Sign up for an{" "}
Auth0 account
{" "}
or{" "}
console.log("log in")}>
log in
{" "}
to your existing account to integrate directly with your own tenant.
;
};
export const sections = [{
id: "configure-auth0",
title: "Configure Auth0"
}, {
id: "integrate-auth0-in-your-application",
title: "Integrate Auth0 in your application"
}, {
id: "configure-your-java-application",
title: "Configure your Java application"
}, {
id: "create-the-authenticationcontroller",
title: "Create the AuthenticationController"
}, {
id: "login-redirection",
title: "Login Redirection"
}, {
id: "handling-the-tokens",
title: "Handling the tokens"
}, {
id: "display-the-home-page",
title: "Display the home page"
}, {
id: "handle-logout",
title: "Handle logout"
}, {
id: "run-the-sample",
title: "Run the sample"
}];
Auth0 allows you to quickly add authentication and gain access to user profile information in your application.
This guide demonstrates how to integrate Auth0 with any new or existing Java Servlet application.
To use Auth0 services, you’ll need to have an application set up in the Auth0 Dashboard. The Auth0 application is
where you will configure how you want authentication to work for the project you are developing.
### Configure an application
Use the interactive selector to create a new Auth0 application or select an existing application that represents
the project you want to integrate with. Every application in Auth0 is assigned an alphanumeric, unique client ID
that your application code will use to call Auth0 APIs through the SDK.
Any settings you configure using this quickstart will automatically update for your Application in the [Dashboard](https://manage.auth0.com/#/), which is where you
can manage your Applications in the future.
If you would rather explore a complete configuration, you can view a sample application instead.
### Configure Callback URLs
A callback URL is a URL in your application that you would like Auth0 to redirect users to after they have
authenticated. If not set, users will not be returned to your application after they log in.
If you are following along with our sample project, set this to
`http://localhost:3000/callback`.
### Configure Logout URLs
A logout URL is a URL in your application that you would like Auth0 to redirect users to after they have logged
out. If not set, users will not be able to log out from your application and will receive an error.
If you are following along with our sample project, set this to `http://localhost:3000/`.
### Setup dependencies
To integrate your Java application with Auth0, add the following dependencies:
* **javax.servlet-api**
: is the library that allows you to create Java Servlets. You then need to add a Server dependency like
Tomcat or Gretty, which one is up to you. Check our sample code for more information.
* **auth0-java-mvc-commons**: is the [Java library](https://github.com/auth0/auth0-java-mvc-common) that allows you to use Auth0 with Java for
server-side MVC web apps. It generates the Authorize URL that you need to call in order to authenticate and
validates the result received on the way back to finally obtain the [Auth0 Tokens](https://auth0.com/docs/tokens) that identify the user.
If you are using Gradle, add them to your `build.gradle`:
```text lines
// build.gradle
compile 'javax.servlet:javax.servlet-api:3.1.0'
compile 'com.auth0:mvc-auth-commons:1.+'W
```
If you are using Maven, add them to your `pom.xml`:
```text lines
com.auth0mvc-auth-commons[1.0, 2.0)javax.servletjavax.servlet-api3.1.0
```
Your Java App needs some information in order to authenticate against your Auth0 account. The samples read this
information from the deployment descriptor file `src/main/webapp/WEB-INF/web.xml`, but you could store
them anywhere else.
This information will be used to configure the **auth0-java-mvc-commons** library to enable users to login to
your application. To learn more about the library, including its various configuration options, see the [library's documentation](https://github.com/auth0/auth0-java-mvc-common/blob/master/README.md).
### Check populated attributes
If you downloaded this sample using the **Download Sample** button, the `domain`,
`clientId` and `clientSecret` attributes will be populated for you. You should verify that
the values are correct, especially if you have multiple Auth0 applications in your account.
