T
three-eight-hotel
Hi all,
We have a home-grown Portal application, that basically acts as an
authentication/authorization tool, simply providing links to other
applications, based on a user login. When a user clicks on a link, he/
she has been authorized to, the users browser is redirected to the
application, with some additional information POSTed along... we have
some web services to allow applications to utilize those POSTed
parameters by checking to see if the user is in fact logged into our
Portal, so the application can make a determination whether or not to
let them in. We also have some mechanisms that allow the applications
to keep the Portal session alive while the user is currently
participating in the applications session (in most cases on different
web and application servers, entirely)
As users navigate to different applications, from our Portal, the
Portal tracks the users application usage, so when the user logs out,
the Portal can send a logout notification to each application the user
visited, allowing the application to perform their own session
termination. Since it's the Portal sending a POST, rather than the
browser, we are struggling with how the application being called would
know how to get ahold of the session context and how it would know
"which" session to terminate. Since the applications already receive
information we POST, we though we could simply POST similar
information on logout, but the question still remains on how we get
access to the session context to even use that information???
The basic methodology is that the Portal has a URL defined for each
application's logout location, which is typically a Servlet. When a
user logs out of the Portal, we are going to iterate through the a
list of applications the user accessed, sending a POST to their logout
URL.
We are all new to intermediate Java developers, so forgive me if I'm
overlooking something obvious. Any thoughts or recommendations would
be greatly appreciated!
Best Regards,
Todd
We have a home-grown Portal application, that basically acts as an
authentication/authorization tool, simply providing links to other
applications, based on a user login. When a user clicks on a link, he/
she has been authorized to, the users browser is redirected to the
application, with some additional information POSTed along... we have
some web services to allow applications to utilize those POSTed
parameters by checking to see if the user is in fact logged into our
Portal, so the application can make a determination whether or not to
let them in. We also have some mechanisms that allow the applications
to keep the Portal session alive while the user is currently
participating in the applications session (in most cases on different
web and application servers, entirely)
As users navigate to different applications, from our Portal, the
Portal tracks the users application usage, so when the user logs out,
the Portal can send a logout notification to each application the user
visited, allowing the application to perform their own session
termination. Since it's the Portal sending a POST, rather than the
browser, we are struggling with how the application being called would
know how to get ahold of the session context and how it would know
"which" session to terminate. Since the applications already receive
information we POST, we though we could simply POST similar
information on logout, but the question still remains on how we get
access to the session context to even use that information???
The basic methodology is that the Portal has a URL defined for each
application's logout location, which is typically a Servlet. When a
user logs out of the Portal, we are going to iterate through the a
list of applications the user accessed, sending a POST to their logout
URL.
We are all new to intermediate Java developers, so forgive me if I'm
overlooking something obvious. Any thoughts or recommendations would
be greatly appreciated!
Best Regards,
Todd