Jetty UserRealm redirect on 3th failed login

Question

If I have a custom Jetty UserRealm implementation and its configured for basic authentication (with SSL), is there any way to get it to go to an specific page after the 3rd failed login?

Well really I just want to display some contact information to the user if they cannot login after 3 attempts.

Alternatively is it possible to display the exception which I throw from the

public Principal authenticate(final String username, final Object credentials, final Request request) 

method when its configured as basic authentication?

Thanks Neil

Answer 1

The BasicAuthenticator is responsible for sending the 403 response when there's no valid credentials in the request.

Looking at the Jetty 6 source, you're best bet is probably to subclass the BasicAuthenticator and override public void sendChallenge(UserRealm realm,Response response)

public class MyAuthenticator extends BasicAuthenticator {
    @Override
    public void sendChallenge(UserRealm realm, Response response) {
        int numberOfAttempts = getNumberOfAuthenticationAttempts();

        if (numberOfAttempts > 3) {
            sendContactDetails(realm, response);
        }
        else
            super.sendChallenge(realm, response);
    }

    protected int getNumberOfAuthenticationAttempts() { ... }
    protected void sendContactDetails(Response response) { ... }

}

Obviously the problem doing this is that you don't have access to the HttpServletRequest which may make tracking request attempts more difficult. You could probably gain access to this via HttpConnection.getCurrentConnection(). Otherwise the code for BasicAuthenticator doesn't lend itself to extension without a blob of copy/paste, but that may be OK in your case.

I'm ignoring the issue of how you track the number of requests have been made in the same authentication attempt, that's going to be dependent upon how your clients are connecting.

Alternatively you can set the ErrorHandler on the context, which is used when HttpResponse.sendError is called, which will be the case when you throw an exception in your realm.

I'd probably opt to use the first method as it more clearly separates responsibilities.