Enforcing security constraints when forward is used

Hi,
I am using Tomcat 4.0.1, and I have specified security constraints in my web.xml. I find that when I try to forward to secure resource, I am able to do so without having to evaluate security constraints. If I request the secure resource directly, I do have to evaluate the security constraints.
Is this normal? I would expect that the security constraints should always be evaluated by the web container.
Thanks in advance,
Steve

Yes, its normal.
In fact, its an important capability to force people thru a "front door" and prevent direct access to protected resources (Model 2?).

Similar Messages

How do you reset the security questions when you havent used a credit card to make any purchases, only the gift cards. Apple support will not help me even though i know my account and apple id and password?

Have a new computer and now cannot access itunes without knowing the answers to the security questions. Apple support cannot reset as we have never used a credit card when purchasing prior, have only used gift cards. Can provide apple id and password and all other account details but still no help. Have we to open a new3 account and start again, this means losing a lot of credit on the existing account?!

I have the same problem. I didn't set a rescue email for some reason. To find out weather you hav a rescue password: Go to appleid.apple.com, sign in, go to manage account and then password and security if you do there will be a link below telling you that you can send an email to it. If not the link won't be there. Hope this helps.

What is the security context when deploying application using SCCM 2012?

As far as i know when using Group Policy the software is always installed under SYSTEM security context. However i cannot find any information related to SCCM 2012 (and deploying applications) security context.
Also is there a difference in doing "Install for User" or "Install for Device/System"?
Thanks

Thanks. Just to confirm that if you use Group Policy and you Publish the msi for user when the user install it from Add/Remove Programs it is still going to be executed in SYSTEM security context?
And while we are on this topic - is the above (about the security context in SCCM 2012) written anywhere in some official MS web page?
Not sure about the context for Intellimirror, but for ConfigMgr it's as Ronnie and Torsten stated. This may be documented somewhere, not sure. Not everything is documented though -- in fact, I'd say less than 25% (probably less than 10%) of everything
to be known about ConfigMgr is officially documented. Note that this is the same for any product -- there simply are far too many permutations and possibilities to document them all.
Jason | http://blog.configmgrftw.com

R/3 Secure Store and Forward, while using SAP portal for SSO

Hello,
We are using SAP Portal UME for authentication, then SAP SSO tickets to log into the SAP R/3 system. Initially we decided that the end users would have a "disabled password" so that they must use the portal authentication mechanism to get into R/3 and therefore could not log in straight to R/3 system via SAP GUI.
All was working fine until during integration testing when someone tried to use the electronic signature function on a QM t-code (QA11) that prompted for an e-sig. Since local passwords have been disabled, the user could not execute the e-sig.
We do not want to activate local R/3 passwords for the users. Can anyone give some advice or a best practice regarding how to set up electronic sigs in R/3 while using an external authentication source? FYI, we are also trying to avoid using the LDAP connector from R/3 to our LDAP.
Please comment for any clarity needed or comments,
Thanks in advance,
Ryan

Good point - but I'm afraid of not knowning an instant answer.
Well, theoretically one could make use of the fact that an NWAS ABAP can act as http client (submitting http requests to the NWAS Java to validate logon data); but that's just a rough idea.
Regards, Wolfgang

Getting Security Error when trying to use bitmapdata.draw method on youtube videos

Hi All ,
I am playing youtube videos in UIComponet of flex, but when I trying to capture the image using bitmapdata.draw() method it gives me an secutity error on server , It works well locally in flex editor.
Is any one knows how to resolve this bug??
Thanks in advance
sujit Rai

Try nesting the clips and then adding the warp stabiliser to the nest.