### Project structure
The example project, which can be downloaded using the **Download Sample** button, has the following
structure:
```text lines
- src
-- main
---- java
------ com
-------- auth0
---------- example
------------ Auth0Filter.java
------------ AuthenticationControllerProvider.java
------------ HomeServlet.java
------------ CallbackServlet.java
------------ LoginServlet.java
------------ LogoutServlet.java
---- webapp
------ WEB-INF
-------- jsp
---------- home.jsp
-------- web.xml
build.gradle
```
The project contains a single JSP: the `home.jsp` which will display the tokens associated with the
user after a successful login and provide the option to logout.
The project contains a WebFilter: the `Auth0Filter.java` which will check for existing tokens before
giving the user access to our protected `/portal/*` path. If the tokens don't exist, the request will
be redirected to the `LoginServlet`.
The project contains also four servlets:
* `LoginServlet.java`: Invoked when the user attempts to log in. The servlet uses the
`client_id` and `domain` parameters to create a valid Authorize URL and redirects the
user there.
* `CallbackServlet.java`: The servlet captures requests to our Callback URL and processes the data
to obtain the credentials. After a successful login, the credentials are then saved to the request's
HttpSession.
* `HomeServlet.java`: The servlet reads the previously saved tokens and shows them on the
`home.jsp` resource.
* `LogoutServlet.java`: Invoked when the user clicks the logout link. The servlet invalidates the
user session and redirects the user to the login page, handled by the `LoginServlet`.
* `AuthenticationControllerProvider.java`: Responsible to create and manage a single instance of the
`AuthenticationController`
To enable users to authenticate, create an instance of the `AuthenticationController` provided by the
`auth0-java-mvc-commons` SDK using the `domain`, `clientId`, and
`clientSecret`. The sample shows how to configure the component for use with tokens signed using the
RS256 asymmetric signing algorithm, by specifying a `JwkProvider` to fetch the public key used to
verify the token's signature. See the [jwks-rsa-java repository](https://github.com/auth0/jwks-rsa-java) to learn about additional configuration options. If you
are using HS256, there is no need to configure the `JwkProvider`.
The `AuthenticationController` does not store any context, and is inteded to be reused.
Unneccessary creation may result in additonal resources being created which could impact performance.
To enable users to log in, your application will redirect them to the Universal Login page. Using the
`AuthenticationController` instance, you can generate the redirect URL by calling the
`buildAuthorizeUrl(HttpServletRequest request`, `HttpServletResponse response`,
`String redirectUrl)` method. The redirect URL must be the URL that was added to the **Allowed
Callback URLs** of your Auth0 application.
After the user logs in, the result will be received in our `CallbackServlet` via either a GET or POST
HTTP request. Because we are using the Authorization Code Flow (the default), a GET request will be sent. If you
have configured the library for the Implicit Flow, a POST request will be sent instead.
The request holds the call context that the library previously set by generating the Authorize URL with the
`AuthenticationController`. When passed to the controller, you get back either a valid
`Tokens` instance or an Exception indicating what went wrong. In the case of a successful call, you
need to save the credentials somewhere to access them later. You can use the `HttpSession` of the
request by using the `SessionsUtils` class included in the library.
It is recommended to store the time in which we requested the tokens and the received
`expiresIn` value, so that the next time when we are going to use the token we can check if
it has already expired or if it's still valid. For the sake of this sample, we will skip that
validation.
Now that the user is authenticated (the tokens exists), the `Auth0Filter` will allow them to access
our protected resources. In the `HomeServlet` we obtain the tokens from the request's session and set
them as the `userId` attribute so they can be used from the JSP code.
To properly handle logout, we need to clear the session and log the user out of Auth0. This is handled in the
`LogoutServlet` of our sample application.
First, we clear the session by calling `request.getSession().invalidate()`. We then construct the
logout URL, being sure to include the `returnTo` query parameter, which is where the user will be
redirected to after logging out. Finally, we redirect the response to our logout URL.
