Get User from SlingHttpServletRequest -> ResourceResolver -> Session in Servlet | Community
Skip to main content
J
jarvis_cl_lukow
Level 2
November 19, 2021
Solved

Get User from SlingHttpServletRequest -> ResourceResolver -> Session in Servlet

  • November 19, 2021
  • 3 replies
  • 3577 views

Hi there community,

 

I am looking to get the current logged in user from the SlingHttpServletRequest.  I am using a POST servlet that extends the SlingAllMethodsServlet.

 

I can confirm that the login-token cookie is being sent with the request:

String tokenCookie = TokenCookie.fromRequest(request).toString();

The tokenCookie string is populated with the correct login-token value. I have tried both GET and POST requests, and the cookie value is always correct.  And, if I push that cookie into a browser and visit /crx/de I see the respective user logged in.

 

I have tried using the trusty resourceResolver adapted to a session to get the user:

final ResourceResolver resolver = request.getResourceResolver();
final Session session = resolver.adaptTo(Session.class);
final String username = session.getUserID();

This always returns anonymous

 

I have tried using the request attribute:

String userSessionName = (String)request.getAttribute("org.osgi.service.http.authentication.remote.user");

This always returns anonymous

 

I have tried using the request principal

Principal principal = request.getUserPrincipal();
String principalName = principal.getName();

This always returns anonymous

 

I did try using a service user session, as some have suggested, but as I expected that approach returns the service user rather than the actual request user.

 

What am I missing? I have been scratching my head all day on this issue, and I hope I am just missing something simple.


Thanks in advance

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Asutosh_Jena_

Hi @jarvis_cl_lukow 

 

You are doing it correct. I don't see any issue with the code and the same code even I tried to use and it works perfectly fine for me.

 

@Component(service = Servlet.class, property = {"process.label=Test Servlet",
        Constants.SERVICE_DESCRIPTION + "=" + "This Servlet is responsible for getting User Id",
        ServletResolverConstants.SLING_SERVLET_PATHS + "=" + HttpConstants.METHOD_GET,
        ServletResolverConstants.SLING_SERVLET_PATHS + "=/bin/getuser"})
public class TestServlet extends SlingSafeMethodsServlet {

    private static final long serialVersionUID = 1L;

    private static final Logger log = LoggerFactory.getLogger(TestServlet.class);

    @Override
    protected void doGet(SlingHttpServletRequest request, SlingHttpServletResponse response) throws ServletException, IOException {
        log.info("***** :: doGet :: Start :: *****");

        String tokenValue = TokenCookie.fromRequest(request).toString();
        log.info("Token Value --> {}", tokenValue);

        ResourceResolver resourceResolver = request.getResourceResolver();
        Session session = resourceResolver.adaptTo(Session.class);
        String userID = session.getUserID();
        log.info("User Id from Session --> {}", userID);

        String userFromRequestAttr = (String) request.getAttribute(HttpContext.REMOTE_USER);
        log.info("User Id from Request Attribute --> {}", userFromRequestAttr);

        Principal userPrincipal = request.getUserPrincipal();
        String principalName = userPrincipal.getName();
        log.info("User Id from User Principal --> {}", principalName);

        log.info("***** :: doGet :: End :: *****");
    }
}

 

This is what I see in the log:

 

20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet ***** :: doGet :: Start :: *****
20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet Token Value --> 34f0ab69-2f2e-4db4-99ae-6c99ca725a64%3a9bffb662-e7e2-49c3-b16a-17639e6efecd_ea05f9202272a988fb0b2f1a9db07e6c%3acrx.default%3b7adb6be4-c538-4689-ab8f-236ddd613c5e%3abecbf06b-212b-4924-aa7b-967473d84dad_a0e48ed735c2c4d839ba9e3101678478%3acrx.default
20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet User Id from Session --> user-one
20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet User Id from Request Attribute --> user-one
20.11.2021 19:35:43.384 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet User Id from User Principal --> user-one
20.11.2021 19:35:43.384 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet ***** :: doGet :: End :: ***** 

 

 

Make sure when this code is executed, the user is always logged in and an anonymous user is not making this request.

3 replies

Asutosh_Jena_
Community Advisor
Asutosh_Jena_Community AdvisorAccepted solution
Community Advisor
November 20, 2021

Hi @jarvis_cl_lukow 

 

You are doing it correct. I don't see any issue with the code and the same code even I tried to use and it works perfectly fine for me.

