This week's book giveaway is in the Testing forum.
We're giving away four copies of Data Structures the Fun Way: An Amusing Adventure with Coffee-Filled Examples and have Jeremy Kubica on-line!
See this thread for details.
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Tim Cooke
  • Devaka Cooray
  • Ron McLeod
  • Jeanne Boyarsky
Sheriffs:
  • Liutauras Vilda
  • paul wheaton
  • Junilu Lacar
Saloon Keepers:
  • Tim Moores
  • Stephan van Hulst
  • Piet Souris
  • Carey Brown
  • Tim Holloway
Bartenders:
  • Martijn Verburg
  • Frits Walraven
  • Himai Minh

Who is Right? Tomcat or iPlanet (j2ee declarative security)

 
Greenhorn
Posts: 8
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I am reworking the authentication infrastructure for medium sized J2EE application. And I have been writing a simple war to test some strategies.
My test war uses a simplified servlet controller ala Pet Store. In effort to protect some 'stuff' from being 'called' directily w/o going thru a controller, I installed a security contraint on a URL pattern and its role is set to 'nobody' - which is not a role in our security realm (LDAP).
Now the proteced URL contains JSPs that are forwared to by the controller, (which is protected but by a different constraint - that does have defined roles in our realm).
Tomcat (4.0.2) has no problem allowing the controller to do a RequestDispatcher.forward() to a JSP in the protected URL pattern. iAS 6sp3 (Solaris) generates a 'not authorized' error when attempting to forward to a protected URL.
I guess I am thinking maybe iAS has it right: wether I went to the URL directly or thru a forward - the current login doesn't have privs to access the URL.
Who is correct? Also, a co-worker has run a similar test on Weblogic 6 and it appears to behave like Tomcat.
The ultimate objective is to protect the JSPs from direct calls. What might be another strategy? Put them under WEB-INF? Where would one forward to in this setup? Oh, we are likely to bail on iAS soon, and go to Weblogic, so a XAppServer solution is highly desireable.
 
Ranch Hand
Posts: 247
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
My initial guess is that iPlanet is going to be 'correct', but my experience with Tomcat and Resin shows that iPlanet is much more strict about some things that Tomcat and Resin consider convenience 'features'. Based on your description I think iPlanet is doing it right and the other two are doing it wrong. Now if you were doing an include instead of a forward, then the situation is much more fuzzy.
I haven't had any experience protecting specific URLs as our server admin uses an NSAPI plugin to do Kerberos authentication on directories and our servlets/JSPs don't know or need to know any different.
 
He got surgery to replace his foot with a pig. He said it was because of this tiny ad:
the value of filler advertising in 2021
https://coderanch.com/t/730886/filler-advertising
reply
    Bookmark Topic Watch Topic
  • New Topic