Case insensitive check for role in HttpServletRequest

Question

The javax.servlet.http.HttpServletRequest class has a method called isUserInRole. I use this to check if a user has, for example, the admin role. However, that method is case sensitive. So, if the role in the request was Admin or ADMIN, then isUserInRole("admin") would be false. I use the isUserInRole method in a number of places accross multiple applications to check for a number of different roles.

Is there a way to achieve the isUserInRole functionality case-insensitively that does not require checking each different possible case combination with isUserInRole?

Answer 1

You could implement a filter that wraps requests using a HttpServletRequestWrapper - implement your HttpServletRequestWrapper to override the isUserInRole() method to make it case-insensitive (eg, configure all roles in upper-case, test role params by converting to upper-case).

A quick search will find plenty of HTTPServletRequestWrapper examples...

Answer 2

http://docs.oracle.com/javaee/6/tutorial/doc/gjiie.html

Just map multiple role names to the admin role:

<servlet>
    <security-role-ref>
        <role-name>admin</role-name>
        <role-link>admin</role-link>
    </security-role-ref>
    <security-role-ref>
        <role-name>Admin</role-name>
        <role-link>admin</role-link>
    </security-role-ref>
</servlet>

<security-role>
    <role-name>admin</role-name>
</security-role>