 

@Component(service = Servlet.class, property = {"process.label=Test Servlet",
        Constants.SERVICE_DESCRIPTION + "=" + "This Servlet is responsible for getting User Id",
        ServletResolverConstants.SLING_SERVLET_PATHS + "=" + HttpConstants.METHOD_GET,
        ServletResolverConstants.SLING_SERVLET_PATHS + "=/bin/getuser"})
public class TestServlet extends SlingSafeMethodsServlet {

    private static final long serialVersionUID = 1L;

    private static final Logger log = LoggerFactory.getLogger(TestServlet.class);

    @Override
    protected void doGet(SlingHttpServletRequest request, SlingHttpServletResponse response) throws ServletException, IOException {
        log.info("***** :: doGet :: Start :: *****");

        String tokenValue = TokenCookie.fromRequest(request).toString();
        log.info("Token Value --> {}", tokenValue);

        ResourceResolver resourceResolver = request.getResourceResolver();
        Session session = resourceResolver.adaptTo(Session.class);
        String userID = session.getUserID();
        log.info("User Id from Session --> {}", userID);

        String userFromRequestAttr = (String) request.getAttribute(HttpContext.REMOTE_USER);
        log.info("User Id from Request Attribute --> {}", userFromRequestAttr);

        Principal userPrincipal = request.getUserPrincipal();
        String principalName = userPrincipal.getName();
        log.info("User Id from User Principal --> {}", principalName);

        log.info("***** :: doGet :: End :: *****");
    }
}

 

This is what I see in the log:

 

20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet ***** :: doGet :: Start :: *****
20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet Token Value --> 34f0ab69-2f2e-4db4-99ae-6c99ca725a64%3a9bffb662-e7e2-49c3-b16a-17639e6efecd_ea05f9202272a988fb0b2f1a9db07e6c%3acrx.default%3b7adb6be4-c538-4689-ab8f-236ddd613c5e%3abecbf06b-212b-4924-aa7b-967473d84dad_a0e48ed735c2c4d839ba9e3101678478%3acrx.default
20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet User Id from Session --> user-one
20.11.2021 19:35:43.383 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet User Id from Request Attribute --> user-one
20.11.2021 19:35:43.384 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet User Id from User Principal --> user-one
20.11.2021 19:35:43.384 *INFO* [[0:0:0:0:0:0:0:1] [1637417143382] GET /bin/getuser HTTP/1.1] com.test.core.servlet.TestServlet ***** :: doGet :: End :: ***** 

 

 

Make sure when this code is executed, the user is always logged in and an anonymous user is not making this request.

    J
    jarvis_cl_lukowAuthor
    Level 2
    November 20, 2021

    @asutosh_jena_ Thanks for validating this for me.  I thought I was doing this right 🤔 🤔

    Something must be interfering with the request processing flow.  I'll keep looking and update the thread once I find the resolution.

      Kiran_Vedantam
      Community Advisor
      Kiran_VedantamCommunity Advisor
      Community Advisor
      November 21, 2021

      Hi @jarvis_cl_lukow 

       

      Are you trying in author or publish? Here is the difference it makes

      In author instance: Request is always made via the user who is logged in (ex: admin)

      In publish instance: Request is always made via anonymous user (This could be the reason that you are facing the issue)

       

      You are sending the token from request but its not necessary that the session created in your servlet using request is being created by the same user. Try in author instance once to validate.

       

      Thanks,

      Kiran Vedantam.

        J
        jarvis_cl_lukowAuthor
        Level 2
        November 22, 2021

        @kiran_vedantam Thanks for your reply.

        Correct me if I am wrong, but if a request is made to AEM and it contains a valid login-token, won't the authentication hander log the respective user into that AEM instance?  

        I can confirm that this behaviour is currently happening - if I add a valid login-token cookie in to the browser and visit /crx/de on author or publish the user is logged in.

        However, in the servlet the session does not contain the logged in (authenticated) user based on the cookie.  I assume the auth mechanism is happening after my servlet is invoked?

          Asutosh_Jena_
          Community Advisor
          Asutosh_Jena_Community Advisor
          Community Advisor
          November 22, 2021

          Hi @jarvis_cl_lukow 

           

          Are you not making this call post login?

            J
            jarvis_cl_lukowAuthor
            Level 2
            December 2, 2021

            Just incase anyone else stubbles upon this in the future, I would like to add that this issue is caused by allowing the "authorization" header in the dispatcher to pass through to the publish server.  When the authorization header is passed, it will take priority over the login-token when the authentication mechanism kicks in.

            In my case, I am using the authorization header to pass a JWT token for some requests, but when the token wasn't being included the authorization header resolved to user that didn't exist and therefore was anonymous

            Terms & ConditionsAccessibility statement

            Loading footer...