Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > Java > Windows login information

Reply
Thread Tools

Windows login information

 
 
jamie.eyre@gmail.com
Guest
Posts: n/a
 
      08-22-2006
Hi,
I would like to get the windows login information from my
application/applet. Specifically I want the username. I know that you
can get the username by calling
System.getProperty("user.name");
This gets the windows USERNAME environment variable.

The only problem with using this method is that it is possible to
change your USERNAME system property to something else (i.e. admin) via
a command propmt (set USERNAME=admin), and then start the application.
If the application is started in the same command dialog, the
application would then get this new name (i.e. admin), when calling
System.getProperty("user.name"); In this way, someone could fake their
name.

Does anybody else have another way of doing this? A more secure way.

Thanks,
Jamie

 
Reply With Quote
 
 
 
 
Dieter Lamberty
Guest
Posts: n/a
 
      08-22-2006
http://www.velocityreviews.com/forums/(E-Mail Removed) schrieb:
> Hi,
> I would like to get the windows login information from my
> application/applet. Specifically I want the username. I know that you
> can get the username by calling
> System.getProperty("user.name");
> This gets the windows USERNAME environment variable.
>
> The only problem with using this method is that it is possible to
> change your USERNAME system property to something else (i.e. admin) via
> a command propmt (set USERNAME=admin), and then start the application.
> If the application is started in the same command dialog, the
> application would then get this new name (i.e. admin), when calling
> System.getProperty("user.name"); In this way, someone could fake their
> name.
>
> Does anybody else have another way of doing this? A more secure way.
>
> Thanks,
> Jamie
>


Hi Jamie

With Java5 there comes a new (?!) method with the class
java.lang.System: getenv(String name).
This should get the "real" enviroment variables. I'm not sure whether or
not this helps you but if you want to do security issues you may change
to a more safe thing.

Hope that helps
Dieter
 
Reply With Quote
 
 
 
 
Roland de Ruiter
Guest
Posts: n/a
 
      08-22-2006
On 22-8-2006 18:23, (E-Mail Removed) wrote:
> Hi,
> I would like to get the windows login information from my
> application/applet. Specifically I want the username. I know that you
> can get the username by calling
> System.getProperty("user.name");
> This gets the windows USERNAME environment variable.
>
> The only problem with using this method is that it is possible to
> change your USERNAME system property to something else (i.e. admin) via
> a command propmt (set USERNAME=admin), and then start the application.
> If the application is started in the same command dialog, the
> application would then get this new name (i.e. admin), when calling
> System.getProperty("user.name"); In this way, someone could fake their
> name.
>
> Does anybody else have another way of doing this? A more secure way.
>
> Thanks,
> Jamie
>

com.sun.security.auth.module.NTSystem NTSystem = new
com.sun.security.auth.module.NTSystem();
System.out.println(NTSystem.getName());
See
<http://java.sun.com/j2se/1.5.0/docs/guide/security/jaas/spec/index.html>

--
Regards,

Roland
 
Reply With Quote
 
jamie.eyre@gmail.com
Guest
Posts: n/a
 
      08-23-2006
Hi,

I have tried using the getenv function, but it gives the same problem.
Any other ideas?

Jamie

Dieter Lamberty wrote:
> (E-Mail Removed) schrieb:
> > Hi,
> > I would like to get the windows login information from my
> > application/applet. Specifically I want the username. I know that you
> > can get the username by calling
> > System.getProperty("user.name");
> > This gets the windows USERNAME environment variable.
> >
> > The only problem with using this method is that it is possible to
> > change your USERNAME system property to something else (i.e. admin) via
> > a command propmt (set USERNAME=admin), and then start the application.
> > If the application is started in the same command dialog, the
> > application would then get this new name (i.e. admin), when calling
> > System.getProperty("user.name"); In this way, someone could fake their
> > name.
> >
> > Does anybody else have another way of doing this? A more secure way.
> >
> > Thanks,
> > Jamie
> >

>
> Hi Jamie
>
> With Java5 there comes a new (?!) method with the class
> java.lang.System: getenv(String name).
> This should get the "real" enviroment variables. I'm not sure whether or
> not this helps you but if you want to do security issues you may change
> to a more safe thing.
>
> Hope that helps
> Dieter


 
Reply With Quote
 
jamie.eyre@gmail.com
Guest
Posts: n/a
 
      08-23-2006
Hi,

The com.sun.security.auth.module.NTSystem works. The only problem now
is that it is not in older java versions. Since the applet will be
running on client machines, I do not have control of the java version,
so i will need to pack the JAAS classes in the applet, which will make
the applet 104KB larger. Any other ideas which would not require
foriegn libraries?

Thanks,
Jamie


Roland de Ruiter wrote:
> On 22-8-2006 18:23, (E-Mail Removed) wrote:
> > Hi,
> > I would like to get the windows login information from my
> > application/applet. Specifically I want the username. I know that you
> > can get the username by calling
> > System.getProperty("user.name");
> > This gets the windows USERNAME environment variable.
> >
> > The only problem with using this method is that it is possible to
> > change your USERNAME system property to something else (i.e. admin) via
> > a command propmt (set USERNAME=admin), and then start the application.
> > If the application is started in the same command dialog, the
> > application would then get this new name (i.e. admin), when calling
> > System.getProperty("user.name"); In this way, someone could fake their
> > name.
> >
> > Does anybody else have another way of doing this? A more secure way.
> >
> > Thanks,
> > Jamie
> >

> com.sun.security.auth.module.NTSystem NTSystem = new
> com.sun.security.auth.module.NTSystem();
> System.out.println(NTSystem.getName());
> See
> <http://java.sun.com/j2se/1.5.0/docs/guide/security/jaas/spec/index.html>
>
> --
> Regards,
>
> Roland


 
Reply With Quote
 
Chris Uppal
Guest
Posts: n/a
 
      08-23-2006
(E-Mail Removed) wrote:

> The com.sun.security.auth.module.NTSystem works. The only problem now
> is that it is not in older java versions. Since the applet will be
> running on client machines, I do not have control of the java version,
> so i will need to pack the JAAS classes in the applet, which will make
> the applet 104KB larger. Any other ideas which would not require
> foriegn libraries?


Why are you so bothered about this anyway ? Presumably the applet is sending
the string to your server, or something like that, and there is absolutely no
way that you can trust that value no matter how you program your applet. Your
architecture has to be able to cope with spoofed data supplied by the client
anyway, so why worry that setting an environment variable gives the user one
more way (perhaps accidentally) to spoof the ID ?

-- chris



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows login information in java GenxLogic Java 8 08-28-2006 08:33 PM
More Information than just IIS Log Information subrato ASP .Net 8 03-14-2006 09:59 PM
signer information does not match signer information of other classes in the same package clercmedia Java 2 12-09-2005 03:14 PM
strange information from asp.net trace / getting performance information using WebRequest and StreamReader z. f. ASP .Net 0 02-03-2005 11:23 AM
Windows Login Information Venu Vinod N Javascript 1 10-30-2003 05:12 AM



Advertisments