Access JSP pages under WEB-INF

Question

Hello, I have a web application and i use Java,JSP, servlets etc.
In my webpage i have three different categories of users
*1)* Registered users
*2)* Not Registered users
*3)* Administrator
I would like the welcome page index.jsp and register page be accessed by everyone.
But as far as the other pages are concerned , i would like to be accessed only by the registered users.
What shall i do??
I placed the index.jsp and register.jsp under the public folder and the other pages under WEB-INF folder in order to be accesses only from the registered users.
But it's not working!
What exactly shall i do in order to make that work??
Thanks, in advance!

Answer 1

g_p_java wrote:
Thanks for the link! As i understood i don't have to place my web pages under WEB-INF (only the web.xml which is already there).
*1)* So i have to follow the steps that are being mentioned there for all the users right??
Registered , Not Registered and admin.
Yes, security constraining through web.xml is a url pattern based protection for your resources. You could create multiple urls - /secured/* and map them to your resources accessible to registered users only or you may have /admin/* and define that only 'admin' roles have access to these resources. Some portions of such setup would be server specific (eg: how you create users and map them to roles)
*2)* I would like to make a question: Who is the "FrontController" in the link you posted me? [http://onjava.com/onjava/2001/08/06/webform.html]
It's the Container. Because such features are mandated by the spec, the container provides an implementation and options to customize the implementation (for example in weblogic, you can specify that your users are bound to an LDAP or configured in a Users table in the db)
Nevertheless, you would have your own Controllers for your application management (Struts or Spring or whatever suits your need). On the same note, you should have your own Filters to implement whatever common logic you have across your application.
Madathil_Prasad wrote:
2. Write a filter that checks for the presence of a session (and entitlements possibly) before allowing access to a resource.
*3)* when you write "_entitlements_" what exactly do you mean??
Thanks!
This is the other road I was talking about. You could throw all configuration and j2ee based security configuration out of the window (they do have their limitations) and implement custom security logic in a Filter. For example,
String urlPattern = request.getRequestURI();
if(urlPattern.indexOf("/secured") != null{
         if(request.getSession(false) == null){
               //redirect to login page.
         }else{
              //valid session
              //now check specific entitlement to see whether user has access
}Here entitlement refers to permissions at a granular level (authorization if you wish to call it). For example, you have 2 kinds of admin users - some who can generate reports of web activity and another who can change application settings.
ram.