To run the sample from a terminal, change the directory to the root folder of the project and execute the
following line:
```text lines
./gradlew clean app
```
After a few seconds, the application will be accessible on `http://localhost:3000/`. Try to access the
protected resource [http://localhost:3000/portal/home](http://localhost:3000/portal/home) and note how you're redirected by the
`Auth0Filter` to the Auth0 Login Page. The widget displays all the social and database connections that
you have defined for this application in the [dashboard](https://manage.auth0.com/#/).
After a successful authentication, you'll be able to see the home page contents.
Log out by clicking the **logout** button at the top right of the home page.
## Next Steps
Excellent work! If you made it this far, you should now have login, logout, and user profile information running in your application.
This concludes our quickstart tutorial, but there is so much more to explore. To learn more about what you can do with Auth0, check out:
* [Auth0 Dashboard](https://manage.auth0.com/dashboard/us/dev-gja8kxz4ndtex3rq) - Learn how to configure and manage your Auth0 tenant and applications
* [auth0-java-mvc-common SDK](https://github.com/auth0/auth0-java-mvc-common) - Explore the SDK used in this tutorial more fully
* [Auth0 Marketplace](https://marketplace.auth0.com/) - Discover integrations you can enable to extend Auth0’s functionality
```xml web.xml lines
com.auth0.domaindev-gja8kxz4ndtex3rq.us.auth0.comcom.auth0.clientIdmz9iNEIo2PHu7oeh8QRt19ndTyyCIgaicom.auth0.clientSecretyLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java AuthenticationControllerProvider.java highlight={5-26} lines
class AuthenticationControllerProvider {
private AuthenticationControllerProvider() {}
private static AuthenticationController INSTANCE;
// if multiple threads may call this, synchronize this method and consider double locking
static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
if (INSTANCE == null) {
String domain = config.getServletContext().getInitParameter("com.auth0.domain");
String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");
if (domain == null || clientId == null || clientSecret == null) {
throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
}
// JwkProvider required for RS256 tokens. If using HS256, do not use.
JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
INSTANCE = AuthenticationController.newBuilder(domain, clientId, clientSecret)
.withJwkProvider(jwkProvider)
.build();
}
return INSTANCE;
}
}
```
```java LoginServlet.java highlight={21-23} lines
@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {
private AuthenticationController authenticationController;
private String domain;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
domain = config.getServletContext().getInitParameter("com.auth0.domain");
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
String redirectUri = req.getScheme() + "://" + req.getServerName();
if ((req.getScheme().equals("http") && req.getServerPort() != 80) || (req.getScheme().equals("https") && req.getServerPort() != 443)) {
redirectUri += ":" + req.getServerPort();
}
redirectUri += "/callback";
String authorizeUrl = authenticationController.buildAuthorizeUrl(req, res, redirectUri)
.build();
res.sendRedirect(authorizeUrl);
}
}
```
```java CallbackServlet.java highlight={16-37} lines
@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
private String redirectOnSuccess;
private String redirectOnFail;
private AuthenticationController authenticationController;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
redirectOnSuccess = "/portal/home";
redirectOnFail = "/login";
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
@Override
public void doPost(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
private void handle(HttpServletRequest req, HttpServletResponse res) throws IOException {
try {
// Parse the request
Tokens tokens = authenticationController.handle(req, res);
SessionUtils.set(req, "accessToken", tokens.getAccessToken());
SessionUtils.set(req, "idToken", tokens.getIdToken());
res.sendRedirect(redirectOnSuccess);
} catch (IdentityVerificationException e) {
e.printStackTrace();
res.sendRedirect(redirectOnFail);
}
}
}
```
```java HomeServlet.java highlight={4-14} lines
@WebServlet(urlPatterns = {"/portal/home"})
public class HomeServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
final String accessToken = (String) SessionUtils.get(req, "accessToken");
final String idToken = (String) SessionUtils.get(req, "idToken");
if (accessToken != null) {
