You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Angela Stempfel <hi...@netlabs.org> on 2005/06/03 08:53:27 UTC
security constraints in tomcat 4.1.30
Hello all
I have a problem concerning Tomcat 4.1.30. In web.xml i defined several
security constraint. First of all I protected the whole application and
then I excluded the directories with images and css files. Furthermore I
defined some roles.
<pre>
<security-constraint>
<display-name>TCE GUI</display-name>
<web-resource-collection>
<web-resource-name>WEBGui Area</web-resource-name>
<!-- Define the context-relative URL(s) to be protected -->
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<!-- Anyone with one of the listed roles may access this area -->
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Images and CSS Not Protected</web-resource-name>
<url-pattern>/images/*</url-pattern>
<url-pattern>/css/*</url-pattern>
<http-method>GET</http-method>
<http-method>HEAD</http-method>
</web-resource-collection>
</security-constraint>
<security-constraint>
<display-name>DSLAM Configuration</display-name>
<web-resource-collection>
<web-resource-name>
Access to DSLAM Configuration
</web-resource-name>
<url-pattern>/DslamConfig/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>dslamConfig</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login-error.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>dslamConfig</role-name>
</security-role>
</pre>
So my problem is that this works fine with Tomcat 5.0 but not with
Tomcat 4.1.30. If I go to the login page, the stylesheet and images are
not found when running the Application with version 4.1.30. Also the
Security Constraints are not working correctly, this means that a user
that hasn't the role "dslamConfig" is able to enter the following URL:
/DslamConfig/*
Has anyone some ideas?
Thanks a lot
Angela
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security constraints in tomcat 4.1.30
Posted by Bill Barker <wb...@wilshire.com>.
Along with what Mark said, you should know that TC 4.1.30 stops checking
after the *first* matching constraint (so in your case, the '/*' always
wins). Try reversing the order of your constraints in web.xml.
As Mark mentioned, this has changed in TC 5.x, and your web.xml should work
as written.
"Angela Stempfel" <hi...@netlabs.org> wrote in message
news:429FFE67.5030803@netlabs.org...
> Hello all
>
> I have a problem concerning Tomcat 4.1.30. In web.xml i defined several
> security constraint. First of all I protected the whole application and
> then I excluded the directories with images and css files. Furthermore I
> defined some roles.
>
> <pre>
> <security-constraint>
> <display-name>TCE GUI</display-name>
> <web-resource-collection>
> <web-resource-name>WEBGui Area</web-resource-name>
> <!-- Define the context-relative URL(s) to be protected -->
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <!-- Anyone with one of the listed roles may access this area -->
> <role-name>*</role-name>
> </auth-constraint>
> </security-constraint>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>Images and CSS Not Protected</web-resource-name>
> <url-pattern>/images/*</url-pattern>
> <url-pattern>/css/*</url-pattern>
> <http-method>GET</http-method>
> <http-method>HEAD</http-method>
> </web-resource-collection>
> </security-constraint>
>
> <security-constraint>
> <display-name>DSLAM Configuration</display-name>
> <web-resource-collection>
> <web-resource-name>
> Access to DSLAM Configuration
> </web-resource-name>
> <url-pattern>/DslamConfig/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>dslamConfig</role-name>
> </auth-constraint>
> </security-constraint>
> <login-config>
> <auth-method>FORM</auth-method>
> <form-login-config>
> <form-login-page>/login.jsp</form-login-page>
> <form-error-page>/login-error.jsp</form-error-page>
> </form-login-config>
> </login-config>
>
> <security-role>
> <role-name>dslamConfig</role-name>
> </security-role>
> </pre>
>
> So my problem is that this works fine with Tomcat 5.0 but not with Tomcat
> 4.1.30. If I go to the login page, the stylesheet and images are not found
> when running the Application with version 4.1.30. Also the Security
> Constraints are not working correctly, this means that a user that hasn't
> the role "dslamConfig" is able to enter the following URL: /DslamConfig/*
>
> Has anyone some ideas?
>
> Thanks a lot
> Angela
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security constraints in tomcat 4.1.30
Posted by Mark Thomas <ma...@apache.org>.
