Admin and SSL

[Brian McSweeney <br...@aurium.net>]

Hi everyone,

I'm getting really confused so perhaps someone can help me :-(

I'm using struts and JBoss. I'm almost finished my app and I have two things left to do.

1) I want to just add ssl where necessary and 
2) I want to create my pages which are visible only by an administrator.

I'm putting them together in one question because they seem to be related.

I didn't want to have to create a new user type in my database for administrators. I thought 
the easiest way to do the administration side would be through using the tomcat-users.xml 
file to declare the administrator role and password, and use the <security-constraint> tag 
in the web.xml file. For example, to secure the page named "protected-page.jsp", with ssl and 
to be accessible only by the administrator, I would add to the web.xml :

  <security-constraint>
    <!-- web resources that are protected -->
    <web-resource-collection>
     <web-resource-name>A Protected Page</web-resource-name>
     <url-pattern>/protected-page.jsp</url-pattern>
    </web-resource-collection>
 
    <auth-constraint>
     <!-- role-name indicates roles that are allowed
        to access the web resource specified above -->
     <role-name>administrator</role-name>
    </auth-constraint>
    <user-data-constraint>    
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
 
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Basic Authentication Example</realm-name>
  </login-config>

Does this seem reasonable?


Now my problem is, I also want to use ssl to secure my normal users 
login. However, to implement this login I have a custom action to check 
the database for username and password. Do I add another security 
constraint in the web.xml file for this? And if so, how do I ensure that 
it doesn't get associate with the login-config?

I know this is a long email, and quite confused. Sorry, it's all getting a 
bit much for me!