RBAC check fails Security Constraint Not Enforced

I configured a simple WAR to ony allow a specific role to be able to execute my Helloworld url. Now it appears that any valid user defined on the appserver can access the url. Shouldn't it be limited to the specific role i defined using the deploytool? It almost appears as if the security constraint is not being enforced. All of the users in the file realm are allowed to access it, instead of the role that's specified in the security constraints.
I'm using Sun Java System Application Server Enterprise Edition 8.2 (build b25-fcs)
web.xml
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>Helloworld</display-name>
<servlet>
<display-name>HelloworldImpl</display-name>
<servlet-name>HelloworldImpl</servlet-name>
<servlet-class>com.boeing.mcc.trade.HelloworldImpl</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>HelloworldImpl</servlet-name>
<url-pattern>/Helloworld</url-pattern>
</servlet-mapping>
<jsp-config/>
<security-constraint>
<display-name>SecurityConstraint</display-name>
<web-resource-collection>
<web-resource-name>WRCollection</web-resource-name>
<url-pattern>/Helloworld/*</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>OPERATOR</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>file</realm-name>
</login-config>
<security-role>
<role-name>ADMIN</role-name>
</security-role>
<security-role>
<role-name>ANALYST</role-name>
</security-role>
<security-role>
<role-name>OPERATOR</role-name>
</security-role>
</web-app>
Message was edited by:
weinhard
Message was edited by:
weinhard
Message was edited by:
weinhard

Note: I used the deploytool to create/package the WAR.
sun-web.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 8.1 Servlet 2.4//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_4-1.dtd">
<sun-web-app>
<context-root>/hello</context-root>
<security-role-mapping>
<role-name>OPERATOR</role-name>
<principal-name>user1</principal-name>
<principal-name>user2</principal-name>
<principal-name>user3</principal-name>
</security-role-mapping>
<security-role-mapping>
<role-name>ANALYST</role-name>
<principal-name>user4</principal-name>
<principal-name>user2</principal-name>
<principal-name>user3</principal-name>
<principal-name>user5</principal-name>
</security-role-mapping>
<security-role-mapping>
<role-name>ADMIN</role-name>
<principal-name>user6</principal-name>
</security-role-mapping>
<servlet>
<servlet-name>HelloworldImpl</servlet-name>
<webservice-endpoint>
<port-component-name>HelloworldIF</port-component-name>
<endpoint-address-uri>Helloworld</endpoint-address-uri>
</webservice-endpoint>
</servlet>
<session-config>
<session-manager persistence-type="memory">
<manager-properties/>
<store-properties/>
</session-manager>
<session-properties/>
<cookie-properties/>
</session-config>
<cache enabled="true" max-entries="4096" timeout-in-seconds="30">
<default-helper/>
</cache>
<class-loader delegate="true"/>
<jsp-config/>
<parameter-encoding default-charset="UTF8"/>
</sun-web-app>

Web.xml security-constraint

Hi,
Anybody has any idea about this one:
In web.xml I have:
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>members</web-resource-name>
               <url-pattern>/members/*</url-pattern>
          </web-resource-collection>
          <auth-constraint>
               <role-name>REGISTERED_USERS</role-name>
          </auth-constraint>
          <user-data-constraint>
               <description>SSL is required</description>
               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
     <security-constraint>
when using the above one, every time when i click any link in /members, the weblogic
first treat the user as guest at the beginning, then change to the real logined
user.
After I changed it to :
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>members</web-resource-name>
               <url-pattern>/members/</url-pattern>
          </web-resource-collection>
          <auth-constraint>
               <role-name>REGISTERED_USERS</role-name>
          </auth-constraint>
          <user-data-constraint>
               <description>SSL is required</description>
               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
     <security-constraint>
i click the links in /members, the weblogic treat the user as the real logined
user.
Any idea what is the * 's meaning or any clue where this difference is mentioned
in weblogic or SUN's documentation?
BTW: I am using weblogic 5.1 with sp11.
Thx,
dliu

Hi,
Please provide a "WEB-INF/weblogic.xml" file as well like following:
*"weblogic.xml"*
<?xml version='1.0' encoding='UTF-8'?>
<weblogic-web-app xmlns="http://www.bea.com/ns/weblogic/90" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<security-role-assignment>
<role-name>BMOUser</role-name>
<principal-name>BMOUser</principal-name>
</security-role-assignment>
</weblogic-web-app>
Thanks
Jay SenSharma
http://weblogic-wonders.com (WebLogic Wonders Are here)

[svn] 1720: Bugs: LCDS-304 - Authentication not working in all cases when using security constraint with NIO endpoints .

