extend form based authentication

[Viv Singh]

i have implemented a form based authentication. however, i would like an "extension". In my database i have a column "last_login". whenever, a user succesfully loggs in to the web app a message is show e.g.: welcome mr ... you last logged in on 23/01/2008 14:34:40.

my first question is when shall i store the login date/time in the database and how?

[Andrea Gazzarini]

Hi Viv,
I suppose that you are already using one of the JAAS login module (probably the database login module) configured on <server_conf>/conf/login-config.xml.

So, for example, I have this one on my configuration file:

    
application-policy name = "jbossmq">
       <authentication>
          <login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule"
             flag = "required">
             <module-option name = "unauthenticatedIdentity">guest</module-option>
             <module-option name = "dsJndiName">java:/DefaultDS</module-option>
             <module-option name = "principalsQuery">SELECT PASSWD FROM JMS_USERS WHERE USERID=?</module-option>
             <module-option name = "rolesQuery">SELECT ROLEID, 'Roles' FROM JMS_ROLES WHERE USERID=?</module-option>
          </login-module>
       </authentication>
    </application-policy>

I think that simply you should have a look how it is implemented the DatabaseServerLoginModule. After that you can extends or decorate it (it depends on its implementation).

Regards,

[Jaikiran Pai]

"a.gazzarini"

Please check your private message for a message from JavaRanch.

[Viv Singh]

is the username stored somewhere in the session after i get authenticated?

i would like to write the following when the user logs in:

welcome user_123, you last logged in on 23/11/2008.

thanks in advance.
[ November 23, 2008: Message edited by: Viv Singh ]

[Andrea Gazzarini]

Hi, you can use the request.getRemoteUser() where of course "request" is an instance of HttpServletRequest. As Javadoc says :

"Returns the login of the user making this request, if the user has been authenticated, or null if the user has not been authenticated. Whether the user name is sent with each subsequent request depends on the browser and type of authentication. Same as the value of the CGI variable REMOTE_USER"

Hope it helps

[Viv Singh]

thanks for your help.

i also need to get the role which is fetched from the database when the authentication is done. how can i get that?

i checked the api and there is only one method request.isUserInRole("1") that returns a boolean. is there any other way to actually get the role of the user that is "logged" in.

thanks in advance.