Urgent, Pls help!! Customize usersbyusernamequery

[karldmoore]

Ok, but how many filters are ever created. If the filter has global state and two users try to login are you going to have problems?

[kuanfai]

Ok, but how many filters are ever created. If the filter has global state and two users try to login are you going to have problems?

Hi karldmoore, thank you so much for your remind. The problem with my implementation is that the one user will be automatically logged out if another user logs out. Referring to your implementation, the question is how to get the UsernamePasswordAuthenticaitonToken from dao class? Since the dao class doesn't have the access to the request or session object.

[kuanfai]

Hi karldmoore, thank you so much for your remind. The problem with my implementation is that the one user will be automatically logged out if another user logs out. Referring to your implementation, the question is how to get the UsernamePasswordAuthenticaitonToken from dao class? Since the dao class doesn't have the access to the request or session object.

Referring to my previous reply, I figured out the way to implement your suggestion:

public class XdAuthenticationProcessingFilter extends AuthenticationProcessingFilter {

protected String obtainEmailmobile(HttpServletRequest request) {
return request.getParameter(StandardValue.EMAILMOBILE);
}

public Authentication attemptAuthentication(HttpServletRequest request) throws AuthenticationException {
String username = obtainUsername(request);
String password = obtainPassword(request);
String emailmobile = obtainEmailmobile(request);

if (username == null) {
username = "";
} else {
username = username + ":" + emailmobile;
}

if (password == null) {
password = "";
}

UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

// Place the last username attempted into HttpSession for views
request.getSession().setAttribute(ACEGI_SECURITY_L AST_USERNAME_KEY, username);

// Allow subclasses to set the "details" property
setDetails(request, authRequest);

return this.getAuthenticationManager().authenticate(authR equest);
}

}

and

public class XdJdbcDaoImpl extends JdbcDaoImpl {

private String userquery = super.getUsersByUsernameQuery();
private boolean usernameBasedPrimaryKey;

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {

String emailmobile = username.substring(username.indexOf(":") + 1);
String queryusername = username.substring(0, username.indexOf(":"));

if (emailmobile.equalsIgnoreCase(StandardValue.EMAIL) ) {
userquery = "SELECT email AS USERNAME, password, '1' AS ENABLED " +
"FROM user, access WHERE user.id = access.id AND user.email = ?";
} else if (emailmobile.equalsIgnoreCase(StandardValue.MOBILE NO)) {
userquery = "SELECT mobileno AS USERNAME, password, '1' AS ENABLED " +
"FROM user, access WHERE user.id = access.id AND user.mobileno = ?";
}

this.usersByUsernameMapping = new UsersByUsernameMapping(getDataSource());

List users = usersByUsernameMapping.execute(queryusername);

if (users.size() == 0) {
throw new UsernameNotFoundException("User not found");
}

UserDetails user = (UserDetails) users.get(0); // contains no GrantedAuthority[]

List dbAuths = authoritiesByUsernameMapping.execute(user.getUsern ame());

addCustomAuthorities(user.getUsername(), dbAuths);

if (dbAuths.size() == 0) {
throw new UsernameNotFoundException("User has no GrantedAuthority");
}

GrantedAuthority[] arrayAuths = (GrantedAuthority[]) dbAuths.toArray(new GrantedAuthority[dbAuths.size()]);

String returnUsername = user.getUsername();

if (!usernameBasedPrimaryKey) {
returnUsername = queryusername;
}

return new User(returnUsername, user.getPassword(), user.isEnabled(), true, true, true, arrayAuths);

}

protected class UsersByUsernameMapping extends MappingSqlQuery {
protected UsersByUsernameMapping(DataSource ds) {
super(ds, userquery);
declareParameter(new SqlParameter(Types.VARCHAR));
compile();
}

protected Object mapRow(ResultSet rs, int rownum)
throws SQLException {
String username = rs.getString(1);
String password = rs.getString(2);
boolean enabled = rs.getBoolean(3);
UserDetails user = new User(username, password, enabled, true, true, true, new GrantedAuthority[] {new GrantedAuthorityImpl("HOLDER")});

return user;
}
}

}

It does not need to get the session in order to get the emailmobile. It has been passed into the loadUserByUsername as part of the input "username".

Regarding to the logout issue, I realized it happens only to the two tabs under one explorer, both implementations are ok for separate explorers. This might be not a problem in the first place as you questioned me for the global filter concern, but just because I tested it in the same window. Anyway, thanks for your help, the second methods seem to be more concise.

[karldmoore]

Thanks for posting back. That is exactly what I was suggesting, although it still doesn't feel quite right, it solves the problem! Glad you got it working!