Authorization: how to denying access

Question

In web.xml it's possible to define which url's are passwordprotected. Like:
<security-constraint>
<web-resource-collection>
<url-pattern>Default/*</url-pattern>
<url-pattern>Portaal/*</url-pattern>
<url-pattern>Informeren/*</url-pattern>
<url-pattern>Behandelen/*</url-pattern>
</web-resource-collection>
<!-- authorization -->
<auth-constraint>
<role-name>sr_developer</role-name>
</auth-constraint>
</security-constraint>
My problem with this is that when I forget a url, the user can get there without password. That's not what I want. I want him only to be able to access the url's I mentioned, not more. Is that possible?
Regards,
Eelco

Answer 1

Schöne guete Morge Julius
Kei angscht, ich han kei Ziit verschwendet und bi au scho uf RSUSR008_009_NEW und S_BCE_68002111 choo, aber jetzt wiiter in englisch für üsi Kollege.
Dear Julius,
Many thanks for your hint. But I found already report RSUSR008_009_NEW and transaction S_BCE_68002111.
But unfortunately there are 2 hindering factors:
a) To set up a clean base for this analyizing tool set we need some more time and knowledge.
b) SAP itself says there are some incorrect results for roles. See http://search.sap.com/ui/notes?id=0001888266
(The problem is, at the moment we cannot /do not want to install those corrections, according to my Basis collegue.)
As fas as I know about TCD S_BCE_68002111, this could/would be of great help.
Do you have or do you know some more tutorials or tranining material about transaction S_BCE_68002111? Any help will be appreciated.
Regards,
Markus