req.setAttribute("userId", accessToken);
} else if (idToken != null) {
req.setAttribute("userId", idToken);
}
req.getRequestDispatcher("/WEB-INF/jsp/home.jsp").forward(req, res);
}
}
```
```java LogoutServlet.java highlight={13-30} lines
@WebServlet(urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
private String domain;
private String clientId;
@Override
public void init(ServletConfig config) {
domain = config.getServletContext().getInitParameter("com.auth0.domain");
clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
}
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
if (request.getSession() != null) {
request.getSession().invalidate();
}
String returnUrl = String.format("%s://%s", request.getScheme(), request.getServerName());
if ((request.getScheme().equals("http") && request.getServerPort() != 80) || (request.getScheme().equals("https") && request.getServerPort() != 443)) {
returnUrl += ":" + request.getServerPort();
}
returnUrl += "/login";
String logoutUrl = String.format(
"https://%s/v2/logout?client_id=%s&returnTo=%s",
domain,
clientId,
returnUrl
);
response.sendRedirect(logoutUrl);
}
}
```
```java AuthenticationControllerProvider.java highlight={5-26} lines
class AuthenticationControllerProvider {
private AuthenticationControllerProvider() {}
private static AuthenticationController INSTANCE;
// if multiple threads may call this, synchronize this method and consider double locking
static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
if (INSTANCE == null) {
String domain = config.getServletContext().getInitParameter("com.auth0.domain");
String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");
if (domain == null || clientId == null || clientSecret == null) {
throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
}
// JwkProvider required for RS256 tokens. If using HS256, do not use.
JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
INSTANCE = AuthenticationController.newBuilder(domain, clientId, clientSecret)
.withJwkProvider(jwkProvider)
.build();
}
return INSTANCE;
}
}
```
```xml web.xml lines
com.auth0.domaindev-gja8kxz4ndtex3rq.us.auth0.comcom.auth0.clientIdmz9iNEIo2PHu7oeh8QRt19ndTyyCIgaicom.auth0.clientSecretyLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java LoginServlet.java highlight={21-23} lines
@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {
private AuthenticationController authenticationController;
private String domain;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
domain = config.getServletContext().getInitParameter("com.auth0.domain");
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
String redirectUri = req.getScheme() + "://" + req.getServerName();
if ((req.getScheme().equals("http") && req.getServerPort() != 80) || (req.getScheme().equals("https") && req.getServerPort() != 443)) {
redirectUri += ":" + req.getServerPort();
}
redirectUri += "/callback";
String authorizeUrl = authenticationController.buildAuthorizeUrl(req, res, redirectUri)
.build();
res.sendRedirect(authorizeUrl);
}
}
```
```java CallbackServlet.java highlight={16-37} lines
@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
private String redirectOnSuccess;
private String redirectOnFail;
private AuthenticationController authenticationController;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
redirectOnSuccess = "/portal/home";
redirectOnFail = "/login";
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
@Override
public void doPost(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
private void handle(HttpServletRequest req, HttpServletResponse res) throws IOException {
try {
// Parse the request
Tokens tokens = authenticationController.handle(req, res);
SessionUtils.set(req, "accessToken", tokens.getAccessToken());
SessionUtils.set(req, "idToken", tokens.getIdToken());
res.sendRedirect(redirectOnSuccess);
} catch (IdentityVerificationException e) {
e.printStackTrace();
res.sendRedirect(redirectOnFail);
}
}
}
```
```java HomeServlet.java highlight={4-14} lines
@WebServlet(urlPatterns = {"/portal/home"})
public class HomeServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
final String accessToken = (String) SessionUtils.get(req, "accessToken");
final String idToken = (String) SessionUtils.get(req, "idToken");
if (accessToken != null) {
req.setAttribute("userId", accessToken);
} else if (idToken != null) {
req.setAttribute("userId", idToken);
}
req.getRequestDispatcher("/WEB-INF/jsp/home.jsp").forward(req, res);
}
}
```
```java LogoutServlet.java highlight={13-30} lines
@WebServlet(urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
private String domain;
