2

I have implemented both kerberos sso login and username/password login for my J2EE web app.

sso.jsp handles single sign on and login.jsp handles username/password login respectively.

User access www.example.com/index.jsp and in index.jsp I will check if the configured login type (in the configuration file) is SSO or Database and redirects the user to the respective jsp pages.

But there is a security issue that the user is able to access www.example.com/login.jsp when I have set the configuration login type to SSO.

How do I prevent the user from directing accessing login.jsp and yet is able to access login.jsp, when I set the login type to Database, which stands for username/password authentication, and vice versa for SSO.

1 Answer 1

1

Why don't you detect the request to login.jsp, check if the login type is sso, and then redirect to sso.jsp? This should be done in a servlet filter.

@WebFilter(urlPatterns = "/login.jsp")
public class SecurityFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        final String loginType = request.getParameter("login-type");

        final HttpServletResponse servletResponse = (HttpServletResponse) response;
        if ("sso".equalsIgnoreCase(loginType)) {
            final String redirectUrl = "sso.jsp";
            servletResponse.sendRedirect(redirectUrl);
        } else {
            chain.doFilter(request, response);
        }
    }

}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.