Win a copy of Testing JavaScript Applications this week in the HTML Pages with CSS and JavaScript forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
  • Campbell Ritchie
  • Bear Bibeault
  • Ron McLeod
  • Jeanne Boyarsky
  • Paul Clapham
  • Tim Cooke
  • Liutauras Vilda
  • Junilu Lacar
Saloon Keepers:
  • Tim Moores
  • Stephan van Hulst
  • Tim Holloway
  • fred rosenberger
  • salvin francis
  • Piet Souris
  • Frits Walraven
  • Carey Brown

how many auth-constraint's per security-constraint

Ranch Hand
Posts: 80
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator

Question 11 on p797 of HFJS has an error I believe.

I can't type the whole question here, so I will summarize. In choice B of the question it states: "It is valid for more instances of auth-constraint to exist within the single tag described above." By "single tag described above" they are referring to the security-constraint tag.

Then in their answer section they mark this answer as true. But I believe it is false.

My question: Am I correct that only one auth-constraint can exist per security-constraint?

Ranch Hand
Posts: 132
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hello JohnWilliam,

your are right. Check this link Under "Changes made in the 07/08 printing" you 'll find there the following sentence:

[833] Question 11;
Answers given are A,B,D,E,F
But, options B and F should not be correct.
- Only one instance of <auth-constraint> will exist within one <security-constraint> tag. The deployment descriptor DTD has the following definition for <security-constraint> as per servlet spec is <!ELEMENT security-constraint (web-resource-collection+, auth-constraint?, user-data-constraint?)> - This tag implies that authorization, data integrity and confidentiality security features are all declared for the wen application. And not authentication. Authentication is declared using the <login-config> tag. As per the servlet spec - The login-config element is used to configure the authentication method that should be used, the realm name that should be used for this application, and the attributes that are needed by the form login mechanism. <!ELEMENT login-config (auth-method?, realm-name?, form-loginconfig?)>

Removed the checkmark from options B and F

[ December 09, 2008: Message edited by: Christian Nicoll ]
JohnWilliam Fitz
Ranch Hand
Posts: 80
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Thanks so much! Looks like I should download and read the errata!
catch it before it slithers away! Oh wait, it's a tiny ad:
Thread Boost feature
    Bookmark Topic Watch Topic
  • New Topic