You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by DIGLLOYD INC <di...@diglloyd.com> on 2008/05/02 17:55:32 UTC
authenticated but not authorized -- blank page
I have a webapp 'guest', with two subfolders 'guest1' and 'guest2'.
These are protected by security constraints.
/guest/guest1 has a security constraint requiring role 'guest1'
/guest/guest2 has a security constraint requiring role 'guest2'
Users 'guest1' and 'guest2' map to roles of the same names, and each
user has its own distinct password.
1. User 'guest1' logs in successfully and is able to view /guest/
guest1/*
2. Now user guest1 tries to access /guest/guest2. Since s/he is not
authorized to access this area, one can expect a failure.
PROBLEM: the server returns a 404 error when 'guest1' accesses a non-
authorized area (/guest/guest2). This results in a blank page in the
browser-very confusing. In this case I don't really care, but I have
other more important situations coming.
QUESTION: shouldn't some kind of "not authorized" error be returned by
Tomcat? A 404 error is very confusing for the user.
The web.xml configuration is shown below.
<servlet-mapping>
<servlet-name>guest</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
<!-- Define reference to the user database for looking up roles -->
<resource-env-ref>
<description>blah blah blah</description>
<resource-env-ref-name>users</resource-env-ref-name>
<resource-env-ref-type>org.apache.catalina.UserDatabase</resource-
env-ref-type>
</resource-env-ref>
<!-- Define a Security Constraint on this Application -->
<security-constraint>
<web-resource-collection>
<web-resource-name>Guest 1 access</web-resource-name>
<url-pattern>/_guest1_/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>guest1</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Guest 2 access</web-resource-name>
<url-pattern>/_guest2_/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>guest2</role-name>
</auth-constraint>
</security-constraint>
<!-- Define the Login Configuration for this Application -->
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Guest Realm</realm-name>
</login-config>
<!-- Security roles referenced by this web application -->
<security-role>
<role-name>guest1</role-name>
<role-name>guest2</role-name>
</security-role>
Lloyd Chambers
http://diglloyd.com
[Mac OS X 10.5.2 Intel, Tomcat 6.0.16]
Re: authenticated but not authorized -- blank page
Posted by DIGLLOYD INC <di...@diglloyd.com>.
I found the problem. In fact, an error 401 is sent, which caused the
browser to retry somehow, but that resulted in a 404. My 404 page,
while specified, did not exist. So then a blank page results. Or at
least it seems that this is what is going on.
On May 2, 2008, at 2:38 PM, DIGLLOYD INC wrote:
> I was trying to simplify the discussion. The folders are actually
> _guest1_ and _guest2_ and the security constraints match. Login and
> the mappings work correctly. I just was trying to phrase the
> discussion generally.
>
>
> On May 2, 2008, at 10:14 AM, Caldarale, Charles R wrote:
>
>>> From: DIGLLOYD INC [mailto:diglloyd1@diglloyd.com]
>>> Subject: authenticated but not authorized -- blank page
>>>
>>> I have a webapp 'guest', with two subfolders 'guest1' and
>>> 'guest2'.
>>
>> Really? Because that's not what's in your security constraints:
>>
>>> <url-pattern>/_guest1_/*</url-pattern>
>>> <url-pattern>/_guest2_/*</url-pattern>
>>
>> Which is it - with or without the underlines?
>>
>> - Chuck
>>
>>
>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE
>> PROPRIETARY
>> MATERIAL and is thus for use only by the intended recipient. If you
>> received this in error, please contact the sender and delete the e-
>> mail
>> and its attachments from all computers.
>>
>> ---------------------------------------------------------------------
>> To start a new topic, e-mail: users@tomcat.apache.org
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>
> Lloyd Chambers
> http://diglloyd.com
>
> [Mac OS X 10.5.2 Intel, Tomcat 6.0.16]
>
>
>
>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Lloyd Chambers
http://diglloyd.com
[Mac OS X 10.5.2 Intel, Tomcat 6.0.16]
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: authenticated but not authorized -- blank page
Posted by DIGLLOYD INC <di...@diglloyd.com>.
I was trying to simplify the discussion. The folders are actually
_guest1_ and _guest2_ and the security constraints match. Login and
the mappings work correctly. I just was trying to phrase the
discussion generally.
On May 2, 2008, at 10:14 AM, Caldarale, Charles R wrote:
>> From: DIGLLOYD INC [mailto:diglloyd1@diglloyd.com]
>> Subject: authenticated but not authorized -- blank page
>>
>> I have a webapp 'guest', with two subfolders 'guest1' and
>> 'guest2'.
