I want my Domino Servlet to get an authenticated u

问题:

It seems a like a pretty fundamental question, in a running Servlet hosted on Domino I want to access Domino resources that I have wisely protected using the the very fine security of IBM Notes and Domino.

I want the Servlet to be able to read and write data to Domino whilst keeping that data from the client that called the Servlet (or xAgent) and preventing the client from writing directly.

I'd be happy to be able to get a session that represented the signer of the application. I can get a session for a registered user by calling the Servlet using ?open&login and signing in. That's not practical.

I've looked here: How can you use SessionAsSigner in a Java Bean called from an XPage? where Mark Leusink (https://stackoverflow.com/users/1177870/mark-leusink) implies the use of ExtLib's getCurrentSessionAsSigner() could be used. I've tried it, having signed the whole application with a single user id and it doesn't return a session. The answer seems to lie in the Servlet's inability to get a FacesContext object.

This feels like the answer should be obvious but it isn't to me. Any ideas?

回答1:

FacesContext is JSF stuff and can be used from XAgent (=XPage).

In a servlet you can do this:

Session session = NotesFactory.createSession(null, "user", "password");

Server ID usually has no password and doing this will use the server ID:

Session session = NotesFactory.createSession();

回答2:

Check the source of the WebDav project on OpenNTF. It has all the code you need

回答3:

There have been lots of good answers to the original question. Thanks very much.

The solution I propose to use is to port the code I have to OSGi plugins. It appears that java code/Servlets within the NSF context are subject to security controls that are relaxed when the same code runs within the OSGi context. The code:

try {
NotesThread.sinitThread();
Session s = NotesFactory.createSession("","<my username>","<my password>");
.....
session = null;
} catch (Exception e) {
} finally {
NotesThread.stermThread();
}

Runs fine in the OSGI context, but within in an NSF produc

回答4:

com.ibm.domino.osgi.core.context.ContextInfo.getUserSession()

回答5:

Jason - I assume you basically want the same functionality you would get running a Web Query Save agent if you didn't select run as Web User selected, in other words as the signer of the code.

You could try setting up a internet site rule to allow basic authentication for the specific application path you wanted to use - might be worth using a subdomain for this.

Then within the Servlet call this URL, whilst setting the Basic authorization parameters (username & password).

Something like this.

URL url = new URL(URL_TO_CALL);
String authStr = "USERNAME:PASSWORD";
String authEncoded = Base64.encodeBytes(authStr.getBytes());
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
connection.setRequestMethod("GET");
connection.setDoOutput(true);
connection.setRequestProperty("Authorization", "Basic " + authEncoded);
InputStream is = connection.getInputStream();