securing JSP pages

Hi,

I want that nobody can bypass the login-page of my application. i.e. It should not be possible that you can access the internal jsp pages just by typing the URL (once u know by any means). To access them you have to login into the application.

I am using JBOSS server for this application. When i m using the following code into my deployment-descriptor then none of the page is accessible;

<security-constraint>

<web-resource-collection>

<web-resource-name>no_access</web-resource-name>

<url-pattern>*.jsp</url-pattern>

</web-resource-collection>

<auth-constraint/>

</security-constraint>

Also please tell me that how we can define the roles (specific for diff. users)

Any response/clue will be appriciated.

thanks.

[854 byte] By [Prashant001a] at [2007-10-2 18:49:01]