private String clientId;
@Override
public void init(ServletConfig config) {
domain = config.getServletContext().getInitParameter("com.auth0.domain");
clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
}
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
if (request.getSession() != null) {
request.getSession().invalidate();
}
String returnUrl = String.format("%s://%s", request.getScheme(), request.getServerName());
if ((request.getScheme().equals("http") && request.getServerPort() != 80) || (request.getScheme().equals("https") && request.getServerPort() != 443)) {
returnUrl += ":" + request.getServerPort();
}
returnUrl += "/login";
String logoutUrl = String.format(
"https://%s/v2/logout?client_id=%s&returnTo=%s",
domain,
clientId,
returnUrl
);
response.sendRedirect(logoutUrl);
}
}
```
```java LoginServlet.java highlight={21-23} lines
@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {
private AuthenticationController authenticationController;
private String domain;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
domain = config.getServletContext().getInitParameter("com.auth0.domain");
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
String redirectUri = req.getScheme() + "://" + req.getServerName();
if ((req.getScheme().equals("http") && req.getServerPort() != 80) || (req.getScheme().equals("https") && req.getServerPort() != 443)) {
redirectUri += ":" + req.getServerPort();
}
redirectUri += "/callback";
String authorizeUrl = authenticationController.buildAuthorizeUrl(req, res, redirectUri)
.build();
res.sendRedirect(authorizeUrl);
}
}
```
```xml web.xml lines
com.auth0.domaindev-gja8kxz4ndtex3rq.us.auth0.comcom.auth0.clientIdmz9iNEIo2PHu7oeh8QRt19ndTyyCIgaicom.auth0.clientSecretyLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java AuthenticationControllerProvider.java highlight={5-26} lines
class AuthenticationControllerProvider {
private AuthenticationControllerProvider() {}
private static AuthenticationController INSTANCE;
// if multiple threads may call this, synchronize this method and consider double locking
static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
if (INSTANCE == null) {
String domain = config.getServletContext().getInitParameter("com.auth0.domain");
String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");
if (domain == null || clientId == null || clientSecret == null) {
throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
}
// JwkProvider required for RS256 tokens. If using HS256, do not use.
JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
INSTANCE = AuthenticationController.newBuilder(domain, clientId, clientSecret)
.withJwkProvider(jwkProvider)
.build();
}
return INSTANCE;
}
}
```
```java CallbackServlet.java highlight={16-37} lines
@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
private String redirectOnSuccess;
private String redirectOnFail;
private AuthenticationController authenticationController;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
redirectOnSuccess = "/portal/home";
redirectOnFail = "/login";
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
@Override
public void doPost(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
private void handle(HttpServletRequest req, HttpServletResponse res) throws IOException {
try {
// Parse the request
Tokens tokens = authenticationController.handle(req, res);
SessionUtils.set(req, "accessToken", tokens.getAccessToken());
SessionUtils.set(req, "idToken", tokens.getIdToken());
res.sendRedirect(redirectOnSuccess);
} catch (IdentityVerificationException e) {
e.printStackTrace();
res.sendRedirect(redirectOnFail);
}
}
}
```
```java HomeServlet.java highlight={4-14} lines
@WebServlet(urlPatterns = {"/portal/home"})
public class HomeServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
final String accessToken = (String) SessionUtils.get(req, "accessToken");
final String idToken = (String) SessionUtils.get(req, "idToken");
if (accessToken != null) {
req.setAttribute("userId", accessToken);
} else if (idToken != null) {
req.setAttribute("userId", idToken);
}
req.getRequestDispatcher("/WEB-INF/jsp/home.jsp").forward(req, res);
}
}
```
```java LogoutServlet.java highlight={13-30} lines
@WebServlet(urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
private String domain;
private String clientId;
@Override
public void init(ServletConfig config) {
domain = config.getServletContext().getInitParameter("com.auth0.domain");
clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
}
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
if (request.getSession() != null) {
request.getSession().invalidate();
