This week's book giveaway is in the Testing forum. We're giving away four copies of Data Structures the Fun Way: An Amusing Adventure with Coffee-Filled Examples and have Jeremy Kubica on-line! See this thread for details.
I am reworking the authentication infrastructure for medium sized J2EE application. And I have been writing a simple war to test some strategies. My test war uses a simplified servlet controller ala Pet Store. In effort to protect some 'stuff' from being 'called' directily w/o going thru a controller, I installed a security contraint on a URL pattern and its role is set to 'nobody' - which is not a role in our security realm (LDAP). Now the proteced URL contains JSPs that are forwared to by the controller, (which is protected but by a different constraint - that does have defined roles in our realm). Tomcat (4.0.2) has no problem allowing the controller to do a RequestDispatcher.forward() to a JSP in the protected URL pattern. iAS 6sp3 (Solaris) generates a 'not authorized' error when attempting to forward to a protected URL. I guess I am thinking maybe iAS has it right: wether I went to the URL directly or thru a forward - the current login doesn't have privs to access the URL. Who is correct? Also, a co-worker has run a similar test on Weblogic 6 and it appears to behave like Tomcat. The ultimate objective is to protect the JSPs from direct calls. What might be another strategy? Put them under WEB-INF? Where would one forward to in this setup? Oh, we are likely to bail on iAS soon, and go to Weblogic, so a XAppServer solution is highly desireable.
My initial guess is that iPlanet is going to be 'correct', but my experience with Tomcat and Resin shows that iPlanet is much more strict about some things that Tomcat and Resin consider convenience 'features'. Based on your description I think iPlanet is doing it right and the other two are doing it wrong. Now if you were doing an include instead of a forward, then the situation is much more fuzzy. I haven't had any experience protecting specific URLs as our server admin uses an NSAPI plugin to do Kerberos authentication on directories and our servlets/JSPs don't know or need to know any different.
CJP (Certifiable Java Programmer), AMSE (Anti-Microsoft Software Engineer)
Author of Posts in the Saloon
He got surgery to replace his foot with a pig. He said it was because of this tiny ad: