Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm developing a small web-application for study. I want to use controller servlet in order to redirect users' requests and control them. To do this I'm doing the following mapping in web.xml:

 <servlet>
    <servlet-name>ServletController</servlet-name>
    <servlet-class>servlet.ServletController</servlet-class>
 </servlet>
 <servlet>
    <servlet-name>IndexJSP</servlet-name>
    <jsp-file>/index.jsp</jsp-file>
 </servlet>
 <servlet-mapping>
    <servlet-name>ServletController</servlet-name>
    <url-pattern>/*</url-pattern>
 </servlet-mapping>
 <servlet-mapping>
    <servlet-name>IndexJSP</servlet-name>
    <url-pattern>/index.jsp</url-pattern>
 </servlet-mapping>

Then I need to allow my controller to get access to other jsps to redirect users to different pages. In the book of Bruce W. Perry, the author advises to add the security-constrain to web.xml in this way:

<security-constraint>
    <display-name>ConstraintIndex</display-name>
    <web-resource-collection>
        <web-resource-name>IndexJSP</web-resource-name>
        <description>Main page</description>
        <url-pattern>/index.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>nullrole</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
</login-config>
<security-role>
    <role-name>nullrole</role-name>
</security-role>

"Nullrole" is the role, which is not owned by any user. It seems to work fine: when user tries to access index.jsp he is asked for login/password, but controller has free access. Nevertheless, I don't understand what login and password may be used in authentification window when user types "index.jsp" directly in browser. As I could see, there are no roles in Glassfish: there are realms like "file" and "admin-realm". So, there is no "Nullrole" either. Could anyone explain, how to add to Glassfish empty role and how to use it in order to restrict anyone's direct access to pages from browser?

share|improve this question

migrated from stackoverflow.com Oct 25 '11 at 13:09

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 0 down vote accepted

I don't understand completely your question but if you ask how to add more roles and map them to users this will answer your question: role mapping java ee security module

Roles can be assigned to multiple users, groups. You use roles to restrict access to pages.

If you want to set where from get users you have to add in your web.xml something like this:

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>siteSecurity</realm-name>
    <form-login-config>
        <form-login-page>/pages/login.jsp</form-login-page>
        <form-error-page>/pages/login.jsp?retry=true</form-error-page>
    </form-login-config>
</login-config>

You have to add your siteSecurity realm in your glassfish.

An useful link of how to do this: how to create realm

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.