GWT Login: how to implement it? - gwt

Question

I'm a bit confused about the making of a login service: I've seen plenty of tutorials, but still can't manage how to make a simple login service.
I don't know what tools I need to remember the navigation, and how to use them.
I could use:
public interface LoginServiceAsync {
boolean isAuthenticated(AsyncCallback<UserDTO> callback);
UserDTO authenticate(String email, String password, AsyncCallback<UserDTO> callback);
void logout(AsyncCallback<UserDTO> callback);
}
But where do I manage Cookies?

Answer 1

Pro Tip: if you don't fully understand how authentication should work, don't try to do it yourself.
IMO, the best way to do authentication is to just redirect to a login form and thus assume that when your app is loaded the user is authenticated (then you can use a JSP for example to pass user-specific values to your GWT app; see the guice-rf-activity archetype for an example). If your app has to be accessible to anonymous users, login would still just redirect to the login page. For a real-life example, have a look at how Google Groups behaves.
That way, you can delegate authentication to either some library that knows how to do it (e.g. Spring Security), or to some tool (e.g. standard servlets authentication, AppEngine-specific authentication)

Answer 2

GWT is just a tool that converts Java code into HTML and JavaScript. There is nothing special about authenticating users in GWT.
One option is to remember that a user is authenticated in a session, and then check the session every time a client makes an RPC call. The implementation depends on your web server. Google your web server and "sessions", and you will find plenty of details on how to do it.

Answer 3

I have also the same problem trying to find a login service. Finally we are using CAS Single Sign Out because we are working with Tomcat. In this case, users are directly logged in Tomcat server and not in GWT. Each user is configured to allow open a URL (GWT application) or not. For example, if the GWT application is hosted in htpp://myhost/GWTapp, it is possible to configure if a user can access to "/GWTapp" or not.
For me, the best benefit, it's that doesn't need to change a lot the GWT application with calls to server and so on. There is a GWT CAS client that makes all for you.