Question

I have an apache webserver that is used to serve php and static web files. In order to use active directory authentication i’ve written some code that can connect to AD through JNDI and authenticate usernames passwords and groups. What I would like is to map all requests to pages in apache through my servlet in order to make sure that a valid session is present and then if they have to login again that they have the correct AD group to visit a particular url. My issue is that when I map my servlet to every url with /* it cannot forward requests to the actual pages that I’m trying to get. It just keeps forwarding the request to my servlet and calling its doGet method till a servlet exception occurs. I want the functionality of a transparent proxy but I cannot seem to get that from this. Does anyone have any concrete examples of a transparent proxy servlet or know a way to do this with servlets. The forwarding functionality of a servlet seems to make this a perfect vehicle for doing it but I seem to be stuck.

Filter code

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest req = (HttpServletRequest)request;
    HttpServletResponse res = (HttpServletResponse)response;
    boolean authenticated = false; //should be false when testing is done.
    //skip if its the login page
    if(req.getRequestURI().equals("/auth/login.jsp") || authenticated){
        chain.doFilter(req, res);   
    }else{
        req.setAttribute("protectedUrl", req.getRequestURI());
        res.sendRedirect("/auth/login.jsp");
    }
}

Web.xml

(snip)
<filter-mapping>
   <filter-name>SessionFilter</filter-name>
   <url-pattern>/*</url-pattern>
   <dispatcher>REQUEST</dispatcher>
</filter-mapping>

Answer 1

Because the servlet is mapped on /*, the RequestDispatcher#forward() will call it again, resulting in an infinite loop and finally a StackOverflowError (or some other exception depending on the servletcontainer in question which might have some recursion prevention builtin which kicks in after a certain amount of recursive calls).

After all, the Servlet is not entirely the right tool for the job, you’d rather like to use a Filter here. Implement javax.servlet.Filter and do the same job in doFilter() method. It won’t call itself recursively when mapped on /* since it by default listens on requests only, not on forwards or includes.