LoginBB.java

package com.jsfcourse.security;

import javax.faces.application.FacesMessage;
import javax.faces.bean.ManagedBean;
import javax.faces.context.FacesContext;
import javax.servlet.http.HttpSession;

@ManagedBean
public class LoginBB {
    private static final String PAGE_MAIN = "index";
    private static final String PAGE_LOGIN = "login";
    private static final String PAGE_STAY_AT_THE_SAME = null;

    private String login;
    private String pass;

    public String getLogin() {
        return login;
    }

    public void setLogin(String login) {
        this.login = login;
    }

    public String getPass() {
        return pass;
    }

    public void setPass(String pass) {
        this.pass = pass;
    }

    public boolean validateData() {
        boolean result = true;
        FacesContext ctx = FacesContext.getCurrentInstance();

        // check if not empty
        if (login == null || login.length() == 0) {
            ctx.addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR,
                    "podaj login", "null"));
        }

        if (pass == null || pass.length() == 0) {
            ctx.addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR,
                    "podaj hasło", "null"));
        }

        if (ctx.getMessageList().isEmpty()) {
            result = true;
        } else {
            result = false;
        }
        return result;

    }

    public String doLogin() {
        FacesContext ctx = FacesContext.getCurrentInstance();
        User user = null;

        // 1. check parameters and stay if errors
        if (!validateData()) {
            return PAGE_STAY_AT_THE_SAME;
        }

        // 2. verify login and pass - get User from "database"
        user = getUserFromDatabase(login, pass);

        // 3. if bad login or pass - stay with error info
        if (user == null) {
            ctx.addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR,
                    "Niepoprawny login lub hasło", null));
            return PAGE_STAY_AT_THE_SAME;
        }

        // 4. if login ok - save User object in session
        HttpSession session = (HttpSession) ctx.getExternalContext()
                .getSession(true);
        session.setAttribute("user", user);

        // and enter the system
        return PAGE_MAIN;
    }

    public User getUser() {
        HttpSession session = (HttpSession) FacesContext.getCurrentInstance()
                .getExternalContext().getSession(true);
        return (User) session.getAttribute("user");
    }

    public String doLogout(){
        HttpSession session = (HttpSession) FacesContext.getCurrentInstance()
                .getExternalContext().getSession(true);
        //Invalidate session
        // - all objects within session will be destroyed
        // - new session will be created (with new ID)
        session.invalidate();
        return PAGE_LOGIN;
    }

    // simulate finding user in database
    private User getUserFromDatabase(String login, String pass) {
        User u = null;

        if (login.equals("login") && pass.equals("pass")) {
            u = new User(login, pass);
            u.setName("Jan");
            u.setSurname("Kowalski");

            // assumed system roles
            u.getRoles().add("role1");
            u.getRoles().add("role2");
            u.getRoles().add("admin");
        }

        return u;
    }

}