Create a servlet filter which will enable external servlets (those not in the portal war) to be authorized by the portal.

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: None
• Fix Version/s: 4.4.0
• Component/s: None
• Labels: None
• Similar Issues: Show 5 results ; ;

  LEP-6023	Allow all servlet filters to be enabled or disabled off via properties
  LEP-2297	Custom servlets running in the ROOT context
  LEP-211	"background" servlets
  LEP-1578	Servlet 2.3 backwards support
  LEP-1213	Optional servlet session sharing across the portal and portlet WAR

This means that calls like req.getRemoteUser() will succeed.

[Raymond Auge]

The side effect of this solution seems to be that we get the same session for servlets in the portlet war as the portlet, which is very cool, but I'm not sure if this side effect will be the same on other app servers/containers (I've only tested tomcat55).

Anyone having details on this please pipe in.

[Raymond Auge]

here is an example with the sample-struts-liferay-portlet.

in the web.xml add the following:

<filter>
<filter-name>Auto Login Filter</filter-name>
<filter-class>com.liferay.portal.kernel.servlet.PortalClassLoaderFilter</filter-class>
<init-param>
<param-name>filter-class</param-name>
<param-value>com.liferay.portal.servlet.filters.autologin.AutoLoginFilter</param-value>
</init-param>
</filter>
<filter>
<filter-name>Servlet Authorizing Filter</filter-name>
<filter-class>com.liferay.portal.kernel.servlet.PortalClassLoaderFilter</filter-class>
<init-param>
<param-name>filter-class</param-name>
<param-value>com.liferay.portal.servlet.filters.external.ServletAuthorizingFilter</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>Auto Login Filter</filter-name>
<url-pattern>/test_session/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>Servlet Authorizing Filter</filter-name>
<url-pattern>/test_session/*</url-pattern>
</filter-mapping>

The result is that the session becomes shared between the portlet and the servlet. As well the req.getRemoteUser() and calls requiring access to the user principle succeed where before they would not.

[Brian Chan]

Nice filter Ray. Changed package to match name. Looks good!

[Brian Chan]

Use "com.liferay.portal.servlet.filters.servletauthorizing.ServletAuthorizingFilter" instead.

[Raymond Auge]

Logic needs hardening.

[Raymond Auge]

This statement is wrong: "The result is that the session becomes shared between the portlet and the servlet."

The servlet spec specifies that sharing the session between two web applications is not supposed to occur. So, we need to look into how to get hotdeployed portlets to have a session from the WAR rather than from the portal, as it should be, so that the portion of the portlet spec regarding common session between servlet and portlets in the same webapp can be upheld.

[Raymond Auge]

Reverted... that last RememberMeAutoLogin fix isn't required.

[marco ferretti]

I have been trying to use this filter in 5.3.2 but it looks like it is not fired ?!? Is there any documentation/examples on how to use liferay filters ?