I have added a tag <login-config> at the end

  <?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <display-name>LoginRemote</display-name>
  <welcome-file-list>

    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
  <servlet>

    <description></description>
    <display-name>remoteSample</display-name>
    <servlet-name>remoteSample</servlet-name>
    <servlet-class>com.src.remoteSample</servlet-class>
  </servlet>

  <servlet-mapping>

    <servlet-name>remoteSample</servlet-name>
    <url-pattern>/remoteSample</url-pattern>
  </servlet-mapping>
  <security-constraint>
      <web-resource-collection>
        <web-resource-name>Secure</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
      </web-resource-collection>
    </security-constraint>
<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>default</realm-name>
</login-config>
</web-app>

and my server is tomcat 6 i have made tomcatAuthenication as "false"

<Connector connectionTimeout="20000" port="9000" protocol="HTTP/1.1" redirectPort="8443" />

and then my Servlet is this i get a null for request.getRemoteUser() and request.getAuthType() what should i do to get the client's username to a remote machine?

 package com.src;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;



public class remoteSample extends HttpServlet {
    private static final long serialVersionUID = 1L;


    public remoteSample() {
        super();
        // TODO Auto-generated constructor stub
    }

    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
     */
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // TODO Auto-generated method stub
        response.setContentType("text/html;charset=UTF-8");
        System.out.println("login info:"+request.getHeader("Authentication"));
        System.out.println("Authentication type:"+request.getAuthType());
        //printWriter.println(""+ServiceContextHolder.getContext().getAuthentication().getName());
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
     */
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // TODO Auto-generated method stub
    }

}

Answer 1

Adding login-config alone is not enough. You're missing two things:

1. The value of tomcatAuthentication should definitely be true , otherwise Tomcat assumes that authentication is done by another service (eg Apache HTTP) and therefore doesn't try to perform any sort of authentication.

2. You also have to tell Tomcat which resources require authentication and which don't. For that, you should add something like this to your web.xml:

<security-constraint>
      <web-resource-collection>
        <web-resource-name>Secure</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
      </web-resource-collection>
    </security-constraint>

There's a tutorial that shows how you can also add a custom page for prompting users for authentication and to ensure that Tomcat always does it over https.

Also, if you choose to use BASIC authentication then another way to solve this problem is by inspecting the value of the Authentication header by calling request.getHeader("Authentication") and extracting the user information directly from the Base64-encoded string that appears after "BASIC". However, note that when Tomcat processes the authentication, it also removes the Authorization header from the request, meaning that you can use this approach as an alternative to the having Tomcat handle the authentication but not in conjunction with it.