Listen to tomcat realm authentication events

Question

I need to know when tomcat accepts a login using realm authentication for a given context. I've been looking at the possible listeners available (ServletContextListener and ServletContextAttributeListener) but can't figure out how to be notified when a login occurs. This should also work when using tomcat single sign on for multiple contexts. Any ideas?

BalusC · Accepted Answer · 2015-08-13T06:41:50.507

7

Unfortunately there's no standard/abstract way to hook on it using the Servlet API. You need either to write appserver specific logic or to implement a global Filter which checks the HttpServletRequest#getUserPrincipal() everytime. E.g.:

public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) {
    HttpServletRequest request = (HttpServletRequest) req;
    Principal user = request.getUserPrincipal();
    HttpSession session = request.getSession(false);

    if (user != null && (session == null || session.getAttribute("user") == null)) {
        request.getSession().setAttribute("user", user);

        // First-time login. You can do your intercepting thing here.
    }

    chain.doFilter(req, res);
}

edited Aug 13 '15 at 06:41

answered Nov 12 '09 at 18:06

BalusC

1,082,665
372
3,610
3,555

This looks exactly to what I need. How about for logouts? perhaps looking at the session expiration event? – Ricardo Marimon Nov 13 '09 at 00:12
If `HttpSession#invalidate()` is been used to logout, then you can indeed hook on `HttpSessionListener#sessionDestroyed()` and check if the `user` attribute is there. – BalusC Nov 13 '09 at 02:32
I used `httpRequest.getSession(false)` to prevent wasteful session creation. – Peter L Jun 06 '14 at 03:07
I had to use Principal instead of UserPrincipal, but it worked like a charm! – Rafael R. S. Robles Aug 12 '15 at 23:25

score 1 · Answer 2 · answered Nov 12 '09 at 17:54

If you have access to the server configuration, you might try writing a LifecycleListener (http://tomcat.apache.org/tomcat-6.0-doc/api/org/apache/catalina/LifecycleListener.html), which are configured with the server (see the tomcat server config docs for your version).

Not sure if it will do the trick or not, but a good place to check.

Good luck.

Listen to tomcat realm authentication events

2 Answers2

Linked