[ https://jira.jboss.org/jira/browse/JBWEB-134?page=com.atlassian.jira.plug... ] Jean-Frederic Clere reassigned JBWEB-134: ----------------------------------------- Assignee: Remy Maucherat (was: Jean-Frederic Clere) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBWEB-134?page=com.atlassian.jira.plug... ] Remy Maucherat resolved JBWEB-134. ---------------------------------- Resolution: Rejected This is wrong. If a constraint does not need auth to be resolved, this does not mean access will be granted (for starters, it could be a constraint to deny all). Of course, it is not so useful at first glance that this is passed to the realm for resolution (done in RealmBase.hasResourcePermission), but that's how it works (which could be because it would be legal to base an access decision on other parameters that the principal, dependeing on the realm, maybe a cookie submitted or something) and your realm should handle that. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira