servlet calling servlet stopped by security

Posted: 2003-12-21 11:54:00

java-programmer, servlet calling servlet stopped by security I have two servlets in the same tomcat webapp (A and B) both normally
accessed from the web. Sometimes A needs to access B and I use http to
do that. Actually 'B' is about a dozen other servlets, still all in
the same webapp.

This works just fine until I turn on security constraints. When I do
that and request A the login form works as normal and invokes A
correctly. But when A needs to invoke B I get another logon form
instead of B. This would be okay, I can hack through that, but I only
know the user name, not the password for A's session.

Is there a simpler way to have one servlet in the same webapp invoke
another without having to go through security? I cannot just do java
to java, there are too many entry points (ie cases of 'B') They are
all volatile and need to be exposed to the web.

Thanks for your help
Roger

Posted: 2003-12-21 18:31:00

java-programmer >> servlet calling servlet stopped by security Roger wrote:
> I have two servlets in the same tomcat webapp (A and B) both normally
> accessed from the web. Sometimes A needs to access B and I use http to
> do that. Actually 'B' is about a dozen other servlets, still all in
> the same webapp.
>
> This works just fine until I turn on security constraints. When I do
> that and request A the login form works as normal and invokes A
> correctly. But when A needs to invoke B I get another logon form
> instead of B. This would be okay, I can hack through that, but I only
> know the user name, not the password for A's session.
>
> Is there a simpler way to have one servlet in the same webapp invoke
> another without having to go through security? I cannot just do java
> to java, there are too many entry points (ie cases of 'B') They are
> all volatile and need to be exposed to the web.
>
> Thanks for your help
> Roger

I may be misunderstanding the question; but I think you could just do

a.getServletContext().getRequestDispatcher("/b").forward(request, response);

or

a.getServletContext().getRequestDispatcher("/b").include(request, response);

Posted: 2003-12-21 20:43:00

java-programmer >> servlet calling servlet stopped by security Do you have single-sign-on enabled in Tomcat? Ordinarily Tomcat requires authentication for each resource.

Roger wrote:
> I have two servlets in the same tomcat webapp (A and B) both normally
> accessed from the web. Sometimes A needs to access B and I use http to
> do that. Actually 'B' is about a dozen other servlets, still all in
> the same webapp.
>
> This works just fine until I turn on security constraints. When I do
> that and request A the login form works as normal and invokes A
> correctly. But when A needs to invoke B I get another logon form
> instead of B. This would be okay, I can hack through that, but I only
> know the user name, not the password for A's session.
>
> Is there a simpler way to have one servlet in the same webapp invoke
> another without having to go through security? I cannot just do java
> to java, there are too many entry points (ie cases of 'B') They are
> all volatile and need to be exposed to the web.
>
> Thanks for your help
> Roger

Posted: 2003-12-22 4:53:00

java-programmer >> servlet calling servlet stopped by security Bill Harrelson <bill.~remove~harrelson@accordare~remove~..com> wrote in message news:<bs44kb$gh9$email***@***.com>...
> Do you have single-sign-on enabled in Tomcat? Ordinarily Tomcat requires authentication for each resource.
>
>
>
> Roger wrote:
> > I have two servlets in the same tomcat webapp (A and B) both normally
> > accessed from the web. Sometimes A needs to access B and I use http to
> > do that. Actually 'B' is about a dozen other servlets, still all in
> > the same webapp.
> >
> > This works just fine until I turn on security constraints. When I do
> > that and request A the login form works as normal and invokes A
> > correctly. But when A needs to invoke B I get another logon form
> > instead of B. This would be okay, I can hack through that, but I only
> > know the user name, not the password for A's session.
> >
> > Is there a simpler way to have one servlet in the same webapp invoke
> > another without having to go through security? I cannot just do java
> > to java, there are too many entry points (ie cases of 'B') They are
> > all volatile and need to be exposed to the web.
> >
> > Thanks for your help
> > Roger

Bill: Single sign on allows you to sign on to multiple web apps, I am
only using one web app.

nobody? I think you are assuming the request to A is passed through to
B. This is not the case. A makes several different requests to B
(several different B's actually) during its life. There is no
similarity between the A requests and the B requests.

I managed to scrape together an answer so I'll put it here for others.
What I really had to do was get the jsessionid into the request header
to B and make it look like a cookie. This is achieved like so:

// in the doPost method on A...
String cookie = request.getHeader("cookie");
// gets me something like 'jsessionid=ABCDEF....'

//... code to get the URLConnection to B

urlConnection.setRequestProperty('cookie',cookie);

The request to B is then treated as part of the same session as the
request to A and does not require a fresh logon. As it happens all of
the B requests are context free so there is no collision with session
information. The only context I need to have is the logon.

Thanks for the suggestions
Roger