title: Java EE 5 programmatic authentication
body: <p>How I can authenticate a user from JSF action (or in servlet <code>doGet</code>/<code>doPost</code> methods)?
  I mean something like:</p>
  
  <pre><code>Authenticator auth = ...;
  if (!auth.authenticate("user","password"))
  {
      FacesContext.getInstance().addMessage("Incorrect username or password", null);
  }
  </code></pre>
  
  <p>Restrictions:</p>
  
  <ul>
    <li>This method must be compatible with container managed security. (i.e. `HttpServletRequest.getRemoteUser()` must return authenticated user)</li>
    <li>This method must work everywhere (i.e. on each application server).</li>
  </ul>
  
  <p>Not using <code>j_security_check</code> or another J2EE authentication type (BASIC, DIGEST, etc...)</p>
  
  <p>It is possible?<br>
  Or how to create captcha in this way?<br>
  Validate that login and password is not empty?<br>
  On single page and without JavaScript, of course...</p>
  
  <p>Similar questions... but without answer on this question:</p>
  
  <p><a href="https://stackoverflow.com/questions/1187949/jsf-authentication-and-authorization">JSF authentication and authorization</a><br>
  <a href="https://stackoverflow.com/questions/2206911/best-way-for-user-authentication-on-javaee-6-using-jsf-2-0">Performing user authentication in Java EE / JSF using j_security_check</a></p>
  
  <p><strong>Edit 1</strong>:<br>
  I mean serlvet API at least 2.3.
  Yes, I read about <code>login</code> in Servlet API 3.0, but it is supported only by new versions of application servers.</p>
  
  <p>I think that here can be some solution that implements this authentication for each application server. 
  Sometimes via some hacks, sometimes via special classes designed for this purpose.
  Like this:</p>
  
  <pre><code>private Class&lt;?&gt; tryClass(String name)
  {
      try
      {
          return Class.forName(name);
      }
      catch (ClassNotFoundException e)
      {
          return null;
      }
  }
  
  public boolean authenticate(String username, String password) throws AuthenticationException
  {
      try
      {
  
          ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();
          Object request = context.getRequest();
          Object response = context.getResponse();
  
          Class&lt;?&gt; authClass = tryClass("com.sun.appserv.security.ProgrammaticLogin");
          if (authClass != null)
          {
              return (Boolean)authClass.getMethod("login").invoke(
                  authClass.newInstance(), "user", "password", request, response);
          }
  
          authClass = tryClass("org.jboss.web.tomcat.security.login.WebAuthentication");
          if (authClass != null)
          {
              return (Boolean)authClass.getMethod("login").invoke(
                  authClass.newInstance(), "user", "password");
          }
  
          // ... other hacks ...application servers 
  
      }
      catch (Exception e)
      {
          throw new AuthenticationException("an error occured during user authentication", e);
      }
  
      return false;
  }
  </code></pre>