Getting the user principal in Restlet over Tomcat

Question

I have a web application deployed on Tomcat, which uses Tomcat's form authentication. When writing a new servlet, this allows me to find a request's user via HttpServletRequest#getUserPrincipal.

I would like to use Restlet in this app, and I was able to do so using Restlet's ServerServlet adaptor. However, it looks like I no longer have access to the user principal when receiving a new request in my resource classes. That is, the user prinicpal information is not carried through from Tomcat to Restlet.

Is there any way of obtaining the principal?

I just found out that the information is available in the request, by casting it to an `HttpRequest`: `((HttpRequest)getRequest()).getHttpCall().getUserPrincipal()` — user154940, Aug 08 '14 at 12:33

score 0 · Answer 1 · answered May 19 '15 at 07:49

You should use the user principal with Restlet. As a matter of fact, Restlet has its own mechanism regarding security based on the challenge response. This allows to authenticate the user for a request, get its roles and set within ClientInfo#user. The servlet extension must be seen as an adapter to embed a Restlet engine within a servlet container but you shouldn't rely on the servlet API.

Here is the way to use security with Restlet:

public class MyApplication extends Application {
    public Restlet createInboundRoot() {
        Router router = new Router(getContext());
        (...)

        ChallengeAuthenticator ca = new ChallengeAuthenticator(getContext(),
            ChallengeScheme.HTTP_BASIC, "admin");

        Verifier verifier = (...)
        Enroler enroler = new MyEnroler(this);

        ca.setNext(router);
        return ca;
    }
}

Here is a sample implementation of Verifier:

public class MyVerifier extends SecretVerifier {
    @Override
    public boolean verify(String identifier, char[] secret) {
        System.out.println(identifier);
        System.out.println(secret);
        //TODO compare with the Database
        return true;
    }
}

Here is a sample implementation of Enroler:

public class MyEnroler implements Enroler {
    private Application application;

    public MyEnroler(Application application) {
        this.application = application;
    }

    public void enrole(ClientInfo clientInfo) {
        Role role = new Role(application, "roleId",
                        "Role name");
        clientInfo.getRoles().add(role);
    }
}

You can then have access the security / authentication hints from the request within filter, server resource, ..., as described below:

User user = getRequest().getClientInfo().getUser();
List<Role> roles = getRequest().getClientInfo().getRoles();

You can notice this mechanism is opened in Restlet and can support a wide set of authentication (oauth2, ...). It's not really the good approach to use cookie-based authentication with REST. That said, you can use it even with Restlet.

Hope it helps you, Thierry

Getting the user principal in Restlet over Tomcat

1 Answers1