Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> Enterprise & Remote Computing >> Web Tier APIs

Web.xml: <security-constraint> [un]usable in JSF?

<security-constraint> in web.xml is a simple, effective and portable method of declaring a web application抯 security policies.

It's been noted, however, in an earlier topic (http://forum.java.sun.com/thread.jspa?threadID=747919&messageID=4279347) that it has it抯 limitations in the context of jsf.

A reasonable solution would be to consult <security-constraint> elements in one抯 own web.xml when rendering <h:commandLink>'s on a page according to the security policy.

Unfortunately, there is no standard method of reading web.xml, other than what抯 available from the ServletContext.

I found some container specific-implementations in the Cargo project from the http://cargo.codehaus.org,

but I抦 looking for a portable solution. Any thoughts?

Thanks, y抋ll!

[825 byte] By [openinaa] at [2007-11-26 13:18:54]
«« Where is my C:\Sun\Appserver folder?
»» SQLServer 2000 Connectivity with Tomcat 5.5
# 1

Use the <security-role-ref> for the Faces Servlet to map the LDAP roles to the logical role names used by the managed bean to determine if links may be rendered.

Bean code:

this.isAdmin = context.getExternalContext().isUserInRole("admin");

web.xml:

<security-role>

<role-name>Local Admin Group</role-name>

</security-role>

<security-role>

<role-name>DBA Group</role-name>

</security-role>

<!-- Faces Servlet -->

<servlet>

<servlet-name>Faces Servlet</servlet-name>

<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>

...

<security-role-ref>

<role-name>admin</role-name>

<role-link>DBA Group</role-link>

</security-role-ref>

<security-role-ref>

<role-name>admin</role-name>

<role-link>Local Admin Group</role-link>

</security-role-ref>

</servlet>

openinaa at 2007-7-7 17:44:51 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
Enterprise & Remote Computing
Web Tier APIs

Enterprise & Remote Computing New Topic

Enterprise & Remote Computing Hot Topic

Enterprise & Remote Computing

All Classified