[jira] Updated: (GERONIMO-1384) Provide default security realm for web-apps with secured pages deployed without a plan

["David Jencks (JIRA)" <de...@geronimo.apache.org>]

     [ http://issues.apache.org/jira/browse/GERONIMO-1384?page=all ]

David Jencks updated GERONIMO-1384:
-----------------------------------

        Summary: Provide default security realm for web-apps with secured pages deployed without a plan  (was: Web app with no Geronimo plan makes all secure pages insecure)
           type: New Feature  (was: Bug)
    Fix Version: Wish List
                     (was: 1.1.1)
       Priority: Minor  (was: Trivial)

Changed subject, target version since the original problem is fixed and perhaps the goal of having a default security realm could be debated.

> Provide default security realm for web-apps with secured pages deployed without a plan
> --------------------------------------------------------------------------------------
>
>          Key: GERONIMO-1384
>          URL: http://issues.apache.org/jira/browse/GERONIMO-1384
>      Project: Geronimo
>         Type: New Feature
>     Security: public(Regular issues) 
>   Components: security, web
>     Versions: 1.0-M5
>     Reporter: Aaron Mulder
>     Priority: Minor
>      Fix For: Wish List
>  Attachments: security-reject.patch
>
> If you deploy a web application with certain pages/URLs protected by a login, but you don't include a Geronimo deployment plan, all those pages/URLs are unprotected.  To replicate:
> Deploy this with no plan: http://cvs.apache.org/repository/geronimo/wars/geronimo-ldap-demo-1.0-SNAPSHOT.war
> and then visit http://localhost:8080/geronimo-ldap-demo-1.0-SNAPSHOT and click the links to "secure" and "forbidden".  Both links work, with no login prompt.  Instead, you should get a login prompt and (since no realm was configured) all logins should fail.
> The web.xml in this case contains:
>     <security-constraint>
>       <web-resource-collection>
>         <web-resource-name>Admin Role</web-resource-name>
>         <url-pattern>/protect/*</url-pattern>
>       </web-resource-collection>
>       <auth-constraint>
>         <role-name>content-administrator</role-name>
>       </auth-constraint>
>     </security-constraint>
>     
>     <security-constraint>
>       <web-resource-collection>
>         <web-resource-name>No Access</web-resource-name>
>         <url-pattern>/forbidden/*</url-pattern>
>       </web-resource-collection>
>       <auth-constraint/>
>     </security-constraint>
>     <login-config>
>       <auth-method>FORM</auth-method>
>       <realm-name>MYREALM</realm-name>
>       <form-login-config>
>          <form-login-page>/auth/logon.html?param=test</form-login-page>
>          <form-error-page>/auth/logonError.html?param=test</form-error-page>
>       </form-login-config>
>     </login-config>
>   <security-role>
>       <role-name>content-administrator</role-name>
>   </security-role>

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
   http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
   http://www.atlassian.com/software/jira