Managing user's roles in Glassfish

Question

I'm developing a small web-application for study. I want to use controller servlet in order to redirect users' requests and control them. To do this I'm doing the following mapping in web.xml:

 <servlet>
    <servlet-name>ServletController</servlet-name>
    <servlet-class>servlet.ServletController</servlet-class>
 </servlet>
 <servlet>
    <servlet-name>IndexJSP</servlet-name>
    <jsp-file>/index.jsp</jsp-file>
 </servlet>
 <servlet-mapping>
    <servlet-name>ServletController</servlet-name>
    <url-pattern>/*</url-pattern>
 </servlet-mapping>
 <servlet-mapping>
    <servlet-name>IndexJSP</servlet-name>
    <url-pattern>/index.jsp</url-pattern>
 </servlet-mapping>

Then I need to allow my controller to get access to other jsps to redirect users to different pages. In the book of Bruce W. Perry, the author advises to add the security-constrain to web.xml in this way:

<security-constraint>
    <display-name>ConstraintIndex</display-name>
    <web-resource-collection>
        <web-resource-name>IndexJSP</web-resource-name>
        <description>Main page</description>
        <url-pattern>/index.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>nullrole</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
</login-config>
<security-role>
    <role-name>nullrole</role-name>
</security-role>

"Nullrole" is the role, which is not owned by any user. It seems to work fine: when user tries to access index.jsp he is asked for login/password, but controller has free access. Nevertheless, I don't understand what login and password may be used in authentification window when user types "index.jsp" directly in browser. As I could see, there are no roles in Glassfish: there are realms like "file" and "admin-realm". So, there is no "Nullrole" either. Could anyone explain, how to add to Glassfish empty role and how to use it in order to restrict anyone's direct access to pages from browser?

Answer 1

I don't understand completely your question but if you ask how to add more roles and map them to users this will answer your question: role mapping java ee security module

Roles can be assigned to multiple users, groups. You use roles to restrict access to pages.

If you want to set where from get users you have to add in your web.xml something like this:

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>siteSecurity</realm-name>
    <form-login-config>
        <form-login-page>/pages/login.jsp</form-login-page>
        <form-error-page>/pages/login.jsp?retry=true</form-error-page>
    </form-login-config>
</login-config>

You have to add your siteSecurity realm in your glassfish.

An useful link of how to do this: how to create realm