Revision: 1720
Author: [email protected]
Date: 2008-05-14 14:50:06 -0700 (Wed, 14 May 2008)
Log Message:
Bugs: LCDS-304 - Authentication not working in all cases when using security constraint with NIO endpoints.
QA: Yes
Doc: No
Details:
Update to the TomcatLoginCommand to work correctly with NIO endpoints.
Ticket Links:
http://bugs.adobe.com/jira/browse/LCDS-304
Modified Paths:
blazeds/branches/3.0.x/modules/opt/src/tomcat/flex/messaging/security/TomcatLoginCommand. java

Revision: 1720
Author: [email protected]
Date: 2008-05-14 14:50:06 -0700 (Wed, 14 May 2008)
Log Message:
Bugs: LCDS-304 - Authentication not working in all cases when using security constraint with NIO endpoints.
QA: Yes
Doc: No
Details:
Update to the TomcatLoginCommand to work correctly with NIO endpoints.
Ticket Links:
http://bugs.adobe.com/jira/browse/LCDS-304
Modified Paths:
blazeds/branches/3.0.x/modules/opt/src/tomcat/flex/messaging/security/TomcatLoginCommand. java

[svn] 1433: adding 'console' security constraint to MBeanServerGateway remote object for MBean tests and ds-console , used when running on Websphere with administrative security enabled.

Revision: 1433
Author: [email protected]
Date: 2008-04-28 13:13:12 -0700 (Mon, 28 Apr 2008)
Log Message:
adding 'console' security constraint to MBeanServerGateway remote object for MBean tests and ds-console, used when running on Websphere with administrative security enabled. Should call setCredentials("bob","bob1") to use this RO.
Modified Paths:
blazeds/branches/3.0.x/qa/apps/qa-regress/WEB-INF/flex/remoting-config.mods.xml
blazeds/branches/3.0.x/qa/apps/qa-regress/WEB-INF/flex/services-config.mods.xml

Hi,
It seems that you were using Hyper-V Remote Management Configuration Utility from the link
http://code.msdn.microsoft.com/HVRemote, if so, you can refer to the following link.
Configure Hyper-V Remote Management in seconds
http://blogs.technet.com/jhoward/archive/2008/11/14/configure-hyper-v-remote-management-in-seconds.aspx
By the way, if you want to perform the further research about Hyper-V Remote Management Configuration Utility, it is recommend that you to get further
support in the corresponding community so that you can get the most qualified pool of respondents. Thanks for your understanding.
For your convenience, I have list the related link as followed.
Discussions for Hyper-V Remote Management Configuration Utility
http://code.msdn.microsoft.com/HVRemote/Thread/List.aspx
Best Regards,
Vincent Hu

Using security-constraint in web.xml; not recognizing url-pattern tag

I am creating a very simple jsp application within JDeveloper 10.1.3.1. I have 2 jsp files...a readData.jsp and a maintainData.jsp. I would like to deploy this application to Oracle Application Server 10.1.2.2. I would like to use Oracle Internet Directory with Single Sign on enabled. The deployment to OAS works fine. For the security, I would like an administrator user to get to both pages...and a user to only be able to see the readData.jsp. I used the security constraints on the properties of the web.xml file within JDeveloper. Here is my web.xml file:
<?xml version = '1.0' encoding = 'windows-1252'?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<description>Empty web.xml file for Web Application</description>
<session-config>
<session-timeout>35</session-timeout>
</session-config>
<mime-mapping>
<extension>html</extension>
<mime-type>text/html</mime-type>
</mime-mapping>
<mime-mapping>
<extension>txt</extension>
<mime-type>text/plain</mime-type>
</mime-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>adm_full_access</web-resource-name>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>adm_all</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>usr_access</web-resource-name>
<url-pattern>readData.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>usr_all</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<security-role>
<role-name>usr_all</role-name>
</security-role>
<security-role>
<role-name>adm_all</role-name>
</security-role>
</web-app>
When I deploy to OAS I added an OID account to the adm_all role...this works fine I can log on as that user and get to both jsps. But, when I add my user to the usr_all role within OAS I try to log on to the app...I then enter my SSO username and password and I get Access Denied errors from my browser when trying to access either page. I am confused about the <url-pattern> tag...is that relative to a directory within my deployment? Most of the examples I have seen use servlets...so I was wondering if I can even use the <url-pattern> tag to restrict/allow access to individual jsps? If someone could point me to some documentation on this set-up I would appreciate it!
Thank you.

