You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Patrick Scheuerer <ta...@hispeed.ch> on 2004/01/05 03:00:14 UTC
Struts and Container-managed security
Hi,
I would like to accomplish the following:
In my webapp there's a mapping /myapp/admin and everything below that should be
restricted. The way the authentication works is like this:
A user logs in via a login form. the login action checks in the database and if
the user exists a user object is saved in session scope.
is it possible to define a security constraint in web.xml which restricts access
to /myapp/admin/* but somehow checks for the presence of the user object in the
session? or do i have to check in every admin action for the presence of the
user object? I read that i can also specify roles for each action. how does
struts check for those roles? how can i tell struts to check for my user objects?
Could the processRoles method in RequestProcessor be of any use?
Any suggestions, comments and tips would be highly appreciated!
Thanks a lot,
Patrick
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Struts and Container-managed security
Posted by Patrick Scheuerer <ta...@hispeed.ch>.
Carl wrote:
> Hi,
>
> You can map a filter on /myapp/admin/* which check the presence of a
> valide UserBean in the session. The login action put a valide UserBean
> in he session and the logout action remove it.
Thanks for the good idea Carl. I'm trying to get this working. I want to define
two filters. A UserFilter which just creates an aynonymous user object if none
exists yet and an AdminFilter which filters all requests for the mapping /admin/*.
Somehow I can't get it to work. I've been checking different documents, I've
been cutting and pasting code from Sun's website but it doesn't work.
Here's my filter definition in web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<filter>
<filter-name>UserFilter</filter-name>
<filter-class>ch.ctc.support.common.UserFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>UserFilter</filter-name>
<url-pattern>/execute/*</url-pattern>
</filter-mapping>
...
If i start up tomcat the following exception is thrown:
SEVERE: Parse error in application web.xml
java.lang.IllegalArgumentException: Filter mapping must specify either a
<url-pattern> or a <servlet-name>
at org.apache.commons.digester.Digester.createSAXException(Digester.java:2540)
at org.apache.commons.digester.Digester.createSAXException(Digester.java:2566)
at org.apache.commons.digester.Digester.endElement(Digester.java:1061)
at org.apache.xerces.parsers.AbstractSAXParser.endElement(Unknown Source)
at org.apache.xerces.impl.dtd.XMLDTDValidator.endNamespaceScope(Unknown Source)
at org.apache.xerces.impl.dtd.XMLDTDValidator.handleEndElement(Unknown Source)
at org.apache.xerces.impl.dtd.XMLDTDValidator.endElement(Unknown Source)
at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanEndElement(Unknown
Source)
at
org.apache.xerces.impl.XMLDocumentFragmentScannerImpl$FragmentContentDispatcher.dispatch(Unknown
Source)
at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown
Source)
at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
at org.apache.xerces.parsers.DTDConfiguration.parse(Unknown Source)
at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
at org.apache.xerces.parsers.AbstractSAXParser.parse(Unknown Source)
at org.apache.commons.digester.Digester.parse(Digester.java:1548)
at
org.apache.catalina.startup.ContextConfig.applicationConfig(ContextConfig.java:302)
at org.apache.catalina.startup.ContextConfig.start(ContextConfig.java:644)
at org.apache.catalina.startup.ContextConfig.lifecycleEvent(ContextConfig.java:254)
at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:166)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:4212)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:866)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:850)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:633)
at
org.apache.catalina.core.StandardHostDeployer.install(StandardHostDeployer.java:316)
at org.apache.catalina.core.StandardHost.install(StandardHost.java:859)
at org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:723)
at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:473)
at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1002)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:393)
at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:166)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1133)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:816)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1125)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:518)
at org.apache.catalina.core.StandardService.start(StandardService.java:519)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:2343)
at org.apache.catalina.startup.Catalina.start(Catalina.java:581)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:297)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:398)
What the hell is going on here??? I DID specify the <url-pattern>! Can somebody
please help me?
Thanks a lot,
Patrick
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Struts and Container-managed security
Posted by Carl <mu...@altern.org>.
Hi,
You can map a filter on /myapp/admin/* which check the presence of a
valide UserBean in the session. The login action put a valide UserBean
in he session and the logout action remove it.
Regards,
Carl
Patrick Scheuerer wrote:
> Hi,
>
> I would like to accomplish the following:
>
> In my webapp there's a mapping /myapp/admin and everything below that
> should be restricted. The way the authentication works is like this:
> A user logs in via a login form. the login action checks in the database
> and if the user exists a user object is saved in session scope.
> is it possible to define a security constraint in web.xml which
> restricts access
> to /myapp/admin/* but somehow checks for the presence of the user object
> in the session? or do i have to check in every admin action for the
> presence of the user object? I read that i can also specify roles for
> each action. how does struts check for those roles? how can i tell
> struts to check for my user objects?
> Could the processRoles method in RequestProcessor be of any use?
>
> Any suggestions, comments and tips would be highly appreciated!
>
> Thanks a lot,
> Patrick
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org