Is auth-constraint related to security-role?

[Rick Roberts]

I have searched HFS&J and Mikalai Zaikin's Notes and still don't understand this concept. Maybe the answer is there and I just missed it but:

Is the <role-name> element in <auth-constraint> related to the <role-name>
element in <security-role> ?


Edited to include a code example:

<web-app>
  <security-constraint>

    <web-resource-collection>
<web-resource-name>User Auth</web-resource-name>
<url-pattern>/auth/*</url-pattern>
    </web-resource-collection>

    <http-method>POST</http-method>
    <auth-constraint>
<role-name>admin</role-name>
<role-name>manager</role-name>
    </auth-constraint>

    <user-data-constraint>
<transport-quarantee>CONFIDENTIAL</transport-quarantee>
    </user-data-constraint>

  </security-constraint>
  <login-config>
<auth-method>FORM</auth-method>
<realm-name>User Auth</realm-name>

<form-login-config>
    <form-login-page>login.jsp</form-login-page>
    <form-error-page>error.jsp</form-error-page>
</form-login-config>

  </login-config>

  <security-role>
<role-name>admin</role-name>
  </security-role>

  <security-role>
<role-name>manager</role-name>
  </security-role>

</web-app>

Thanks
[ October 15, 2006: Message edited by: Rick Roberts ]

[Kai Witte]

hello,

yes. Normally in auth-constraint only roles which are declared using security-role would be used.

Kai

[Rick Roberts]

Does that mean that a <security-role> <role-name> is required before you can use <auth-constraint> <role-name> ?

[Kai Witte]

hello,

without the security-role declaration the container would normally not be able to (or is not allowed to be able to?) map the role names in the auth-constraint to the ones that are set up in the container-specific configuration.

I recommend to just set up such a system, for example with the Tomcat MemoryRealm.

Kai

[Rick Roberts]

I have set it up in my tomcat and I still don't get it.

It doesn't work the way that I expect it would I will probably be able to figure it out. I may have to reference the tomcat docs.

But more importantly, I don't think that HFS&J nor Mikalai's notes gives enough info to understand how this works.