Temporarily bypass a closed user group page within a servlet | Community
Skip to main content
F
flkr
New Participant
October 16, 2015
Solved

Temporarily bypass a closed user group page within a servlet

  • October 16, 2015
  • 3 replies
  • 902 views

Hello,

I have a page, which is protected with a closed user group. Now I need to get the HTML-Markup of this (protected) page via a servlet.

The difficulty here is, that the user should not need to be logged in. I know it sounds weird, to protect a page just to make it vulnerable again through a servlet, but it is the customers wish. :)

My first step to solve this, was to create this servlet and use a RequestDispatcher object, which calls the "/content/.../targetpage.html":

StringWrapper responseWrapped = new StringWrapper(response); RequestDispatcher dispatcher = request.getRequestDispatcher("/content/blah/protectedsection/targetpage.html"); dispatcher.include(request, responseWrapped); String markup = responseWrapped.toString();

This works as expected: The RequestDispatcher calls the given resource and delivers the constructed HTML into my String object which I then can use for things to come.

But this works just as long as I am logged in. As soon as I logout, i.e. lose my sling authentication, the RequestDispatcher does not deliver anything. This is because it is just using the actual request of the user calling the servlet (who is not authenticated).

What I need, would be something like an internal "RequestDispatcherWithCredentials" (which does not exist, of course) which can access at least the pages I need.

Maybe there is a possibility to get administrative privileges temporarily within the servlet? For example, I know how to get an admin session and how to access any node within the jcr - independently from the credentials of the actual user. So there should be also a way to bypass closed user groups to get final HTML markup... I hope.

Has anyone an idea how I could solve this?

Thanks in advance for your help!

Florian

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    Best answer by JustinEd3

    Hi Florian,

    First off, let's just get this out of the way - this is a bad idea. You shouldn't do it. But you know that already smiley

    The way to handle this requirement is using the SlingRequestProcessor interface (http://sling.apache.org/apidocs/sling6/org/apache/sling/engine/SlingRequestProcessor.html). You'll also want to use the RequestResponseFactory to create synthetic request and response objects (http://dev.day.com/docs/en/cq/current/javadoc/com/day/cq/contentsync/handler/util/RequestResponseFactory.html).

    The code would look like this (ignoring service injections and error handling):

    HttpServletRequest request = requestResponseFactory.createRequest("GET", "/content/blah/protectedsection/targetpage.html"); ByteArrayOutputStream baos = new ByteArrayOutputStream(); HttpServletResponse response = rrFactory.createResponse(baos); ResourceResolver resolver = resourceResolverFactory.getAdministrativeResourceResolver(null); requestProcessor.processRequest(request, response, resolver); resolver.close();

    HTH,

    Justin

    P.S. Don't do this smiley

    3 replies

    J
    JustinEd3Accepted solution
    Employee
    October 16, 2015

    Hi Florian,

    First off, let's just get this out of the way - this is a bad idea. You shouldn't do it. But you know that already smiley

    The way to handle this requirement is using the SlingRequestProcessor interface (http://sling.apache.org/apidocs/sling6/org/apache/sling/engine/SlingRequestProcessor.html). You'll also want to use the RequestResponseFactory to create synthetic request and response objects (http://dev.day.com/docs/en/cq/current/javadoc/com/day/cq/contentsync/handler/util/RequestResponseFactory.html).

    The code would look like this (ignoring service injections and error handling):

    HttpServletRequest request = requestResponseFactory.createRequest("GET", "/content/blah/protectedsection/targetpage.html"); ByteArrayOutputStream baos = new ByteArrayOutputStream(); HttpServletResponse response = rrFactory.createResponse(baos); ResourceResolver resolver = resourceResolverFactory.getAdministrativeResourceResolver(null); requestProcessor.processRequest(request, response, resolver); resolver.close();

    HTH,

    Justin

    P.S. Don't do this smiley

      F
      flkrAuthor
      New Participant
      October 16, 2015

      Hi Justin,

      thanks for your help! I am still in the process of trying it out, but not yet getting it to run. (NullPointerException for any reason) ;)

      I have to take more time on friday (tomorrow are holidays in Germany).

      I'll update this post then.

      Thanks again!

      Florian

      F
      flkrAuthor
      New Participant
      October 16, 2015

      Hi again,

      it worked. Somehow I feel bad, but it worked... devil

      Right now I am implementing some security mechanisms to harden this construction at least a little bit.

      Thanks again!

      Florian

      Terms & ConditionsAccessibility statement

      Loading footer...