Session “user_id” from spring project to non-spring project

Question

I'm working on a small Java EE project which is gonna join a much bigger one. The main project was designed using maven and spring frameworks. Mine don't as it's really a basic one.

Here is my problem :

The main project already logged the user using the Active Directory of the company and store it into spring. The code looks like this :

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    private final String URL = "blablablabla";
    private final int PORT = 389;
    private final String MANAGER_DN = "CN=blablablabla,OU=blablablabla,OU=blablablabla,OU=blablablabla,OU=blablablablaFund,OU=EBS,DC=blablablabla,DC=blablablabla,DC=blablablabla";
    private final String MANAGER_PASSWORD = "blablablabla";
    private final String GROUP_BASE = "OU=blablablabla,OU=blablablabla,OU=blablablabla,OU=blablablabla,DC=blablablabla,DC=blablablabla,DC=blablablabla";
    private final String USER_SEARCH_BASE = "DC=blablablabla,DC=blablablabla,DC=blablablabla";
    private final String USER_SEARCH_FILTER = "(sAMAccountName={0})";
    private final String GROUP_ROLE_ATTR = "blablablabla";
    private final String GROUP_SEARCH_FILTER = "(member={0})";
    private final String ROLE_LDIG_ALPHA = "blablablabla";

    @Override
    @Autowired
    protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
        authManagerBuilder
            .ldapAuthentication()
                .userSearchBase(USER_SEARCH_BASE)
                .userSearchFilter(USER_SEARCH_FILTER)
                .groupRoleAttribute(GROUP_ROLE_ATTR)
                .groupSearchFilter(GROUP_SEARCH_FILTER)
                .groupSearchBase(GROUP_BASE)
                .contextSource().url(URL).port(PORT).managerDn(MANAGER_DN).managerPassword(MANAGER_PASSWORD);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/**").hasRole(ROLE_LDIG_ALPHA)
                .anyRequest().authenticated()
                .and()
            .formLogin()
            .and()
            .httpBasic();
    }
}

Now I need to retrieve user session information from my servlet for example without having the user log again (I repeat : I do not use the spring framework)

Is that possible?

Answer 1

A simple implementation would be to create a cookie in authentication handling project and store related non-sensitive information in it, then read the cookie in the other project.

another implementation would be to use jndi to register your object and then read in other needed place.