I was able to get this to work. By doing the following:
<security-constraint>
<web-resource-collection>
<web-resource-name>adm_full_access</web-resource-name>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>adm_all</role-name>
</auth-constraint>
</security-constraint>
I was restricting access to all other groups by uisng <url-pattern>*</url-pattern>. Any other security-constraints set-up after that will not work. So saying * requires usr_all will restrict ALL webpages to ONLY adm_all, regardless of what future constraints say. So, my first security-constraints lists all directories or pages that every user can access. My next security-constraint then list resources that only my admins (adm_all) can acess. Any other security constraints then are set-up for each user role that I have...if adm_all should have access to these then the <role-name>adm_all</role-name> is added to each security constraint.

Using a custom Custom AuthorizatioProvider with security-constraints on webApp?

Hi,
we have adapted the security from the medrec-example to build our own
authorization-provider to fetch our users from an RDBMS. Mainly we want
to secure a web-application using <security-constraint>'s:
The MBean for the AUthorizationProvider gets properly deployed into
<wl-home>/server/lib/mbeantypes
and the log-messages show, that the user gets logged in and the groups
for the user are properly resolved. However, when we access a ressource
in a web-app that is secured using:
<security-constraint>
          <web-resource-collection>
               <web-resource-name>SecureCollection</web-resource-name>
               <description>
These pages are only accessible by members of the dvr.
</description>
               <url-pattern>/htdocs/secure/*</url-pattern>
               <http-method>DELETE</http-method>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
               <http-method>PUT</http-method>
          </web-resource-collection>
          <auth-constraint>
               <description>These are the roles who have access</description>
               <role-name>securegroup</role-name>
          </auth-constraint>
          <user-data-constraint>
               <description>
This is how the user data must be transmitted
</description>
               <transport-guarantee>NONE</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
access to the ressource is denied, although the user is in securegroup.
Is there something else we need?! From the docs I understood, that in
absence of a security-role-assignment in weblogic.xml, the server takes
the rolename as principal, so our weblogic.xml is empty right now....
Any ideas anybody?!
Cheers
stf

As there is obviously noone else to answer this, I had to figure this
out myself: The reason for this is the "REQUIRED"-Controlflag on the
Default-AuthorizationProvider. The docs for the medrec-example forgot to
say, that unless you have your users in both the Database and the
internal LDAP-Server the Default-AuthorizationProvider, you are not
granted access - changing the Flag to optional does the trick.
By the way: Same holds true for the Compatibility-Security you can use
to upgrade your old RDBMS-Realms from 6.1: Without the Control-Flag on
the Default-AuthorizationProvider you can search endlessly for the
reason you can't log in although your realm properly authenticates you....
Stefan Frank wrote:
Hi,
we have adapted the security from the medrec-example to build our own
authorization-provider to fetch our users from an RDBMS. Mainly we want
to secure a web-application using <security-constraint>'s:
The MBean for the AUthorizationProvider gets properly deployed into
<wl-home>/server/lib/mbeantypes
and the log-messages show, that the user gets logged in and the groups
for the user are properly resolved. However, when we access a ressource
in a web-app that is secured using:
<security-constraint>
<web-resource-collection>
<web-resource-name>SecureCollection</web-resource-name>
<description>
These pages are only accessible by members of the dvr.
</description>
<url-pattern>/htdocs/secure/*</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<description>These are the roles who have access</description>
<role-name>securegroup</role-name>
</auth-constraint>
<user-data-constraint>
<description>
This is how the user data must be transmitted
</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
access to the ressource is denied, although the user is in securegroup.
Is there something else we need?! From the docs I understood, that in
absence of a security-role-assignment in weblogic.xml, the server takes
the rolename as principal, so our weblogic.xml is empty right now....
Any ideas anybody?!
Cheers
stf

