security, web.xml: multiple override wildcard

[aldana <al...@gmx.de>]

i am combininig multiple <security-constraint> and wildcard pattern. The
result is a bit confusing.

only and single <security-constraint> def:
===
<security-constraint>
    <web-resource-collection>
      <web-resource-name>HTMLManger and Manager command</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
       <role-name>admin</role-name>
    </auth-constraint>
  </security-constraint>
===

Above gives me access to all ressources.

Now adding another constraint disallows the 'admin' to access ressource
/foo:
===
<security-constraint>
    <web-resource-collection>
      <web-resource-name>HTMLManger and Manager command</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
       <role-name>admin</role-name>
    </auth-constraint>
  </security-constraint>

    <security-constraint>
    <web-resource-collection>
      <web-resource-name>HTMLManger and Manager command</web-resource-name>
      <url-pattern>/foo</url-pattern>
    </web-resource-collection>
    <auth-constraint>
       <role-name>other</role-name>
    </auth-constraint>
  </security-constraint>
===

This is counterintuitive, I would still expect 'admin' to access all
ressources, because it has /* wildcard.

After debugging tomcat confirms, adding constraints is side-effecting
exististing constraints.

When reading the servlet specification SRV.12.8.1 it mentions an union
operation of multiple <security-constraint>. But to me above behaviour looks
more like a difference operation (the 2nd security constraint is removing a
right from the 1st one).

Or maybe I am reading something wrong...?

thanks.

-----
manuel aldana
aldana((at))gmx.de
software-engineering blog: http://www.aldana-online.de
-- 
View this message in context: http://old.nabble.com/security%2C-web.xml%3A-multiple-%3Csecurity-constraint%3E-override-wildcard-%3Cweb-resource-collection%3E-tp28219182p28219182.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: security, web.xml: multiple override wildcard

[Christopher Schultz <ch...@christopherschultz.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Manuel,

On 4/12/2010 4:38 PM, aldana wrote:
> This is counterintuitive, I would still expect 'admin' to access all
> ressources, because it has /* wildcard.
> 
> After debugging tomcat confirms, adding constraints is side-effecting
> exististing constraints.
> 
> When reading the servlet specification SRV.12.8.1 it mentions an union
> operation of multiple <security-constraint>. But to me above behaviour looks
> more like a difference operation (the 2nd security constraint is removing a
> right from the 1st one).

Re-read those sections: it says that constraints are combined when they
have the same pattern and method. You have different patterns, so the
will not be combined.

There's a great example right there in the text that demonstrates this.

What version of the spec are you reading? In mine (v2.5 MR6), the
relevant section is 12.7.1, not 12.8.1.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkvDihMACgkQ9CaO5/Lv0PAqHACfSjs0H+q2x/Bu2a2BBegeOxc9
sIgAoILDz5M5H80k1ST5SHec8IhzpoQ2
=6Uys
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org