Brendan Healey wrote:Try this:
[Edit: sorry I just saw that you're using JSF 1.2 and couldn't comment on whether this is
valid on that version but it's got to be worth a go - good luck]
Tim Holloway wrote:Usually, a third-party SSO means that you're using container-managed security.
Container-managed security doesn't signal logon events and it doesn't route to a "welcome page". For the first case, that's because you might have logged in hours ago onto a different application on an SSO system, and that state will then apply to all other apps until you log out. For the second case, I happen to like it because it allows me to bookmark secured pages.
However, allowing for those limitations, you can do what you want and the easiest way is usually to use a servlet filter.
When a request comes in, after it's passed container security, it goes to the servlet filter. The servlet filter can then check the HttpServletRequest user ID against a stored user ID in the HttpSession. If the HttpSession doesn't exist or if there is no user ID stored in it, this is the user's first attempt to access the app after login. If the HttpServletRequest userid is null, the user isn't logged in yet.
In the case of first-entry detection, you can test to see which role(s) the user has and select the appropriate welcome page. The servlet filter can then redirect to that page in the usual way.
Pascal Lochmann wrote:
The problem here is, that i need the jsf-bean, which calls services to get more data, to decide what pages should be forward to. I could retrieve the faces-beans in the filter like mentioned in this blog ( http://www.thoughtsabout.net/blog/archives/000033.html ). It's a working solution, so thanks for your post.