saving login state with static variable - JSF2 - jsf-2

Question

I like to know whats the correct way to create a login/logout mechanizm in jsf2 environment.
I have created a login xhtml form and a Admin bean that stores a static boolean (is_authenticated) . I want to check that variable in every xhtml page , if true? continue , else redirect to login page.
this is Admin.java bean:
#ManagedBean
#SessionScoped
public class Admin implements Serializable {
/**
*
*/
private static final long serialVersionUID = 1L;
static Boolean authenticated;
String username;
String password;
#PostConstruct
public void initialisation() { // init bean on new instance
Admin.authenticated = false;
}
public Boolean getAuthenticated(){
return Admin.authenticated;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String doLogout() {
Admin.authenticated=false;
return "login?faces-redirect=true";
}
public String validity() {
if(username.equals("admin") && password.equals("admin")) {
Admin.authenticated=true;
return "success";
} else {
Admin.authenticated=false;
return "failure";
}
}
}
and this is the main.xhtml:
<?xml version="1.0" encoding="UTF-8" ?>
<ui:composition template="template.xhtml"
xmlns="http://www.w3.org/1999/xhtml"
xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:c="http://java.sun.com/jsp/jstl/core"
xmlns:ui="http://java.sun.com/jsf/facelets">
<ui:define name="content">
<c:if test="#{admin.authenticated == false}">
// update Admin.authenticate to false
<meta http-equiv="refresh" content="0;URL=login.xhtml" />
</c:if>
<h1>Statistics</h1>
<div style="margin:10px">
<h:panelGrid columns="3">
Advertisers:
<h:outputText value="#{stats.advertisers}"/>
<h:outputText value=""/>
Publishers:
<h:outputText value="#{stats.publishers}"/>
<h:outputText value=""/>
Campaigns:
<h:outputText value="#{stats.campaigns}"/>
<h:outputText value="(#{stats.activeCampaigns} active)"/>
Banners:
<h:outputText value="#{stats.banners}"/>
<h:outputText value="(#{stats.activeBanners} active)"/>
Games:
<h:outputText value="#{stats.games}"/>
<h:outputText value="(#{stats.activeGames} active)"/>
</h:panelGrid>
</div>
</ui:define>
</ui:composition>
Two questions:
in the jstl 'if' ,I get : "Property 'authenticated' not found on
type com.pkg.name.Admin"
How can I update Admin.authenticate to false from the xhtml file(sorry for the lame question, i'm really new to jsf and web dev in general)
is it good practice to use this static variable? (like an instance of the session variable)

Answer 1

According to me the correct and cleaner way to implement login/logout is to create a filter and apply it to the urls that should be protected(e.g. /admin/*).
If the user sucessfully logs in load his details in session bean. When the user requests a protected page the filter runs first. In the filter get the session from request and call its getAttribute method to get the session bean(jsf stores the session scoped beans as session attributes). If you get the bean object then he is logged in else if you get null he is not authorized and you can redirect him to login page.
For logout you can just call invalidate on the session and all the session scoped attributes will be destroyed.
A working example will be like following:
The SessionScoped bean which will save login information:
UserBean.java
#ManagedBean
#SessionScoped
class UserBean implements Serializable{
private User user;
//getter/setter for user
}
LoginBean.java
#ManagedBean
class LoginBean
{
#ManagedProperty(value="#{userBean}")
private UserBean userBean;
public UserBean getUserBean(){
return userBean;
}
public void setUserBean(UserBean userBean){
this.userBean=userBean;
}
private String username,password;
//getter and setter for username,password
public String checkLogin(){
//check database for user
if(user!=null){
userBean.setUser(user);
}
//...
}
}
LoginFilter.java- We apply this filter to url pattern: /admin/*
#WebFilter("/admin/*")
class LoginFilter implements Filter{
#Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException {
HttpSession session=((HttpServletRequest)request).getSession();
userBean userBean=(userBean)session.getAttribute("userBean");
if(userBean!=null){
User user=userBean.getUser();
if(user==null){
((HttpServletResponse)response).sendRedirect("login.jsf");
}
else
chain.doFilter(request, response);
}
else
((HttpServletResponse)response).sendRedirect("login.jsf");
}
public void init(FilterConfig fc){}
public void destroy(){}
}
login.xhtml
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:f="http://java.sun.com/jsf/core">
<h:head><title>Login To Admin Panel</title>
</h:head>
<h:body>
<h:form>
Username : <h:inputText value="#{loginBean.username}"/>
Password : <h:inputSecret value="#{loginBean.password}"/>
<h:commandButton value="Login" action="#{loginBean.checkLogin}" />
</h:form>
</h:body>
</html>
For log out you can simply call session.invalidate() which will destroy the session along with any session scoped attributes.
This way you don't have to write conditional jstl tags to determine whether the use is logged in or not.
Hope this helps.