title: How to acess HttpServletRequest in Jaas login module in Tomcat
body: <p>We have a task to certify our application in Tomcat7 which is already certified and running in Websphere.</p>
  
  <p>Our application in websphere has JAAS custom login module and it access HttpServletRequest object via callback handlers as shown below and we set user related information in the session object (which is retrieved from request).</p>
  
  <pre><code>javax.security.auth.callback.Callback callbacks[] = new javax.security.auth.callback.Callback[3];
  callbacks[0] = new javax.security.auth.callback.NameCallback(
              "Username: ");
  callbacks[1] = new javax.security.auth.callback.PasswordCallback(
              "Password: ", false);
  callbacks[2] = new com.ibm.wsspi.security.auth.callback.WSServletRequestCallback(
              "HttpServletRequest: ");
  </code></pre>
  
  <p>The problem here is that, as you see, the above code is specific to websphere. So, we want to write another custom login module specific to Tomcat. Excuse me, this is designed by someone else.</p>
  
  <p><strong>Now the queustion is how can I access HttpServletRequest/HttpSession object in Jaas login module in Tomcat?</strong></p>
  
  <p>Note: I have tried to use ThreadLocal to pass the user information instead HttpServeletRequest but it appears that it is not advised since threads are reused from Thread Pool in Tomcat and there could be a potential problems (memory leak, user information shared etc) in case if we don't clear the ThreadLocal properly.</p>