getRemoteUser and getAuthType methods
The getRemoteUser and getAuthType methods are methods of the javax.servlet.http.HttpServletRequest interface. If the user has been authenticated, the getRemoteUser method returns the login of the user that makes the request. If the user is not authenticated, the getRemoteUser method returns null. The getAuthType method returns the name of the authentication scheme that is used to protect the servlet (for example, BASIC or SSL). If the servlet is not protected, the getAuthType method returns null.
For both methods, the data that is returned depends upon whether security is enabled in the application server where the servlet is deployed. The following possibilities exist:
- If security is not enabled, a servlet is requested and it is configured with Web server protection. The getRemoteUser method returns the login and getAuthType method returns the authentication scheme.
- If security is enabled and a servlet is requested, both methods return null when WAS protection is not configured for the servlet.
- If security is enabled, a servlet is requested, and the servlet is configured with WAS protection, then the getRemoteUser method returns the login and the getAuthType method returns the configured authentication scheme.
Attention: We can disable security at the application server level by overriding the global security setting. For more information, see Securing specific application servers .
Related tasks
Developing with programmatic security APIs for Web applications Related reference
Example: Using a programmatic security model for a Web application