Question

I’m trying to authenticate my Vaadin app with OpenID and I’m having difficulties with handling redirects in the app.

1. On loading the app, users are presented with an OpenID login utility which is a simple Vaadin window with some buttons that trigger redirects to a separate authentication servlet (LoginServlet)

2. LoginServlet then handles the redirection to the OpenID Provider and the subsequent redirection back to the servlet, which handles the authentication response. Security status is updated here (using Apache Shiro) which can be checked by the Vaadin app later.

3. LoginServlet then redirects to the application, however this is where the issue lies – how to handle this redirect? The Vaadin Window appears to have no method of handling redirects.

Currently the only option seems to be utilizing UriFragmentUtility.FragmentChangedListener and ensuring the redirect from LoginServlet is unique using a UUID ensuring the fragment changed event is fired, allowing the user’s authentication status to be checked and allowing access to the app. This however is something of a hack and leads to a messy URIFragment.

If anyone has any better ideas on integrating OpenID and Vaadin or just handling redirects in Vaadin, I’d be very grateful.

Answer 1

The proffered answer links to a very immature project which wasn’t suitable. I’ve chosen a different approach, which is handling all authentication at the servlet level. See my accepted answer on programmers which was based on the recommendations in the article Creating Secure Vaadin Applications using JEE6