[jdiscuss][mock][question]

[S.L.Narayanan]

Hi friends
I got a question as follows:

 
  Consider the following web.xml code snippet: 
 

    <servlet>
        <servlet-name>BankServlet</servlet-name>
        <servlet-class>com.abc.bankapp.BankServlet</servlet-class>
        <security-role-ref>
            <role-name>manager</role-name>
            <role-link>supervisor</role-link>
        </security-role-ref>
    </servlet>
 

Which of the following statements are correct?
 
Select 1 correct option. 
  
(A).The servlet code should use "manager" as a parameter in request.isUserInRole() method. 
   
(B).The servlet code can use "manager" or "supervisor" as a parameter in request.isUserInRole() method. 
   
(C).The servlet code should use"supervisor" as a parameter in request.isUserInRole() method. 
   
(D).The role of "manager" must be defined in the servlet container. 
  "supervisor" must be defined in the container. For example, in conf/tomcat-users.xml for Tomcat. 
    
(E).None of these. 
 
 

My answer was B. But the answer given was A. How it is possible?. As far as I know if we use the name given in <role-link> directly in the isUserInRole() method then it should directly map to the role. Am I right?

[Narendra Dhande]

Hi,

<security-role-ref>
<role-name>manager</role-name>
<role-link>supervisor</role-link>
</security-role-ref>

<security-role-ref> element, combined with <security> element can link a security role name used in a servlet as the argument to HttpServletRequest.isUserInRole() method to a role name known by the web container. All role names definded by <security-role> elements must be mapped to users and/or groups known by the web container. How this is done is container dependent. The <security-role-element> allows you to use servlet that uses a role name in the isUserRole() method that is not defined by a <security-role> elemnt. A typical scenario where this can be useful is whem you combine servlets from different sources into one application, and the servlets use different role names for tyhe same logical role.

So I think the given answer is correct.

Thanks