You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Steve Luzynski <sl...@mac.com> on 2004/07/09 06:19:39 UTC
Container managed security
I've been scratching my head most of the day on this...
Using Tomcat 5.0.25 on Mac OS X (10.3.4 specifically). Trying to
implement container managed security.
I have a JDBC Realm set up in server.xml for the context in question.
The web.xml file for the application is set up just like the examples:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web
Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>IPBoss</display-name>
<security-contraint>
<web-resource-collection>
<web-resource-name>restricted pages</web-resource-name>
<url-pattern>/add/*</url-pattern>
<url-pattern>/edit/*</url-pattern>
<url-pattern>/delete/*</url-pattern>
</web-resource-collection>
<auth-contraint>
<role-name>user</role-name>
</auth-contraint>
</security-contraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>IPBoss application</realm-name>
<form-login-config>
<form-login-page>/index.html</form-login-page>
<form-error-page>/index.html</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>
The role of any user of this application.
</description>
<role-name>user</role-name>
</security-role>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
</web-app>
When I try to hit a url like
http://localhost:9006/IPBoss/add/add_network.html, which as near as I
can tell should trigger authentication, I just get the page I'm asking
for - no login.
I'm sure I'm missing something easy but I just can't figure it out.
Thanks!
-Steve
Re: Container managed security
Posted by Bill Barker <wb...@wilshire.com>.
"Steve Luzynski" <sl...@mac.com> wrote in message
news:72019A1C-D1E5-11D8-B43E-000A95B96842@mac.com...
> On Jul 9, 2004, at 12:40 PM, Robert F. Hall wrote:
>
> > Have you tried adding <http-method/> elements to
> > <web-resource-collection> ?
> >
> > <web-resource-collection>
> > <http-method>HEAD</http-method>
> > <http-method>GET</http-method>
> > <http-method>POST</http-method>
> > <http-method>PUT</http-method>
> > <http-method>DELETE</http-method>
> > </web-resource-collection>
>
> No go there either, tried it with and without.
>
> Is there some logging or debugging I can turn on? The stock logs aren't
> showing me anything other than just a normal access to the resources
> that I'm wanting to protect.
>
You could try setting debug="10" on your <Context> and/or <Realm> element.
That should tell you in pretty good detail what Tomcat is trying to do with
the request.
> Thanks,
> Steve
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Container managed security
Posted by Steve Luzynski <sl...@mac.com>.
On Jul 9, 2004, at 5:52 PM, QM wrote:
> On Fri, Jul 09, 2004 at 03:20:39PM -0500, Steve Luzynski wrote:
> : Is there some logging or debugging I can turn on? The stock logs
> aren't
> : showing me anything other than just a normal access to the resources
> : that I'm wanting to protect.
>
> Another silly question, then: what's the deployed webapp?
> Is "IPBoss" a proper context, or is "IPBoss" the subdir of something
> mapped to the root context?
It's a context.
Does it matter that there are no actual servlets in the web.xml file
yet? I'm in the process of switching away from Struts to a different
framework and decided this was a good time to move to container managed
security since I destroyed the entire view anyway. :) So because of
that there is no servlet mapping yet, I'm just trying to get Tomcat to
properly access control some static HTML right now.
(I'm grasping too...)
Thanks,
Steve
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Container managed security
Posted by QM <qm...@brandxdev.net>.
On Fri, Jul 09, 2004 at 03:20:39PM -0500, Steve Luzynski wrote:
: Is there some logging or debugging I can turn on? The stock logs aren't
: showing me anything other than just a normal access to the resources
: that I'm wanting to protect.
Another silly question, then: what's the deployed webapp?
Is "IPBoss" a proper context, or is "IPBoss" the subdir of something
mapped to the root context?
Yes, I'm grasping ;)
-QM
--
software -- http://www.brandxdev.net
tech news -- http://www.RoarNetworX.com
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Container managed security
Posted by Steve Luzynski <sl...@mac.com>.
