How to get user roles in a JSP / Servlet

Question

Hi,

Is there any way to get a String[] with the roles a user has in the JSP or Servlet?

I know about request.isUserInRole("role1") but I also want to know all the roles of the user.

I searched the servlet source and it seems this is not possible, but this seems odd to me.

So... any ideas?

Answer 1

The answer is messy.

First you need to find out what type request.getUserPrincipal() returns in your webapp.

    System.out.println("type = " + request.getUserPrincipal().getClass());

Let's say that returns org.apache.catalina.realm.GenericPrincipal.

Then cast the result of getUserPrincipal() to that type and use the methods it provides.

    final Principal userPrincipal = request.getUserPrincipal();
    GenericPrincipal genericPrincipal = (GenericPrincipal) userPrincipal;
    final String[] roles = genericPrincipal.getRoles();

I said it was going to be messy. It's not very portable either.

Answer 2

Read in all the possible roles, or hardcode a list. Then iterate over it running the isUserInRole and build a list of roles the user is in and then convert the list to an array.

String[] allRoles = {"1","2","3"};
HttpServletRequest request = ... (or from method argument)
List userRoles = new ArrayList(allRoles.length);
for(String role : allRoles) {
 if(request.isUserInRole(role)) { 
  userRoles.add(role);
 }
}

// I forgot the exact syntax for list.toArray so this is prob wrong here
return userRoles.toArray(String[].class);