Docs

Docs

Container-Managed Authentication

Letting the servlet container authenticate the users of a plain servlet Vaadin application.

Instead of checking the credentials against its own user store, as in Setting Up Security, an application can let the servlet container authenticate its users. The container checks the credentials against a security realm, which is a repository of users, their passwords, and their roles, and sets the user on the request itself.

HttpServletRequest.login() logs a user in through the realm. Replace authenticate() of the SecurityUtils class in Setting Up Security with the following, and leave out the filter:

Source code
Java
public static boolean authenticate(String username, String password) {
    HttpServletRequest request = VaadinServletRequest.getCurrent()
            .getHttpServletRequest();
    try {
        request.login(username, password);
        request.changeSessionId(); // Protects against session fixation.
        return true;
    } catch (ServletException e) {
        return false; // The credentials don't match.
    }
}

Role names in @RolesAllowed are passed unchanged to isUserInRole(), so they have to match the role names of the realm exactly.

How to configure a realm depends on the servlet container. Some containers also require an authentication method, configured with <login-config> in web.xml, before login() can be used. See the documentation of your container. The following examples use realms that read the users from a file, which is convenient for development. Both containers also provide realms that read the users from a database.

Tomcat

Tomcat’s UserDatabaseRealm reads the users from conf/tomcat-users.xml:

Source code
$CATALINA_HOME/conf/tomcat-users.xml
<tomcat-users>
  <role rolename="admin" />
  <role rolename="user" />
  <user username="test" password="password1" roles="user" />
  <user username="admin" password="password2" roles="user,admin" />
</tomcat-users>

To read the users from a database instead, use DataSourceRealm. See Realm Configuration in the Tomcat documentation.

Jetty

Jetty’s HashLoginService reads the users, their passwords, and their roles from a properties file:

Source code
realm.properties
test: password1,user
admin: password2,user,admin

Register the login service for the web application — for example, in a context XML file in the webapps directory of $JETTY_BASE — and point it to the properties file, as described in the Jetty documentation. To read the users from a database instead, use JDBCLoginService. In Jetty 12.1, which supports Jakarta EE 11, the web application classes are in an environment-specific package, such as org.eclipse.jetty.ee11.webapp.

A0A3832E-663B-47A6-B108-78F36B608B77

Updated –