Authentication

[MaheshS Kumbhar]

To get authentication working, we must use

<login-config>
<auth-method>BASIC<auth-method>
</login-config>

In addition to that, if we dont specify

<auth-constraint>

element inside

<security-constraint>

then this tells the Container to allow unauthenticated access to URL's matching to

<url-pattern>

element inside

<security-constraint>

.

So does this mean that specifying only

<login-config>

element in DD is not enough to allow authentication working, it needs to be used in combination with

<auth-constraint>

element too to get authentication working.

[Frits Walraven]

Hi MaheshS,

does this mean that specifying only <login-config> element in DD is not enough to allow authentication working, it needs to be used in combination with

That is correct.

There is a subtle difference between:

Allowing everybody -> so no <auth-constraint>

Allowing known users -> <auth-constraint> with <role-name> of *

Regards,
Frits