In RTC project,we can see our own created workitems for project.My colleague's workitem Change by field value is himself,but mine is also his name(Bold part as below).
The session part in web application is this:
package com.ibm.workitemCreator.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.log4j.Logger;
import com.ibm.workitemCreator.common.Constant;
import com.ibm.workitemCreator.common.CreatorConfig;
import com.ibm.workitemCreator.service.IAuditLogService;
public class LoginFilter implements Filter {
private static final String USER_VALID_IDS = "user.valid.ids";
private static final Logger log = Logger.getLogger(LoginFilter.class);
// private IAuditLogDao auditLogDao;
private IAuditLogService auditLogService;
@Override
public void destroy() {
// TODO Auto-generated method stub
}
@Override
public void doFilter(ServletRequest sRequest, ServletResponse sResponse,
FilterChain chain) throws IOException, ServletException {
log.info("Pre login filter");
HttpServletRequest request = (HttpServletRequest) sRequest;
HttpServletResponse response = (HttpServletResponse) sResponse;
String user = request.getParameter("j_username");
String password = request.getParameter("j_password");
log.info("Pre login filter, username: " + user);
HttpSession session = request.getSession();
if(!isValidUser(user)){
session.setAttribute(Constant.LOGIN_RESULT, "error");
session.setAttribute(Constant.LOGIN_ERROR_MSG, "Your ID is invalid!");
String indexPage=request.getContextPath()+"/login.jsp";
response.sendRedirect(indexPage);
return;
}
// create a new session for every login
if (session != null) {
session.invalidate(); // invalidate existing session
}
session = request.getSession(true); // create a new Session ID...
chain.doFilter(request, response);
Throwable t = com.ibm.websphere.security.auth.WSSubject
.getRootLoginException();
if (null != t) {
log.info("Post login filter, t.getMessage() " + t.getMessage());
// t.getMessage();
session.setAttribute(Constant.LOGIN_RESULT, "error");
session.setAttribute(Constant.LOGIN_ERROR_MSG, "Your ID or Password is invalid!");
getAuditLogService().writeLogonLog(user,"logonerr", 0);
}else{
session.setAttribute(Constant.LOGIN_USER, user);
session.setAttribute(Constant.LOGIN_USER_PWD, password);
getAuditLogService().writeLogonLog(user,"logon", 0);
log.info("Post login filter, login success, user # " + user);
}
log.info("Post login filter, user # " + user);
}
private boolean isValidUser(String user) {
String validUsersId=CreatorConfig.getStringValue(USER_VALID_IDS);
log.debug("validUsersId: "+validUsersId);
if(null==validUsersId){
return false;
}
String[] array = validUsersId.split(",");
for(int i=0;i<array.length;i++){
String temp = array[i];
if(user.equalsIgnoreCase(temp.trim())){
return true;
}
}
return false;
}
@Override
public void init(FilterConfig arg0) throws ServletException {
// TODO Auto-generated method stub
}
public void setAuditLogService(IAuditLogService auditLogService) {
this.auditLogService = auditLogService;
}
public IAuditLogService getAuditLogService() {
return auditLogService;
}
}
Comments
Hi Mr. Jayee Huang,
Could you please elaborate more on the situation. I see that you have created your own web application which in turn uses Java client api to create workitems automatically in RTC. (Hope i'm correct till now...). Now 2 different people are accessing RTC server from your web application at the same time..., I`m guessing some problem in session handling in your web application. Please do recheck and kindly acknowledge if that is not the problem.