You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomee.apache.org by kuba44 <ja...@gmail.com> on 2013/09/06 19:55:49 UTC
Bug in security TomEE
Welcome!
I'm new in web application development. When I write my application I ask
some question at http://stackoverflow.com
I asked one question there
(http://stackoverflow.com/questions/18661580/form-authentication-for-not-authorised-user?noredirect=1#comment27482833_18661580)
and someone persuade me to write about it.
What can you say about it?
--
View this message in context: http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009.html
Sent from the OpenEJB User mailing list archive at Nabble.com.
Re: Bug in security TomEE
Posted by Thiago Veronezi <th...@veronezi.org>.
You can call the HttpServletRequest#logout method.
On Fri, Sep 6, 2013 at 2:51 PM, kuba44 <ja...@gmail.com> wrote:
> So what should i do when I'm authenticated and authorized as user and i
> want
> to get protection resource for admin? I how to logout and login again as
> admin ?
>
>
>
> --
> View this message in context:
> http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665014.html
> Sent from the OpenEJB User mailing list archive at Nabble.com.
>
Re: Bug in security TomEE
Posted by kuba44 <ja...@gmail.com>.
So what should i do when I'm authenticated and authorized as user and i want
to get protection resource for admin? I how to logout and login again as
admin ?
--
View this message in context: http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665014.html
Sent from the OpenEJB User mailing list archive at Nabble.com.
Re: Bug in security TomEE
Posted by kuba44 <ja...@gmail.com>.
ok, thank you for explanation and sorry for confusion :)
--
View this message in context: http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665016.html
Sent from the OpenEJB User mailing list archive at Nabble.com.
Re: Bug in security TomEE
Posted by Thiago Veronezi <th...@veronezi.org>.
>> So, what should I do if i want to get to protected resource, when i'm
>> authenticated only as user and i want to get authorized as admin ? I
have to
>> logout and login again ?
Yes... I guess,
I don't remember if changes to a user security-roles are automatically
reflected without a logout/login.
Notice that the logged user can be a "usr" and an "admin" at the same time.
The user just need to be part of both "security-role".
[]s,
Thiago.
On Fri, Sep 6, 2013 at 2:48 PM, kuba44 <ja...@gmail.com> wrote:
> Authentication and authorization are two different things.
> If you try to access a protected resource and you are not authenticated,
> the server will ask for your username.password. After having you
> authenticated, the server will check if your user is authorized to access
> the requested resource. If you are not authorized, it will throw a 403
> exception, but you will still be authenticated.
>
> If you after having a 403 you can't access what you are supposed to have
> access to, then we have an issue. :)
> Is that it?
>
> So, what should I do if i want to get to protected resource, when i'm
> authenticated only as user and i want to get authorized as admin ? I have
> to
> logout and login again ?
>
>
>
> --
> View this message in context:
> http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665013.html
> Sent from the OpenEJB User mailing list archive at Nabble.com.
>
Re: Bug in security TomEE
Posted by kuba44 <ja...@gmail.com>.
Authentication and authorization are two different things.
If you try to access a protected resource and you are not authenticated,
the server will ask for your username.password. After having you
authenticated, the server will check if your user is authorized to access
the requested resource. If you are not authorized, it will throw a 403
exception, but you will still be authenticated.
If you after having a 403 you can't access what you are supposed to have
access to, then we have an issue. :)
Is that it?
So, what should I do if i want to get to protected resource, when i'm
authenticated only as user and i want to get authorized as admin ? I have to
logout and login again ?
--
View this message in context: http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665013.html
Sent from the OpenEJB User mailing list archive at Nabble.com.
Re: Bug in security TomEE
Posted by Thiago Veronezi <th...@veronezi.org>.
Authentication and authorization are two different things.
If you try to access a protected resource and you are not authenticated,
the server will ask for your username.password. After having you
authenticated, the server will check if your user is authorized to access
the requested resource. If you are not authorized, it will throw a 403
exception, but you will still be authenticated.
If you after having a 403 you can't access what you are supposed to have
access to, then we have an issue. :)
Is that it?
[]s,
Thiago
On Fri, Sep 6, 2013 at 2:21 PM, kuba44 <ja...@gmail.com> wrote:
> Yes, I'm authenticated but not authorized.
>
> But information about my 'not authorization' is remember, so i can't try to
> login again. I have to invalidate session like when i login with success,
> like i would be authorized.
>
> Do you understood?
>
>
>
> --
> View this message in context:
> http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665011.html
> Sent from the OpenEJB User mailing list archive at Nabble.com.
>
Re: Bug in security TomEE
Posted by kuba44 <ja...@gmail.com>.
Yes, I'm authenticated but not authorized.
But information about my 'not authorization' is remember, so i can't try to
login again. I have to invalidate session like when i login with success,
like i would be authorized.
Do you understood?
--
View this message in context: http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009p4665011.html
Sent from the OpenEJB User mailing list archive at Nabble.com.
Re: Bug in security TomEE
Posted by Thiago Veronezi <th...@veronezi.org>.
It seems the normal behavior.
You are authenticated but not authorized.
Is that it?
[]s,
Thiago.
On Fri, Sep 6, 2013 at 1:55 PM, kuba44 <ja...@gmail.com> wrote:
> Welcome!
>
> I'm new in web application development. When I write my application I ask
> some question at http://stackoverflow.com
>
> I asked one question there
> (
> http://stackoverflow.com/questions/18661580/form-authentication-for-not-authorised-user?noredirect=1#comment27482833_18661580
> )
> and someone persuade me to write about it.
>
> What can you say about it?
>
>
>
> --
> View this message in context:
> http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-tp4665009.html
> Sent from the OpenEJB User mailing list archive at Nabble.com.
>