}
String returnUrl = String.format("%s://%s", request.getScheme(), request.getServerName());
if ((request.getScheme().equals("http") && request.getServerPort() != 80) || (request.getScheme().equals("https") && request.getServerPort() != 443)) {
returnUrl += ":" + request.getServerPort();
}
returnUrl += "/login";
String logoutUrl = String.format(
"https://%s/v2/logout?client_id=%s&returnTo=%s",
domain,
clientId,
returnUrl
);
response.sendRedirect(logoutUrl);
}
}
```
```java CallbackServlet.java highlight={16-37} lines
@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
private String redirectOnSuccess;
private String redirectOnFail;
private AuthenticationController authenticationController;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
redirectOnSuccess = "/portal/home";
redirectOnFail = "/login";
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
@Override
public void doPost(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
private void handle(HttpServletRequest req, HttpServletResponse res) throws IOException {
try {
// Parse the request
Tokens tokens = authenticationController.handle(req, res);
SessionUtils.set(req, "accessToken", tokens.getAccessToken());
SessionUtils.set(req, "idToken", tokens.getIdToken());
res.sendRedirect(redirectOnSuccess);
} catch (IdentityVerificationException e) {
e.printStackTrace();
res.sendRedirect(redirectOnFail);
}
}
}
```
```xml web.xml lines
com.auth0.domaindev-gja8kxz4ndtex3rq.us.auth0.comcom.auth0.clientIdmz9iNEIo2PHu7oeh8QRt19ndTyyCIgaicom.auth0.clientSecretyLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java AuthenticationControllerProvider.java highlight={5-26} lines
class AuthenticationControllerProvider {
private AuthenticationControllerProvider() {}
private static AuthenticationController INSTANCE;
// if multiple threads may call this, synchronize this method and consider double locking
static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
if (INSTANCE == null) {
String domain = config.getServletContext().getInitParameter("com.auth0.domain");
String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");
if (domain == null || clientId == null || clientSecret == null) {
throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
}
// JwkProvider required for RS256 tokens. If using HS256, do not use.
JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
INSTANCE = AuthenticationController.newBuilder(domain, clientId, clientSecret)
.withJwkProvider(jwkProvider)
.build();
}
return INSTANCE;
}
}
```
```java LoginServlet.java highlight={21-23} lines
@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {
private AuthenticationController authenticationController;
private String domain;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
domain = config.getServletContext().getInitParameter("com.auth0.domain");
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
String redirectUri = req.getScheme() + "://" + req.getServerName();
if ((req.getScheme().equals("http") && req.getServerPort() != 80) || (req.getScheme().equals("https") && req.getServerPort() != 443)) {
redirectUri += ":" + req.getServerPort();
}
redirectUri += "/callback";
String authorizeUrl = authenticationController.buildAuthorizeUrl(req, res, redirectUri)
.build();
res.sendRedirect(authorizeUrl);
}
}
```
```java HomeServlet.java highlight={4-14} lines
@WebServlet(urlPatterns = {"/portal/home"})
public class HomeServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
final String accessToken = (String) SessionUtils.get(req, "accessToken");
final String idToken = (String) SessionUtils.get(req, "idToken");
if (accessToken != null) {
req.setAttribute("userId", accessToken);
} else if (idToken != null) {
req.setAttribute("userId", idToken);
}
req.getRequestDispatcher("/WEB-INF/jsp/home.jsp").forward(req, res);
}
}
```
```java LogoutServlet.java highlight={13-30} lines
@WebServlet(urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
private String domain;
private String clientId;
@Override
public void init(ServletConfig config) {
domain = config.getServletContext().getInitParameter("com.auth0.domain");
clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
}
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
if (request.getSession() != null) {
request.getSession().invalidate();
}
String returnUrl = String.format("%s://%s", request.getScheme(), request.getServerName());
if ((request.getScheme().equals("http") && request.getServerPort() != 80) || (request.getScheme().equals("https") && request.getServerPort() != 443)) {
returnUrl += ":" + request.getServerPort();
}
returnUrl += "/login";
