help using JDBCRealm - how to relate a realm with a security constraint

[Pedro Garcia <pe...@groove.com.co>]

Hi!
I am trying to set up security management for my web applications 
through JDBCRealm.

What i have done:
1. modify the server.xml file to add a Realm tag (<Realm 
className="org.apache.catalina.realm.JDBCRealm" debug="99" 
connectionName="root" connectionPassword="XXXX" 
connectionURL="jdbc:mysql://myserver:3306/mydatabase" 
driverName="org.gjt.mm.mysql.Driver" roleNameCol="role_name" 
userCredCol="user_password" userNameCol="user_name" 
userRoleTable="user_roles" userTable="users" />)

Database and corresponding tables exists

2. modify the web.xml to add a security-constraint tag ( 
<security-constraint>
		<web-resource-collection>
			<web-resource-name>Area de pruebas de seguridad</web-resource-name>
			<url-pattern>/cosa.jsp</url-pattern>
			<url-pattern>/test.jsp</url-pattern>
			<http-method>DELETE</http-method>
			<http-method>GET</http-method>
			<http-method>POST</http-method>
			<http-method>PUT</http-method>
		</web-resource-collection>
		<auth-constraint>
		  <description>rol de administrador</description>
			<role-name>YYY</role-name>
		</auth-constraint>
	</security-constraint>
)

YYY is a role defined in the database


It doesn't work. So i want to know how to relate a realm declared within 
a context with the entries in the web.xml file in order to do the users 
of my web application to be authenticated against my -user, roles- database.

Thanks!

-- 
-----------------------------------------------
| Pedro A García Medina                       |
| Groove Media                                |
| emailto: pedro.garcia@groove.com.co         |
| Tel: 6211072                                |
|----------------------------------------------


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org

Re: help using JDBCRealm - how to relate a realm with a security constraint

[Christopher Schultz <ch...@comcast.net>]

Pedro,

> What i have done:
> 1. modify the server.xml file to add a Realm tag (<Realm 
> className="org.apache.catalina.realm.JDBCRealm" debug="99" 
> connectionName="root" connectionPassword="XXXX" 
> connectionURL="jdbc:mysql://myserver:3306/mydatabase" 
> driverName="org.gjt.mm.mysql.Driver" roleNameCol="role_name" 
> userCredCol="user_password" userNameCol="user_name" 
> userRoleTable="user_roles" userTable="users" />)

Where did you put this declaration? In the <Context> of your web 
application? I recall that Realm declarations can appear in multiple 
places. Make sure that it appears in the <Context> where you have:

> 2. modify the web.xml to add a security-constraint tag ( 
> <security-constraint>
>         <web-resource-collection>
>             <web-resource-name>Area de pruebas de 
> seguridad</web-resource-name>
>             <url-pattern>/cosa.jsp</url-pattern>
>             <url-pattern>/test.jsp</url-pattern>
>             <http-method>DELETE</http-method>
>             <http-method>GET</http-method>
>             <http-method>POST</http-method>
>             <http-method>PUT</http-method>
>         </web-resource-collection>
>         <auth-constraint>
>           <description>rol de administrador</description>
>             <role-name>YYY</role-name>
>         </auth-constraint>
>     </security-constraint>
> )

This looks good. What is the URL that you expect to be protetced, and is 
not protected? Also, try removing the <http-method> settings, just in 
case that is complicating things.

-chris


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org