Section 6 - Security - BASIC Authentication ?

[Dumitru Husleag]

I didnt managed to make an working example. This is my security section from web.xml:

 
  <security-constraint>
    <display-name>manager</display-name>
    <web-resource-collection>
      <web-resource-name>SCWCD Resource</web-resource-name>
      <description>All</description>
      <url-pattern>/*</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
      <http-method>PUT</http-method>
      <http-method>DELETE</http-method>
      <http-method>HEAD</http-method>
      <http-method>OPTIONS</http-method>
      <http-method>TRACE</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>manager</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>INTEGRAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>SCWCD</realm-name>
  </login-config>
  <security-role>
    <description>some manager</description>
    <role-name>manager</role-name>
  </security-role>
 

With this the application sends always a HTTP404 . If I delete it the app works ok but of course there is no authentication.
In fact I would like to know how to make working all types of authentication.
If you know how to do it or a good tutorial with working examples please help.
I intend to take my exam in about 2 weeks so I am a little bit pressed

[Tieyi Guo]

<user-data-constraint> <transport-guarantee>INTEGRAL</transport-guarantee> </user-data-constraint>

You may try to use "None" in your "transport-guarantee" segment. I believe "Integral" or "Confidential" means using SSL and you may not having SSL configured when you run this example. If that is the case, then changing to "None" should help you solve the problem.
Hope this will be of some help to you.
Tieyi

[Dumitru Husleag]

Tieyi , I tried also with NONE for transport-guarantee and it doesnt solve the problem.

[Tieyi Guo]

Two things I can think of at this moment:
1) If you are using the "tomcat-users.xml" file to store the user security role, then you need to make sure you have a role "manager" defined there before you access the page;
2) If you are using some other kind of security backstore like LDAP etc, then you probabaly need to define a "Relm" in your sever.xml file to make that work.

Tieyi

[Tieyi Guo]

Pardon me for my typo: I mean "Realm", not "Relm".