Problem with security-constraint use

Hola!
I need help for my j2ee 1.4 application, about using security-constraint in web.xml file.
This is my web.xml...at the bottom i'll expplain my problem:
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
     <display-name>
     Prova14Web</display-name>
     <servlet>
          <display-name>
          action</display-name>
          <servlet-name>action</servlet-name>
          <servlet-class>
          org.apache.struts.action.ActionServlet</servlet-class>
          <init-param>
               <param-name>config</param-name>
               <param-value>/WEB-INF/struts-config.xml</param-value>
          </init-param>
          <load-on-startup>1</load-on-startup>
     </servlet>
     <servlet-mapping>
          <servlet-name>action</servlet-name>
          <url-pattern>*.do</url-pattern>
     </servlet-mapping>
     <welcome-file-list>
          <welcome-file>jsp/index.jsp</welcome-file>
     </welcome-file-list>
     <jsp-config>
          <taglib>
               <taglib-uri>/WEB-INF/struts-bean.tld</taglib-uri>
               <taglib-location>/WEB-INF/struts-bean.tld</taglib-location>
          </taglib>
          <taglib>
               <taglib-uri>/WEB-INF/struts-html.tld</taglib-uri>
               <taglib-location>/WEB-INF/struts-html.tld</taglib-location>
          </taglib>
<taglib>
          <taglib-uri>/WEB-INF/struts-logic.tld</taglib-uri>
          <taglib-location>/WEB-INF/struts-logic.tld</taglib-location>
     </taglib>
     </jsp-config>
     <security-constraint>
          <display-name>
          vincolo1</display-name>
          <web-resource-collection>
               <web-resource-name>Restricted</web-resource-name>
               <url-pattern>/jsp/*</url-pattern>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
          </web-resource-collection>
          <auth-constraint>
               <role-name>operatore</role-name>
          </auth-constraint>
     </security-constraint>
     <login-config>
          <auth-method>FORM</auth-method>
<form-login-config>
               <form-login-page>/html/login.html</form-login-page>
               <form-error-page>/html/error.html</form-error-page>
          </form-login-config>
     </login-config>
     <security-role>
          <role-name>operatore</role-name>
     </security-role>
</web-app>
The problem is the that when i connect to my application at http://localhost:9081/Prova14Web, the first page that appears is the welcome.jsp, when it should be appear the login page! The application bypass the login page...but I don't know why it happens!
I'm using RAD6 and Websphere6 AS.
Could you help me please??

Hi ,
do u know which BADI tiggers first ?
first u need to export from the first BADI
like this
*Exporting Results to ABAP Memory for Future Calc.
IF GT_TQA[] IS NOT INITIAL.
EXPORT LT_TQA FROM GT_TQA TO MEMORY ID 'TQA'.
ENDIF.
and import in another BADI
IMPORT LT_TQA TO GT_TQA FROM MEMORY ID 'TQA'.
regards
Prabhu

What is the use of security-constraint tag in web.xml

what is the use of following tag , and how to use that, and where to use that tag.
<web-resource-collection>
<web-resource-name>SecureOrderJSP</web-resource-name>
<descrip<url-pattern>/order/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name></role-name>
</auth-constraint>
</security-constraint>tion>Protect the Order JSP Pages </description>

Hi,
You can refer this link
http://www.whizlabs.com/tutorial/scwcd/j-scwcd-7-5.html
give the complete description of your doubt
Thanks,
Snigdha Sivadas

Ques;How do you secure imail when used being used in iweb. People can mess

How do you secure imail when used being used in iweb? People can mess w/my settings in iweb imail window.

What is iMail?
And what is an iWeb iMail window?
iWeb is part of iLife 06 which is an application used to create websites hosted on .Mac.
Are you referring to Apple's Mail application and webmail access using a browser such as Safari to access your .Mac account?
Which people can mess with what settings? You shouldn't allow anyone else to access your Mac when logged in to your account and home folder/directory. OS X was designed for multiple users of the same Mac with each regular user having their own computer login account (with or without admin privileges) and associated home folder/directory to store and access their data and settings for their login account only.

When I forward mail (using iPhone) to other, the recipient replied the picture become a link.

When I forward mail (using iPhone) to other, the recipient replied the picture insides mail content become a link. Of course, they can click on the link and it goes to the picture. Please help.

From the menu bar select '''View-Headers-Normal'''

Enforcing security constraints when forward is used

Similar Messages

Maybe you are looking for