Angela Stempfel wrote:
> Hello all
>
> I have a problem concerning Tomcat 4.1.30. In web.xml i defined several
> security constraint. First of all I protected the whole application and
> then I excluded the directories with images and css files. Furthermore I
> defined some roles.
<snip>
> So my problem is that this works fine with Tomcat 5.0 but not with
> Tomcat 4.1.30. If I go to the login page, the stylesheet and images are
> not found when running the Application with version 4.1.30. Also the
> Security Constraints are not working correctly, this means that a user
> that hasn't the role "dslamConfig" is able to enter the following URL:
> /DslamConfig/*
>
> Has anyone some ideas?
You need to read section SRV.12.8 of both the servlet 2.3 spec and the
servlet 2.4 spec. The way constraints are handled has changed. For example,
<spec-quote version="2.3">
If the authorization constraint defines no roles, no user is allowed
access to the portion of the web application defined by the security
constraint.
</spec-quote>
compared to
<spec-quote version="2.4">
If no authorization constraint applies to a request, the container must
accept the request without requiring user authentication.
</spec-quote>
There is a fair amount of ambiguity in this area of the 2.3 spec, which
is why it changed so much in 2.4
You should also be aware of
http://issues.apache.org/bugzilla/show_bug.cgi?id=15570
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security constraints in tomcat 4.1.30
Posted by Jo <jo...@speedlegal.com>.
Hi Angela,
Not sure why it works fine with Tomcat 5 but followings is my view to the
problem with the login page.
1. The security constraint for the images and CSS tells that the GET and
HEAD methods to these resources ARE protected.
2. When you go to the login page, as it tries to get the protected images
and stylesheet, Tomcat has to redirect the request back to the login page
again.
rgds,
Jo.-
----- Original Message -----
From: "Angela Stempfel" <hi...@netlabs.org>
To: <to...@jakarta.apache.org>
Sent: Friday, June 03, 2005 4:53 PM
Subject: security constraints in tomcat 4.1.30
> Hello all
>
> I have a problem concerning Tomcat 4.1.30. In web.xml i defined several
> security constraint. First of all I protected the whole application and
> then I excluded the directories with images and css files. Furthermore I
> defined some roles.
>
> <pre>
> <security-constraint>
> <display-name>TCE GUI</display-name>
> <web-resource-collection>
> <web-resource-name>WEBGui Area</web-resource-name>
> <!-- Define the context-relative URL(s) to be protected -->
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <!-- Anyone with one of the listed roles may access this area -->
> <role-name>*</role-name>
> </auth-constraint>
> </security-constraint>
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>Images and CSS Not Protected</web-resource-name>
> <url-pattern>/images/*</url-pattern>
> <url-pattern>/css/*</url-pattern>
> <http-method>GET</http-method>
> <http-method>HEAD</http-method>
> </web-resource-collection>
> </security-constraint>
>
> <security-constraint>
> <display-name>DSLAM Configuration</display-name>
> <web-resource-collection>
> <web-resource-name>
> Access to DSLAM Configuration
> </web-resource-name>
> <url-pattern>/DslamConfig/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>dslamConfig</role-name>
> </auth-constraint>
> </security-constraint>
> <login-config>
> <auth-method>FORM</auth-method>
> <form-login-config>
> <form-login-page>/login.jsp</form-login-page>
> <form-error-page>/login-error.jsp</form-error-page>
> </form-login-config>
> </login-config>
>
> <security-role>
> <role-name>dslamConfig</role-name>
> </security-role>
> </pre>
>
> So my problem is that this works fine with Tomcat 5.0 but not with
> Tomcat 4.1.30. If I go to the login page, the stylesheet and images are
> not found when running the Application with version 4.1.30. Also the
> Security Constraints are not working correctly, this means that a user
> that hasn't the role "dslamConfig" is able to enter the following URL:
> /DslamConfig/*
>
> Has anyone some ideas?
>
> Thanks a lot
> Angela
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
> !DSPAM:429fffc716436437214267!
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org