[jboss-user] [JBoss Seam] - Unauthenticated Principal
toni
do-not-reply at jboss.com
Sun Sep 23 12:02:46 EDT 2007
Hi,
how can I grant unauthenticated users access to parts of my webapplication? I have read that we have to use the tag <unauthenticated-principal> in order to do this. Here is my configuration, maybe somebody can help me out?
|
| ----------- important part of web.cml -------------------------
|
| <security-constraint>
| <web-resource-collection>
| <web-resource-name>Unsecure area</web-resource-name>
| <description>Unprotected Pages</description>
|
| <url-pattern>/homepage.seam</url-pattern>
| <url-pattern>/about.seam</url-pattern>
|
| <http-method>POST</http-method>
| <http-method>GET</http-method>
| </web-resource-collection>
| <auth-constraint>
| <description>All people</description>
| <role-name>guest</role-name>
| </auth-constraint>
| </security-constraint>
|
| <security-constraint>
| <web-resource-collection>
| <web-resource-name>Secure area</web-resource-name>
| <description>Security for Protected Pages</description>
|
| <url-pattern>*.seam</url-pattern>
| <url-pattern>*.jsp</url-pattern>
|
| <http-method>POST</http-method>
| <http-method>GET</http-method>
| </web-resource-collection>
| <auth-constraint>
| <description>All areas are restived</description>
| <role-name>Admin</role-name>
| </auth-constraint>
| </security-constraint>
|
| <login-config>
| <auth-method>FORM</auth-method>
| <realm-name>userDatabase</realm-name>
| <form-login-config>
| <form-login-page>/login.seam</form-login-page>
| <form-error-page>/loginError.seam</form-error-page>
| </form-login-config>
| </login-config>
|
| <security-role>
| <description>The role of an adminr</description>
| <role-name>Admin</role-name>
| </security-role>
|
| <security-role>
| <description>Any body</description>
| <role-name>guest</role-name>
| </security-role>
| </web-app>
|
| ---------------------- userDatabase login config ------------------------
|
| <application-policy name="userDatabase">
| <authentication>
| <login-module
| code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
| flag="required">
| <module-option name="unauthenticatedIdentity">guest</module-option>
| <module-option name="dsJndiName">
| java:/PostgresqlDS
| </module-option>
| <module-option name="principalsQuery">
| SELECT password FROM systemuser WHERE login=?
| </module-option>
| <module-option name="rolesQuery">
| SELECT r.rolename, r.p_group FROM systemuser as o, role as r, systemuser_role as pr WHERE o.login=pr.systemuser_login AND r.roleName = pr.roles_roleName AND o.login=?
| </module-option>
| </login-module>
|
| </authentication>
| </application-policy>
|
| -------------------------------- i also added jboss.xml to my ear archive ---
|
|
| <!DOCTYPE jboss PUBLIC
| "-//JBoss//DTD JBOSS 4.0//EN"
| "http://www.jboss.org/j2ee/dtd/jboss_4_0.dtd">
|
| <jboss>
|
| <security-domain>java:/jaas/userDatabase</security-domain>
| <unauthenticated-principal>guest</unauthenticated-principal>
|
| </jboss>
|
|
| -----------------------------------------------
|
| Unfortuantely unauthenticated people can't access "/homepage.seam" before loggin in.
|
|
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4087644#4087644
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4087644
More information about the jboss-user
mailing list