Question

I am using Tomcat realm for security and my question is that I didn’t know where to get the user’s information after logging in.

I want to use the role of the user that has logged on and I don’t know what Tomcat sets in it’s session after logging on.

Answer 1

Tomcat follows the servlet specification and makes the user’s information available to your webapp in two ways:

1. Use request.getUserPrincipal to get the java.security.Principal that represents the user. You can call Principal.getName to get the user’s name.
2. Use request.isUserInRole to check if a user has a particular role.

Note that you can’t just get “the user’s role” because the user may have multiple roles. The standard API does not include a way to get all the user’s roles: you have to check for them individually.