RBAC check fails Security Constraint Not Enforced

I configured a simple WAR to ony allow a specific role to be able to execute my Helloworld url. Now it appears that any valid user defined on the appserver can access the url. Shouldn't it be limited to the specific role i defined using the deploytool? It almost appears as if the security constraint is not being enforced. All of the users in thefile realm are allowed to access it, instead of the role that's specified in the security constraints.

I'm using Sun Java System Application Server Enterprise Edition 8.2 (build b25-fcs)

web.xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

<display-name>Helloworld</display-name>

<servlet>

<display-name>HelloworldImpl</display-name>

<servlet-name>HelloworldImpl</servlet-name>

<servlet-class>com.boeing.mcc.trade.HelloworldImpl</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>HelloworldImpl</servlet-name>

<url-pattern>/Helloworld</url-pattern>

</servlet-mapping>

<jsp-config/>

<security-constraint>

<display-name>SecurityConstraint</display-name>

<web-resource-collection>

<web-resource-name>WRCollection</web-resource-name>

<url-pattern>/Helloworld/*</url-pattern>

<http-method>POST</http-method>

<http-method>GET</http-method>

</web-resource-collection>

<auth-constraint>

<role-name>OPERATOR</role-name>

</auth-constraint>

<user-data-constraint>

<transport-guarantee>NONE</transport-guarantee>

</user-data-constraint>

</security-constraint>

<login-config>

<auth-method>BASIC</auth-method>

<realm-name>file</realm-name>

</login-config>

<security-role>

<role-name>ADMIN</role-name>

</security-role>

<security-role>

<role-name>ANALYST</role-name>

</security-role>

<security-role>

<role-name>OPERATOR</role-name>

</security-role>

</web-app>

Message was edited by:

weinhard

Message was edited by:

weinhard

Message was edited by:

weinhard

[2727 byte] By [weinharda] at [2007-11-27 8:34:36]