Authorization in DBTableOraDataSourceLoginModule ??

Question

Dear all,
first of all, I want to say sorry if my English is not too good.
I'm a newbie who trying to developed a database oriented authentication using Jdeveloper 10.1.3.3.0 . I use DBTableOraDataSourceLoginModule and exactly follow the instruction in www.oracle.com/technology/products/jdev/howtos/10g/jaassec/index.htm successfully.
But still there's something that I don't understand, for example :
A is a USER
B is a MANAGER
PageA can be accessed by USER or MANAGER
PageB can be accessed only by MANAGER
In PageA there is a button that connect into PageB
And then, A login successfully into PageA and then click the button into PageB
Theorically, A cannot acces PageB and get "permission denied" error
But, in my code, A still can access PageB.
According to the tutorial, I've only add
<security-constraint>
<web-resource-collection>
<web-resource-name>manager_only</web-resource-name>
<url-pattern>/faces/manager/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>MANAGER</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<role-name>MANAGER</role-name>
</security-role>
in web.xml
Is there any documentation that can help me more understand about this and can make me know what to do? Thanx.
P.S in my country there's not much people who developed Jdev so I encourage myself to ask into this forum.

Answer 1

Wow...
It works..
Thanx Mr. Frank..
May I ask another question?
I declare security roles and security constraints in web.xml file. Can I make my application create new security roles with it's security constraints at runtime condition? I mean, I try to make a form to generate addition into web.xml file. Is it possible? Is there any documentation I can take?
Thanx before.