web security not working as expected,

[Anil Deshpande]

I have written two index.jsp files in /Beer/AddRecipe and /Beer/ReviewRecipe/ folders. And one index.html in the application context. And have done changes to the tomcat-usres.xml

tomcat-users.xml looks like as follows.

  <?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="Guest"/>
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <role rolename="Admin"/>
  <role rolename="Member"/>
  <user username="Annie" password="Admin" roles="Admin,Member,Guest"/>
  <user username="Diane" password="coder" roles="Member,Guest"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="role1" password="tomcat" roles="role1"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="Ted" password="newbie" roles="Guest"/>
</tomcat-users>
  

Line 3,4,5,6,7 were there previously. All other things I have done.

And the wrote web.xml which looks as follows

  <web-app xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">
  
  <security-role>
  	<role-name>Admin</role-name>
  </security-role>
  
  <security-role>
  	<role-name>Member</role-name>
  </security-role>
  
  <security-role>
  	<role-name>Guest</role-name>
  </security-role>
    
  <login-config>
  	<auth-method>BASIC</auth-method>
  </login-config>
  
  
  <security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Update Recipes</web-resource-name>
  		
  		<url-pattern>/Beer/AddRecipe/*</url-pattern>
  		
  		<http-method>GET</http-method>
  		<http-method>POST</http-method>
  	</web-resource-collection>
  	
  	<auth-constraint>
  		<role-name>Admin</role-name>
  		<role-name>Member</role-name>
  	</auth-constraint>
  </security-constraint>
</web-app>  

But the problem is when I type in http://localhost:8080/testauth1/Beer/AddRecipe/index.jsp or http://localhost:8080/testauth1/Beer/ReviewRecipe/index.jsp it is not doing any authentication or authorization. Is there any thing wrong with my xml files. and Another thing do I have to remove role name in tomcat-users.xml that were there previously.


It works for the first time. But next time it doesn't as for username and password

[Chinmaya Chowdary]

Hi Anil.

You have not made resouce '/Beer/ReviewRecipe/' as constrained. If you made,

    http://localhost:8080/testauth1/Beer/ReviewRecipe/index.jsp

it will work.

It works for the first time. But next time it doesn't ask for username and password

For the first request, tomcat creates session object and sets the time period of 30 min's(default time period of tomcat) and adds it to the cookie object and sends it to the client. Next time client will communicate to the tomcat via. cookie(JSESSIONID cookie).

For the second request if we want authentication, delete cookie at the browser side and send request.

[Anil Deshpande]

Thanks for the clarification on why it doesn't work for next requests. Another thing , I have written security-constraint in line number 23 to 37. I worked fine.