Acl on web app

Question

I am having trouble setting up ACL on my Web Application.
Basically, I have two subdirectory under my Web App root directory
called
'myapp', one is named 'pub' and one is named 'sec'. I want to put acl on
the jsp pages in /sec. Can somebody show me the web.xml for doing this.
I have created a group 'admin' that consists of members that have access
to the 'sec' piece of the web app.
The following is what I have, and it is kind of semi-working
<security-constraint>
<web-resource-collection>
<web-resource-name> Admin System </web-resource-name>
<description> access control on admin subsystem </description>
<url-pattern> /sec/* </url-pattern>
<http-method> GET </http-method>
<http-method> POST </http-method>
</web-resource-collection>
<auth-constraint>
<description> only certain set of user can have access </description>
<role-name> admin </role-name>
</auth-constraint>
</security-constraint>
<!--
<login-config>
<auth-method> BASIC </auth-method>
</login-config>
-->
If I did not comment out the <login-config> section, it will always ask
me to authenticate for both 'put' and 'sec'
With above, it does NOT ask me to authenticate for those pages in 'pub',
but still ask me login not only for pages in 'sec' which is good, but
also for
pages in the roor directory 'myapp', which is odd.
thanks
Xiaodong

Answer 1

Hie,
          We are facing the same problem; i.e. we are getting the same error message when we are trying to run our struts application on Weblogic 7.0.5 using JDK 1.3.1. This problem occured particularly when we tried to do a load testing using approx 20 concurrent users (a lesser load was supported though). Can you please let us know how this problem was sorted out on your end?
          thanks,
          Debanjan