String logoutUrl = String.format(
"https://%s/v2/logout?client_id=%s&returnTo=%s",
domain,
clientId,
returnUrl
);
response.sendRedirect(logoutUrl);
}
}
```
```java HomeServlet.java highlight={4-14} lines
@WebServlet(urlPatterns = {"/portal/home"})
public class HomeServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
final String accessToken = (String) SessionUtils.get(req, "accessToken");
final String idToken = (String) SessionUtils.get(req, "idToken");
if (accessToken != null) {
req.setAttribute("userId", accessToken);
} else if (idToken != null) {
req.setAttribute("userId", idToken);
}
req.getRequestDispatcher("/WEB-INF/jsp/home.jsp").forward(req, res);
}
}
```
```xml web.xml lines
com.auth0.domaindev-gja8kxz4ndtex3rq.us.auth0.comcom.auth0.clientIdmz9iNEIo2PHu7oeh8QRt19ndTyyCIgaicom.auth0.clientSecretyLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java AuthenticationControllerProvider.java highlight={5-26} lines
class AuthenticationControllerProvider {
private AuthenticationControllerProvider() {}
private static AuthenticationController INSTANCE;
// if multiple threads may call this, synchronize this method and consider double locking
static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
if (INSTANCE == null) {
String domain = config.getServletContext().getInitParameter("com.auth0.domain");
String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");
if (domain == null || clientId == null || clientSecret == null) {
throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
}
// JwkProvider required for RS256 tokens. If using HS256, do not use.
JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
INSTANCE = AuthenticationController.newBuilder(domain, clientId, clientSecret)
.withJwkProvider(jwkProvider)
.build();
}
return INSTANCE;
}
}
```
```java LoginServlet.java highlight={21-23} lines
@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {
private AuthenticationController authenticationController;
private String domain;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
domain = config.getServletContext().getInitParameter("com.auth0.domain");
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
String redirectUri = req.getScheme() + "://" + req.getServerName();
if ((req.getScheme().equals("http") && req.getServerPort() != 80) || (req.getScheme().equals("https") && req.getServerPort() != 443)) {
redirectUri += ":" + req.getServerPort();
}
redirectUri += "/callback";
String authorizeUrl = authenticationController.buildAuthorizeUrl(req, res, redirectUri)
.build();
res.sendRedirect(authorizeUrl);
}
}
```
```java CallbackServlet.java highlight={16-37} lines
@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
private String redirectOnSuccess;
private String redirectOnFail;
private AuthenticationController authenticationController;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
redirectOnSuccess = "/portal/home";
redirectOnFail = "/login";
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
@Override
public void doPost(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
private void handle(HttpServletRequest req, HttpServletResponse res) throws IOException {
try {
// Parse the request
Tokens tokens = authenticationController.handle(req, res);
SessionUtils.set(req, "accessToken", tokens.getAccessToken());
SessionUtils.set(req, "idToken", tokens.getIdToken());
res.sendRedirect(redirectOnSuccess);
} catch (IdentityVerificationException e) {
e.printStackTrace();
res.sendRedirect(redirectOnFail);
}
}
}
```
```java LogoutServlet.java highlight={13-30} lines
@WebServlet(urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
private String domain;
private String clientId;
@Override
public void init(ServletConfig config) {
domain = config.getServletContext().getInitParameter("com.auth0.domain");
clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
}
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
if (request.getSession() != null) {
request.getSession().invalidate();
}
String returnUrl = String.format("%s://%s", request.getScheme(), request.getServerName());
if ((request.getScheme().equals("http") && request.getServerPort() != 80) || (request.getScheme().equals("https") && request.getServerPort() != 443)) {
returnUrl += ":" + request.getServerPort();
}
returnUrl += "/login";
String logoutUrl = String.format(
"https://%s/v2/logout?client_id=%s&returnTo=%s",
domain,
clientId,
returnUrl
);
response.sendRedirect(logoutUrl);
}
}
```
```java LogoutServlet.java highlight={13-30} lines
@WebServlet(urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
private String domain;
private String clientId;