>
> Really? Because that's not what's in your security constraints:
>
>> <url-pattern>/_guest1_/*</url-pattern>
>> <url-pattern>/_guest2_/*</url-pattern>
>
> Which is it - with or without the underlines?
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE
> PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you
> received this in error, please contact the sender and delete the e-
> mail
> and its attachments from all computers.
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Lloyd Chambers
http://diglloyd.com
[Mac OS X 10.5.2 Intel, Tomcat 6.0.16]
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: authenticated but not authorized -- blank page
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: DIGLLOYD INC [mailto:diglloyd1@diglloyd.com]
> Subject: authenticated but not authorized -- blank page
>
> I have a webapp 'guest', with two subfolders 'guest1' and
> 'guest2'.
Really? Because that's not what's in your security constraints:
> <url-pattern>/_guest1_/*</url-pattern>
> <url-pattern>/_guest2_/*</url-pattern>
Which is it - with or without the underlines?
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: authenticated but not authorized -- blank page
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Lloyd,
DIGLLOYD INC wrote:
| I don't read schemas well. Perhaps if you would be so kind as to
| explain why it's wrong? Is it because there is more than one
| <role-name> specified eg it needs to be:
|
| <security-role>
| <role-name>guest1</role-name>
| </security-role>
| <security-role>
| <role-name>guest2</role-name>
| </security-role>
That's exactly right. <security-role> looks like this in DTD-speak:
<!ELEMENT security-role (description?, role-name)>
The idea is that you can enumerate the roles and give them
human-readable descriptions. The servlet specification also states that
roles used in other places must be defined in a <security-role> section,
but most servers ignore this requirement.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkgfENUACgkQ9CaO5/Lv0PCSnQCfc44V5ZIMQBQeTsjRtF8/3wP1
SYsAoIsdtg4QLzjmx5rjpFyHIxGtfIzE
=ClD/
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: authenticated but not authorized -- blank page
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: DIGLLOYD INC [mailto:diglloyd1@diglloyd.com]
> Subject: Re: authenticated but not authorized -- blank page
>
> Is it because there is more than one <role-
> name> specified eg it needs to be:
>
> <security-role>
> <role-name>guest1</role-name>
> </security-role>
> <security-role>
> <role-name>guest2</role-name>
> </security-role>
Yes, the javaee schema allows only one <role-name> element within a
<security-role>. Tomcat seems to allow multiple <role-name> elements
here, but I don't know if it does anything useful with the extras.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: authenticated but not authorized -- blank page
Posted by DIGLLOYD INC <di...@diglloyd.com>.
I'm using:
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd
"
version="2.5">
I don't read schemas well. Perhaps if you would be so kind as to
explain why it's wrong? Is it because there is more than one <role-
name> specified eg it needs to be:
<security-role>
<role-name>guest1</role-name>
</security-role>
<security-role>
<role-name>guest2</role-name>
</security-role>
This is what I see in the schema:
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd
<xsd:key name="web-app-role-name-key">
<xsd:annotation>
<xsd:documentation>
A role-name-key is specified to allow the references
from the security-role-refs.
</xsd:documentation>
</xsd:annotation>
<xsd:selector xpath="javaee:security-role"/>
<xsd:field xpath="javaee:role-name"/>
</xsd:key>
Lloyd
On May 4, 2008, at 5:58 AM, Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Lloyd,
>
> DIGLLOYD INC wrote:
> | <security-role>
> | <role-name>guest1</role-name>
> | <role-name>guest2</role-name>
> | </security-role>
>
> Not sure if Tomcat actually cares, but this is an invalid
> configuration.
> Look at the DTD or Schema (whichever one you are using) again.
>
> - -chris
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkgdsvkACgkQ9CaO5/Lv0PA11gCfY+qjBS8Ps/+Oo6euBrtH2XYX
> WG8AmwQua1rRdHt8XZ9R59bUvYprX9MG
> =zP74
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Lloyd Chambers
http://diglloyd.com
[Mac OS X 10.5.2 Intel, Tomcat 6.0.16]
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: authenticated but not authorized -- blank page
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Lloyd,
DIGLLOYD INC wrote:
| <security-role>
| <role-name>guest1</role-name>
| <role-name>guest2</role-name>
| </security-role>
Not sure if Tomcat actually cares, but this is an invalid configuration.
Look at the DTD or Schema (whichever one you are using) again.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkgdsvkACgkQ9CaO5/Lv0PA11gCfY+qjBS8Ps/+Oo6euBrtH2XYX
WG8AmwQua1rRdHt8XZ9R59bUvYprX9MG
=zP74
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org