JSF HTTP Session Login

Question

Hello All ! i try to create login form in web application. in JSP page i can use

<%
   String name = request.getParameter( "username" );
   session.setAttribute( "theName", name );
%>

but now i using JSF /Facelets for web application i dont know how to create session in JSF Backing bean for client and check if user login or not login it will redirect into login page? who can help me give me link tutorial for these problem ? thank you before

Now i have little problem with mapping into web.xml code snipped of class Filter

@Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.config = filterConfig;
    }

 @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;
        LoginController controller = (LoginController) req.getSession().getAttribute("loginController");
        if (controller == null || !controller.isLoggedIn()) {
            res.sendRedirect("../admin/login.xhtml");
        } else {
            chain.doFilter(request, response);
        }

    }

and in web.xml i map with tag

<filter>
        <filter-name>userLoginFilter</filter-name>
        <filter-class>com.mcgraw.controller.UserLoginFilter</filter-class>
    <init-param>
      <param-name>loginPage</param-name>
      <param-value>/login.xhtml</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>userLoginFilter</filter-name>
    <url-pattern>/admin/*</url-pattern>

  </filter-mapping>

i have one folder admin in web project and i check user not login with permission admin not to access page ( i can do check permission) but when i user filter browser dont unserstand url ?? not StackTrace show when browser dont understand url

Error show on Firefox

The page isn't redirecting properly

on IE it loading ... loading . .. non-stop

now i change condition which check if req.getPathInfo.startsWith("/login.xhtml") it will do chain

i have 2 idea but it response 500 HTTP STATUS

if (controller == null || !controller.isLoggedIn()) {

                res.sendRedirect("../admin/login.xhtml");
                if(req.getPathInfo().startsWith("/login.xhtml")){
                    chain.doFilter(request, response);
                }

        } else {
            chain.doFilter(request, response);
        }

===============

if (controller == null || !controller.isLoggedIn()) {


                if(!req.getPathInfo().startsWith("/login.xhtml")){
                   res.sendRedirect("../admin/login.xhtml");
                }else{
                         chain.doFilter(request, response);
                  }

        } else {
            chain.doFilter(request, response);
        }

====================== update Class loginController

package com.mcgraw.controller;

import com.DAO.UserBean;
import com.entity.IUser;
import java.io.Serializable;
import javax.ejb.EJB;
import javax.faces.bean.ManagedBean;
import javax.faces.bean.SessionScoped;

/**
 *
 * @author Kency
 */
@ManagedBean
@SessionScoped
public class LoginController implements Serializable{
    @EJB
    private UserBean userBean;
    private IUser user;
    private boolean admin  ;
    private boolean mod  ;
    private PasswordService md5;




    /** Creates a new instance of LoginController */
    public LoginController() {
        user = new IUser();

        md5 = new PasswordService();


    }

    //getter / setter
     public boolean isMod() {
        return mod;
    }

    public void setMod(boolean mod) {
        this.mod = mod;
    }


    public IUser getUser() {
        return user;
    }

    public void setUser(IUser user) {
        this.user = user;
    }
    public boolean isAdmin() {
        return admin ;
    }

    public void setAdmin(boolean admin) {
        this.admin = admin;
    }




     public String cplogin() {


        String md5Password = md5.md5Password(user.getPassword());
        if (userBean.userLogin(user.getUsername(), md5Password) != null) {

           if(user.getUsername() != null || md5Password != null){
               user = userBean.userLogin(user.getUsername(), md5Password);
               if(user.getGroups().getAdmin() != null){
                    setAdmin(user.getGroups().getAdmin());

               }
               if(user.getGroups().getMods() != null){
                    setMod(user.getGroups().getMods());
                }
               if(isAdmin() == true || isMod() == true){

                    return "home";

               }else{
                return "login";
               }
           }else {
            return "login";
           }



        } else {

            return "login";
        }
    }





    public String logout() {
        user = null;
        return "login";
    }

    public boolean isLoggedIn() {
        return user != null;
    }




}

i have new problem if render JSF taglib with methog loggedIn, in index page (not in admin folder) user doesn't login can see what i render example, <== this like if user doesn't login user can't see but why can he see it?

Answer 1

Try this in your backing bean when a request is received (like in an action method):

HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
HttpSession session = request.getSession();

Then you can work with the request and session objects just like you used to with JSPs, setting attributes and so on.

You might also want to take a look at my related question about checking the client session in a servlet Filter. You could write a similar Filter to check for the user login in their HttpSession and then do a redirect (or RequestDispatch like I ended up doing) to your login page if needed.

Answer 2

Create a session scoped managed bean which roughly look like this:

@ManagedBean
@SessionScoped
public class UserManager {
    private String username;
    private String password;
    private User user;

    public String login() {
        user = userDAO.find(username, password);
        if (user != null) {
            username = password = null;
            return "home";
        } else {
            setMessage("Unknown login, please retry.");
            return "login";
        }
    }

    public String logout() {
        user = null;
        return "login";
    }

    public boolean isLoggedIn() {
        return user != null;
    }

    // ...
}

In the Facelets page, just bind the username and password input fields to this bean and invoke login() action accordingly.

<h:form>
    <h:inputText value="#{userManager.username}" />
    <h:inputSecret value="#{userManager.password}" />
    <h:commandButton value="login" action="#{userManager.login}" />
</h:form>

When testing if the user is logged in, make use of the UserManager#isLoggedIn() in some rendered attribute, e.g.

<h:panelGroup rendered="#{userManager.loggedIn}">
    <p>Welcome, #{userManager.user.fullName}</p>
</h:panelGroup>

No need to fiddle with raw servlet API like that. Session scoped beans are stored as session attribtues anyway.

---

As to checking if an user is logged in or not, just create a Filter which does roughly the following in doFilter() method:

HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
UserManager userManager = (UserManager) req.getSession().getAttribute("userManager");
if (userManager == null || !userManager.isLoggedIn()) {
    res.sendRedirect("login.xhtml");
} else {
    chain.doFilter(request, response);
}

Map it on an url-pattern covering the restricted pages, e.g. /secured/*. Note that the managed bean name is exactly the session attribute name.