Authorisation of the static resources OAS10g R2

Question

Hi,
I have some static resources (folders with html and image files) referenced in the web server of my OAS 10g release 2.
The alias ‘myalias’ is defined in the oas10gr2/Apache/Apache/conf/httpd.conf
<IfModule mod_alias.c>
/myAlias/ “/folder_root/folder_web_ressources/”
And this alias is secured (SSO – OID – LDAP) in oas10gr2/Apache/Apache/conf/mod_osso.conf
<IfModule mod_osso.c>
<Location /myAlias >
require valid-user
AuthType Basic
</Location>
When I access a file by his URL, the authentification page is display and having a user and a password I can display my page, which is ok.
Now I need to restrict the access of certain folders to a given role.
For eg the user accessing www.domain.com/myAlias/customer/c.html must have the CUSTOMER_ROLE and the user accessing www.domain.com/myAlias/owner/c.html must have the OWNER_ROLE.
All my roles are defined in LDAP, but I don’t know how I can modify my configuration files to make this role verification.
It is possible to have something like that ?
<Location /myAlias/customer >
require valid-user
AuthType Basic
PRIVILEGE CUSTOMER_ROLE
</Location>
<Location /myAlias/owner >
require valid-user
AuthType Basic
PRIVILEGE OWNER_ROLE
</Location>
Thanks for any suggestion,
Ivat

Answer 1

Hi again,
I do it differently:
In my web application I have created a virtual directory to my static content (which is dynamically updated by another application).
1. In WEB-INF\orion-web.xml
<?xml version = '1.0' encoding = 'windows-1252'?>
<!DOCTYPE orion-web-app PUBLIC "-//Evermind//DTD Orion Web Application 2.3//EN" "http://xmlns.oracle.com/ias/dtds/orion-web.dtd">
<orion-web-app servlet-webdir="/servlet/" directory-browsing="deny" autoreload-jsp-beans="true" autoreload-jsp-pages="true" persistence-path="./persistence">
<web-app-class-loader search-local-classes-first="true"/>
<virtual-directory real-path="/server/folder_root/folder_web_ressources" virtual-path="/resources" />
</orion-web-app>
2. This alias is secured (SSO – OID – LDAP) in oas10gr2/Apache/Apache/conf/mod_osso.conf
<IfModule mod_osso.c>
<Location MyAppRoot/resources >
require valid-user
AuthType Basic
</Location>
3. I use a servlet filter where, after the authorisation, I do my ROLE check.
Web.xml
<filter>
<filter-name>Filter_VIRTUAL_DIR</filter-name>
<filter-class>mydomain.servlet.RoleCheckFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>Filter_VIRTUAL_DIR</filter-name>
<url-pattern>/ resources/*</url-pattern>
</filter-mapping>
This “workaround” do my job. I hope that this can help someone.
Thanks,
Ivat