You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@tomcat.apache.org by Peter Coppens <pc...@gmail.com> on 2006/12/22 11:54:30 UTC

Form based authentaction but not for static resources

Tomcat fans,

I have a (I assume basic) question wrt servlet/tomcat
authentication/authorization

First let me indicate I would like my URL to always be something like 
http://<host>/username

I have configured a security-constraint like

<security-constraint>
  <web-resource-collection>
    <web-resource-name>myapp</web-resource-name>
      <url-pattern>/*</url-pattern>
      <http-method>POST</http-method>
      <http-method>GET</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>user</role-name>
     </auth-constraint>
 </security-constraint>


I would however like to have some static resources accessible without any
authentication. Typically these would be identified with 
http://<host>/resouce/appstyle.css etc.

The reason is that I would like to have the login page use an external
stylesheet and/or some images.

Is that at all possible? Any guidelines how to achieve that?

Thanks,

Peter
-- 
View this message in context: http://www.nabble.com/Form-based-authentaction-but-not-for-static-resources-tf2870124.html#a8021941
Sent from the Tomcat - User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Form based authentaction but not for static resources

Posted by Peter Coppens <pc...@gmail.com>.

Thanks, I will, Peter.


Mikolaj Rydzewski-2 wrote:
> 
> Peter Coppens wrote:
>> I understand that that is the way a typical servlet deployment would work
>> yes. On the other hand, it would not meet the url requirements that are
>> imposed on me.
>>   
> So you can try http://securityfilter.sourceforge.net/
> 
> -- 
> Mikolaj Rydzewski <mi...@ceti.pl>
> 
> 
>  
> 

-- 
View this message in context: http://www.nabble.com/Form-based-authentaction-but-not-for-static-resources-tf2870124.html#a8025548
Sent from the Tomcat - User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Form based authentaction but not for static resources

Posted by Mikolaj Rydzewski <mi...@ceti.pl>.

Peter Coppens wrote:
> I understand that that is the way a typical servlet deployment would work
> yes. On the other hand, it would not meet the url requirements that are
> imposed on me.
>   
So you can try http://securityfilter.sourceforge.net/

-- 
Mikolaj Rydzewski <mi...@ceti.pl>

Re: Form based authentaction but not for static resources

Posted by Peter Coppens <pc...@gmail.com>.

I understand that that is the way a typical servlet deployment would work
yes. On the other hand, it would not meet the url requirements that are
imposed on me.

Thanks,

Peter


Mikolaj Rydzewski-2 wrote:
> 
> Peter Coppens wrote:
>> <security-constraint>
>>   <web-resource-collection>
>>     <web-resource-name>myapp</web-resource-name>
>>       <url-pattern>/*</url-pattern>
>>   
> Use pattern like *.jsp, *.do or /secure/*
> 
> 
> -- 
> Mikolaj Rydzewski <mi...@ceti.pl>
> 
> 
>  
> 

-- 
View this message in context: http://www.nabble.com/Form-based-authentaction-but-not-for-static-resources-tf2870124.html#a8023769
Sent from the Tomcat - User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Form based authentaction but not for static resources

Posted by Mikolaj Rydzewski <mi...@ceti.pl>.

Peter Coppens wrote:
> <security-constraint>
>   <web-resource-collection>
>     <web-resource-name>myapp</web-resource-name>
>       <url-pattern>/*</url-pattern>
>   
Use pattern like *.jsp, *.do or /secure/*


-- 
Mikolaj Rydzewski <mi...@ceti.pl>