SEAM - get url of base65 authentication

Question

Hi guys,

I have this config in my components.xml:

<web:authentication-filter url-pattern="/resource/rest/*" auth-type="basic"/>
<security:identity authenticate-method="#{basicAuthenticator.login}"/>

Well, my basicAuthenticator is a Stateless seam component where i have that login method which returns true/false depending on credentials.

I do really want to find the host (url adress) of the request.

Of course i can use ExternalContext like:

 @In(value = "#{facesContext.externalContext}", required = false)
 private ExternalContext externalContext;

but it gives me null because i have no jsf here...

Do you know any other way?

Thanks.

Answer 1

Cristian,

Because ServletFilter will always be called before FacesServlet, you will always get null.

So do not use

private @In FacesContext facesContext;

anymore when using Servlet Filter.

Solution: well, it can not be The best solution but it solves what you want to do

Create a CustomAuthenticationFilter as follows

@Scope(APPLICATION)
@Name("org.jboss.seam.web.authenticationFilter")
@Install(value = false, precedence = BUILT_IN)
@BypassInterceptors
@Filter(within = "org.jboss.seam.web.exceptionFilter")
public class CustomAuthenticationFilter extends org.jboss.seam.web.AbstractFilter {

    /** 
      * Because of some private methods defined in AuthenticationFilter
      * do Ctrl + C / Ctrl + V All of source code of AuthenticationFilter
      *
      * Except authenticate method which is shown bellow
      */

    private void authenticate(HttpServletRequest request, final String username) throws ServletException, IOException {
        new ContextualHttpServletRequest(request) {

            @Override
            public void process() throws ServletException, IOException, LoginException {
                Identity identity = Identity.instance();
                identity.getCredentials().setUsername(username);

                try {
                    identity.preAuthenticate();

                    /**
                      * Yes, THE SAME LOGIC performed by authenticate-method must goes here
                      */

                    /**
                      * Do not use @In-jection here
                      * 
                      * Use context lookup instead
                      * For instance, UserService userService = (UserService) Contexts.lookupInStatefulContexts("userService");
                      */

                    identity.postAuthenticate();
                } finally {
                    // Set password to null whether authentication is successful or not
                    identity.getCredentials.setPassword(null);    
                }
            }
        }.run();  
    }

}

Now overrides default AuthenticationFilter in /WEB-INF/componets.xml

<web:rewrite-filter view-mapping="/resource/rest/*"/>
<component name="org.jboss.seam.web.authenticationFilter" class="br.com.ar.seam.CustomAuthenticationFilter">  
    <property name="urlPattern">/resource/rest/*</property>
    <property name="authType">basic</property>
</component>

And To enable restURL do as follows

web.xml

<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>
<!--HERE GOES NON-REST INTERCEPTED URL-->
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>*.seam</url-pattern>
</servlet-mapping>
<!--HERE GOES REST INTERCEPTED URL-->
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/*</url-pattern>
</servlet-mapping>

Now, let's suppose you want to call /resource/rest/user which matchs restURL servlet-mapping. In /WEB-INF/pages.xml declare

<page view-id="<VIEW_ID_GOES_HERE>">
    <rewrite pattern="/resource/rest/user"/>
    <rewrite pattern="/resource/rest/{userId}"/>
    <!--userId comes from pattern shown above-->
    <param name="userId" value="#{userService.userId}"/>
</page>

To avoid FacesServlet intercept any client-side resource such as css, javaScript and images files, you can define

<servlet>
    <servlet-name>Seam Resource Servlet</servlet-name>
    <servlet-class>org.jboss.seam.servlet.SeamResourceServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>Seam Resource Servlet</servlet-name>
    <url-pattern>/resource/*</url-pattern>
</servlet-mapping>

Which does not apply JSF lifecycle. Make sure put Seam Resource Servlet above FacesServlet declaration.