@Override
public void init(ServletConfig config) {
domain = config.getServletContext().getInitParameter("com.auth0.domain");
clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
}
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
if (request.getSession() != null) {
request.getSession().invalidate();
}
String returnUrl = String.format("%s://%s", request.getScheme(), request.getServerName());
if ((request.getScheme().equals("http") && request.getServerPort() != 80) || (request.getScheme().equals("https") && request.getServerPort() != 443)) {
returnUrl += ":" + request.getServerPort();
}
returnUrl += "/login";
String logoutUrl = String.format(
"https://%s/v2/logout?client_id=%s&returnTo=%s",
domain,
clientId,
returnUrl
);
response.sendRedirect(logoutUrl);
}
}
```
```xml web.xml lines
com.auth0.domaindev-gja8kxz4ndtex3rq.us.auth0.comcom.auth0.clientIdmz9iNEIo2PHu7oeh8QRt19ndTyyCIgaicom.auth0.clientSecretyLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java AuthenticationControllerProvider.java highlight={5-26} lines
class AuthenticationControllerProvider {
private AuthenticationControllerProvider() {}
private static AuthenticationController INSTANCE;
// if multiple threads may call this, synchronize this method and consider double locking
static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
if (INSTANCE == null) {
String domain = config.getServletContext().getInitParameter("com.auth0.domain");
String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");
if (domain == null || clientId == null || clientSecret == null) {
throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
}
// JwkProvider required for RS256 tokens. If using HS256, do not use.
JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
INSTANCE = AuthenticationController.newBuilder(domain, clientId, clientSecret)
.withJwkProvider(jwkProvider)
.build();
}
return INSTANCE;
}
}
```
```java LoginServlet.java highlight={21-23} lines
@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {
private AuthenticationController authenticationController;
private String domain;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
domain = config.getServletContext().getInitParameter("com.auth0.domain");
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
String redirectUri = req.getScheme() + "://" + req.getServerName();
if ((req.getScheme().equals("http") && req.getServerPort() != 80) || (req.getScheme().equals("https") && req.getServerPort() != 443)) {
redirectUri += ":" + req.getServerPort();
}
redirectUri += "/callback";
String authorizeUrl = authenticationController.buildAuthorizeUrl(req, res, redirectUri)
.build();
res.sendRedirect(authorizeUrl);
}
}
```
```java CallbackServlet.java highlight={16-37} lines
@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
private String redirectOnSuccess;
private String redirectOnFail;
private AuthenticationController authenticationController;
@Override
public void init(ServletConfig config) throws ServletException {
super.init(config);
redirectOnSuccess = "/portal/home";
redirectOnFail = "/login";
authenticationController = AuthenticationControllerProvider.getInstance(config);
}
@Override
public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
@Override
public void doPost(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
handle(req, res);
}
private void handle(HttpServletRequest req, HttpServletResponse res) throws IOException {
try {
// Parse the request
Tokens tokens = authenticationController.handle(req, res);
SessionUtils.set(req, "accessToken", tokens.getAccessToken());
SessionUtils.set(req, "idToken", tokens.getIdToken());
res.sendRedirect(redirectOnSuccess);
} catch (IdentityVerificationException e) {
e.printStackTrace();
res.sendRedirect(redirectOnFail);
}
}
}
```
```java HomeServlet.java highlight={4-14} lines
@WebServlet(urlPatterns = {"/portal/home"})
public class HomeServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
final String accessToken = (String) SessionUtils.get(req, "accessToken");
final String idToken = (String) SessionUtils.get(req, "idToken");
if (accessToken != null) {
req.setAttribute("userId", accessToken);
} else if (idToken != null) {
req.setAttribute("userId", idToken);
}
req.getRequestDispatcher("/WEB-INF/jsp/home.jsp").forward(req, res);
}
}
```
Sign up for an{" "}
Auth0 account
{" "}
or{" "}
console.log("log in")}>
log in
{" "}
to your existing account to integrate directly with your own tenant.
After a successful authentication, you'll be able to see the home page contents.
Log out by clicking the **logout** button at the top right of the home page.