How to check user group membership in WebSphere Portal portlet code

Checking the group membership of the authenticated user is a common requirement for WebSphere Portal portlets. To achieve this, you must use the PUMA SPI in your portlet's Java code. PUMA is an acronym for the Portal User Management Architecture and SPI is an acronym for Service Provider Interface.

Following is a way that you can quickly add an isMember() method to your portlet code that leverages the PUMA SPI. The method will take the name of a user group as an argument. The method will return true if the user is a member of the given group and false if they are not.

The following code has been proven on WebSphere Portal version 6.1.5.

First, the imports:

Next, you will need to declare two global variables in your main portlet class like this:

Next, you will want to initialize the portletServiceHome object from within the init method of your portlet. This should be done in the init method because it utilizes a JNDI lookup, which is an expensive operation. By doing this lookup in the init method, we ensure that it happens only once. In the same method, we'll also initialize the GROUP_ATTRS map.

Next, place the following method in your main portlet class:

Now, you have all the plumbing you need to check whether or not a user belongs to a given group. Typically, you'll be accessing the isMember method somewhere in your doView() method. In the following example, I'm just testing the method by using it within some logging statements: