I'm developing a small web-application for study. I want to use controller servlet in order to redirect users' requests and control them. To do this I'm doing the following mapping in web.xml:
<servlet> <servlet-name>ServletController</servlet-name> <servlet-class>servlet.ServletController</servlet-class> </servlet> <servlet> <servlet-name>IndexJSP</servlet-name> <jsp-file>/index.jsp</jsp-file> </servlet> <servlet-mapping> <servlet-name>ServletController</servlet-name> <url-pattern>/*</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>IndexJSP</servlet-name> <url-pattern>/index.jsp</url-pattern> </servlet-mapping>
Then I need to allow my controller to get access to other jsps to redirect users to different pages. In the book of Bruce W. Perry, the author advises to add the security-constrain to web.xml in this way:
<security-constraint> <display-name>ConstraintIndex</display-name> <web-resource-collection> <web-resource-name>IndexJSP</web-resource-name> <description>Main page</description> <url-pattern>/index.jsp</url-pattern> </web-resource-collection> <auth-constraint> <role-name>nullrole</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>NONE</transport-guarantee> </user-data-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config> <security-role> <role-name>nullrole</role-name> </security-role>
"Nullrole" is the role, which is not owned by any user. It seems to work fine: when user tries to access index.jsp he is asked for login/password, but controller has free access. Nevertheless, I don't understand what login and password may be used in authentification window when user types "index.jsp" directly in browser. As I could see, there are no roles in Glassfish: there are realms like "file" and "admin-realm". So, there is no "Nullrole" either. Could anyone explain, how to add to Glassfish empty role and how to use it in order to restrict anyone's direct access to pages from browser?