You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Marquez, Omar" <om...@navteq.com> on 2005/09/20 17:40:34 UTC
Mixing Form-based authentication with Public Resources
Hi,
Im using Tomcat Form-based Authentication with a JDBC realm, this is working
ok for all my pages that are protected trough web.xml with
<security-constraint>
<web-resource-collection>
<web-resource-name>All System</web-resource-name>
<url-pattern>*.do</url-pattern>
<url-pattern>*.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>sys_user</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
however, now I have a set of pages, report*.jps and report*.do for which I
would like to NOT require authentication. I.e. "Public access". My question
is how can I declare a Public Resource in web xml that will not affect the
"All System" security constrain above ?
I tried, without luck, inserting before the constrain above a new constrain
like so:
<security-constraint>
<web-resource-collection>
<web-resource-name>Public Resources</web-resource-name>
<url-pattern>/includes/*</url-pattern>
<url-pattern>report*.do</url-pattern>
<url-pattern>report*.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Anonymous</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
Anybody knows the solution for this problem?
Thanks,
Omar
--
Omar Marquez
Techops Software Engineer
NAVTEQ
222 Merchandise Mart
Suite 900
Chicago, IL 60654, USA
Ph. (312) 894-7689
The information contained in this communication may be CONFIDENTIAL and is
intended only for the use of the recipient(s) named above. If you are not
the intended recipient, you are hereby notified that any dissemination,
distribution, or copying of this communication, or any of its contents, is
strictly prohibited. If you have received this communication in error,
please notify the sender and delete/destroy the original message and any
copy of it from your computer or paper files.
Re: Mixing Form-based authentication with Public Resources
Posted by Tim Funk <fu...@joedog.org>.
No solution. You can filter prefix, or suffix, but not both.
-Tim
Marquez, Omar wrote:
> Hi,
>
> Im using Tomcat Form-based Authentication with a JDBC realm, this is working
> ok for all my pages that are protected trough web.xml with
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>All System</web-resource-name>
> <url-pattern>*.do</url-pattern>
> <url-pattern>*.jsp</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>sys_user</role-name>
> </auth-constraint>
> <user-data-constraint>
> <transport-guarantee>NONE</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
>
> however, now I have a set of pages, report*.jps and report*.do for which I
> would like to NOT require authentication. I.e. "Public access". My question
> is how can I declare a Public Resource in web xml that will not affect the
> "All System" security constrain above ?
> I tried, without luck, inserting before the constrain above a new constrain
> like so:
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>Public Resources</web-resource-name>
> <url-pattern>/includes/*</url-pattern>
> <url-pattern>report*.do</url-pattern>
> <url-pattern>report*.jsp</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>Anonymous</role-name>
> </auth-constraint>
> <user-data-constraint>
> <transport-guarantee>NONE</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
>
> Anybody knows the solution for this problem?
> Thanks,
> Omar
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org