On Jul 9, 2004, at 12:40 PM, Robert F. Hall wrote:
> Have you tried adding <http-method/> elements to
> <web-resource-collection> ?
>
> <web-resource-collection>
> <http-method>HEAD</http-method>
> <http-method>GET</http-method>
> <http-method>POST</http-method>
> <http-method>PUT</http-method>
> <http-method>DELETE</http-method>
> </web-resource-collection>
No go there either, tried it with and without.
Is there some logging or debugging I can turn on? The stock logs aren't
showing me anything other than just a normal access to the resources
that I'm wanting to protect.
Thanks,
Steve
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Container managed security
Posted by "Robert F. Hall" <rf...@berkeley.edu>.
Have you tried adding <http-method/> elements to
<web-resource-collection> ?
<web-resource-collection>
<http-method>HEAD</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
Steve Luzynski wrote:
> On Jul 9, 2004, at 8:11 AM, QM wrote:
>
>> On Thu, Jul 08, 2004 at 11:19:39PM -0500, Steve Luzynski wrote:
>> : Using Tomcat 5.0.25 on Mac OS X (10.3.4 specifically). Trying to
>> : implement container managed security.
>> :
>> : [snip: deployment descriptor]
>> :
>> : When I try to hit a url like
>> : http://localhost:9006/IPBoss/add/add_network.html, which as near as I
>> : can tell should trigger authentication, I just get the page I'm asking
>> : for - no login.
>>
>> Humor me -- is there an Apache server in front of Tomcat that's
>> intercepting the .html?
>
>
> Nope, Tomcat is running an http connector directly on port 9006.
>
>>
>> (I hate to ask this) but did you restart Tomcat after making the web.xml
>> changes?
>
>
> Repeatedly. :)
>
>> Otherwise, web.xml looks spec-compliant as far as I can tell.
>
>
> I thought so. Any other ideas? I'm stumped.
>
> Thanks much,
> Steve
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Container managed security
Posted by Steve Luzynski <sl...@mac.com>.
On Jul 9, 2004, at 8:11 AM, QM wrote:
> On Thu, Jul 08, 2004 at 11:19:39PM -0500, Steve Luzynski wrote:
> : Using Tomcat 5.0.25 on Mac OS X (10.3.4 specifically). Trying to
> : implement container managed security.
> :
> : [snip: deployment descriptor]
> :
> : When I try to hit a url like
> : http://localhost:9006/IPBoss/add/add_network.html, which as near as I
> : can tell should trigger authentication, I just get the page I'm
> asking
> : for - no login.
>
> Humor me -- is there an Apache server in front of Tomcat that's
> intercepting the .html?
Nope, Tomcat is running an http connector directly on port 9006.
>
> (I hate to ask this) but did you restart Tomcat after making the
> web.xml
> changes?
Repeatedly. :)
> Otherwise, web.xml looks spec-compliant as far as I can tell.
I thought so. Any other ideas? I'm stumped.
Thanks much,
Steve
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Container managed security
Posted by QM <qm...@brandxdev.net>.
On Thu, Jul 08, 2004 at 11:19:39PM -0500, Steve Luzynski wrote:
: Using Tomcat 5.0.25 on Mac OS X (10.3.4 specifically). Trying to
: implement container managed security.
:
: [snip: deployment descriptor]
:
: When I try to hit a url like
: http://localhost:9006/IPBoss/add/add_network.html, which as near as I
: can tell should trigger authentication, I just get the page I'm asking
: for - no login.
Humor me -- is there an Apache server in front of Tomcat that's
intercepting the .html?
(I hate to ask this) but did you restart Tomcat after making the web.xml
changes?
Otherwise, web.xml looks spec-compliant as far as I can tell.
-QM
--
software -- http://www.brandxdev.net
tech news -- http://www.RoarNetworX.com
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org