Topic
  • 4 replies
  • Latest Post - ‏2013-12-04T14:50:11Z by c.high
Isotonic
Isotonic
2 Posts

Pinned topic Weblogic ServletAuthentication migration to Websphere

‏2013-11-27T17:12:28Z |

Hi All,

I'm working on a project migrating java code used in a web application from Weblogic to Websphere.

Is there an equivalent class to the weblogic ServletAuthentication in Websphere?

specifically is calls the method ServletAuthentication.runAs this method sets the current thread identity and current session identity given a subject.

http://docs.oracle.com/cd/E15051_01/wls/docs103/javadocs/weblogic/servlet/security/ServletAuthentication.html#runAs(javax.security.auth.Subject, HttpServletRequest)

Regards,

Iso

  • AlexMulholland
    AlexMulholland
    32 Posts

    Re: Weblogic ServletAuthentication migration to Websphere

    ‏2013-11-27T20:45:11Z  

    Hi Iso,

    You can configure the runAs role in your web.xml (or use the @RunAs annotation)and map it to a user in ibm-application-bnd.xmi/xml or the server.xml file as shown at this link:

    http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-express-dist&topic=twlp_sec_runas

    Does that do what you need?

     

    Regards, Alex.

     

  • Isotonic
    Isotonic
    2 Posts

    Re: Weblogic ServletAuthentication migration to Websphere

    ‏2013-11-28T10:47:32Z  

    Thanks Alex,

    I sort of understand how that would work but is there a programmatic way to achieve the same?

    A bit of background; This authentication is required when one web application calls another web application. It's done via a URL call from an ADF web application.

    Regards,

    Iso

     

  • kark
    kark
    26 Posts

    Re: Weblogic ServletAuthentication migration to Websphere

    ‏2013-12-02T19:56:55Z  
    • Isotonic
    • ‏2013-11-28T10:47:32Z

    Thanks Alex,

    I sort of understand how that would work but is there a programmatic way to achieve the same?

    A bit of background; This authentication is required when one web application calls another web application. It's done via a URL call from an ADF web application.

    Regards,

    Iso

     

    Hi,

    You can use the getSSOCookieFromSSOToken method to get the cookie from the initial login and set it in the request for the other web application. More information  here.

    Also, you can use the methods in com.ibm.websphere.security.WSSubject to get the current subject and use the doAs or setRunAsSubject if you need set the subject on a different thread.

    --Ajay

  • c.high
    c.high
    1 Post

    Re: Weblogic ServletAuthentication migration to Websphere

    ‏2013-12-04T14:50:11Z  

    Hi Iso,

    Have you looked at the IBM WebSphere Application Server Migration Toolkit for assistance in your migration?  It is an Eclipse-based free tool that scans your code looking for Java, JSP, XML and classpath issues that might need migrating.  It is available at:  http://www.ibm.com/developerworks/websphere/downloads/migtoolkit/compmig.html.

    ServletAuthentication is a class that the tool flags.  The tool provides help to use HttpServletRequest.login() and HttpServletRequest.logout()methods.  I am interested in hearing the solution you used so that we might incorporate new information to expand the rule help. 

    I am also interesting in hearing if you tried the tool.  You can reply here or the migration toolkit forum is at:

    https://www.ibm.com/developerworks/community/forums/html/forum?id=11111111-0000-0000-0000-000000002106

     

    Thanks,

    Cindy