0

I mean a user ID can't be auth in two different machines at the same time. How can I control this? I'm using the Java EE platform.

3 Answers 3

0

Every time a user logs in you give him some token (Session ID, for example). Later, when user performs some operations you're receiving this token from him and validates it against your internal data storage (a database, for example). If validation succeeds you let the user in.

In order to disable multiple logins from different computers your token should include, among other data, an ID of the machine. During a) login and b) validating you will compare the ID from the token and a real ID of currently used machine.

0

Spring-security has concurrency control in session. See http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#concurrent-sessions.

0

Java EE doesn't provide a direct solution for this scenario.

You might introduce a servlet Filter to enforce your restriction:

  • Keep track of whether a user is logged in or not, and reject requests coming in for a duplicate user. If you're going to want to scale up then track that in a database, not at application scope [though an application scoped hash table would be a quick-and-dirty prototype solution].

  • You might use HttpServletRequest.getRemoteAddr to distinguish between two incoming computers, HOWEVER this won't help distinguish two computers behind the same router.

  • Inject an EJB into the filter to handle your JPA requests; using an EJB will eliminate other issues.

  • Deploy the filter on all your servlets (else you'll have a security hole):

    @WebFilter({"/*"})
    public class SecurityFilter extends AbstractSecurityFilter { ... }
    
  • AbstractSecurityFilter, defined below, augments the standard Java EE security check. It will reduce the overhead of checking on every incoming servlet request, making the full check only for "new logins". It'll also handle the rejection logic. It DOES NOT implement the authentication being discussed, but may provide a basis for such.

Sub-class and provide definitions for the authenticate and getFailedLoginPage() methods:

/***
 * Augment the Java EE security check(s).
 * 
 * Java EE Security is the primary check, so this filter doesn't take any action
 * until after the user successfully logs in through the standard Java EE security
 * mechanisms. Once logged in, the method authenticate is called to perform
 * the custom checks. If these checks fail the user is logged out and forwarded
 * to the page returned by getFailedLoginPage().
 */
public abstract class AbstractSecurityFilter implements Filter
{
    protected static final String ATTR__IS_AUTHENTICATED = AbstractSecurityFilter.class.getName() + ".authenticated";


    /**
     * @return true if request meets our authentication requirements. 
     */
    protected abstract boolean authenticate(HttpServletRequest request, HttpServletResponse response);

    protected abstract String getFailedLoginPage();


    @Override
    final public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
            throws IOException, ServletException
    {
        /**
         * 
         * Order of events (and order is somewhat important): <code>
         * 
         * - ignore if user has not logged in (if Java EE Security hasn't required login, neither do we here).
         * 
         * - check for this filter's ATTR__IS_AUTHENTICATED flag to be set on the session attributes:
         *   if set we have nothing else to do.
         * 
         * - call authenticate...
         *   - on failure: logout, forward to failedLoginPage, and return (cancel remainder of this request).
         *   - on success: set ATTR__IS_AUTHENTICATED flag in the session attributes.
         * 
         * </code>
         */

        if (request instanceof HttpServletRequest) {
            final HttpServletRequest httpRequest = (HttpServletRequest)request;

            final HttpSession session = httpRequest.getSession(false);
            if (session != null) {
                /*
                 * Ignore if user has not (yet) logged in; let JEE Security filter(s) do their job(s) first.
                 */
                final Principal userPrincipal = httpRequest.getUserPrincipal();
                if (userPrincipal != null) {

                    // Check that user has not been fully "verified".
                    final Object attribute = session.getAttribute(ATTR__IS_AUTHENTICATED);
                    if (attribute == null) {
                        if ( !authenticate(httpRequest, (HttpServletResponse)response) {
                            httpRequest.logout();

                            final ServletContext servletContext = httpRequest.getServletContext();
                            servletContext.getRequestDispatcher(getFailedLoginPage()).forward(request, response);
                            return;
                        }

                        // User has passed local checks; record so we don't have to do this again.
                        final String name = userPrincipal.getName();
                        session.setAttribute(ATTR__IS_AUTHENTICATED, name);
                    }
                }
            }
        }

        chain.doFilter(request, response);
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.