How to configure jazn-data.xml for two realms?

Question

Hi,
in my test application a JSP page is secured with <auth-method>BASIC</auth-method>.
I use the jazn-data.xml configurtion in the Embedded OC4J in JDeveloper 10.1.2.
With the standard configuration of jazn-data.xml I can sign in with user admin/welcome without any problems.
In this case only the jazn.com realm exists.
If I configure a second realm over the JDeveloper menu "Tools -> Embedded OC4J Server Preferences ..." then I can´t sign in any more.
The new realm domain.com have some users in the group myusers. In the orion-web.xml I add the new group in the role-mapping.
What is the problem? I can´t find informations in the documentation.
Oracle® Application Server Containers for J2EE
Security Guide
10g Release 2 (10.1.2)
B14013-02
Thanks and best regards,
Tobias
orion-web.xml
<orion-web-app servlet-webdir="/servlets/">
<security-role-mapping impliesAll="false" name="user">
<group name="jazn.com/users"/>
<group name="domain.com/myusers"/>
</security-role-mapping>
</orion-web-app>
web.xml
<web-app>
<description>Empty web.xml file for Web Application</description>
<session-config>
<session-timeout>35</session-timeout>
</session-config>
<mime-mapping>
<extension>html</extension>
<mime-type>text/html</mime-type>
</mime-mapping>
<mime-mapping>
<extension>txt</extension>
<mime-type>text/plain</mime-type>
</mime-mapping>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>TestApp</web-resource-name>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<role-name>user</role-name>
</security-role>
</web-app>

Answer 1

Hi,
I switched my above example from jazn-data.xml to LDAP and deployed this in iAS.
In the OID are two realms configured, realm_1 and realm_2 and some users for each.
But I can only access my JSP with users of realm_1 or realm_2 and not
simultaneous users of both realms. That´s dependents on the configured "Default
realm" of the JAZN LDAP User Manager in the EAR.
If I set "Default realm" = realm_1 in the enterprise manager of the iAS then
only members of realm_1 can access the JSP and vice versa for realm_2.
I packaged my above example as EAR and configured the default generated
orion-application.xml in the enterpise manager of the iAS.
orion-application.xml
<?xml version = '1.0'?>
<!DOCTYPE orion-application PUBLIC "-//ORACLE//DTD OC4J Application runtime
9.04//EN" "http://xmlns.oracle.com/ias/dtds/orion-application-9_04.dtd">
<orion-application deployment-version="10.1.2.0.2"
default-data-source="jdbc/OracleDS" treat-zero-as-null="true">
<web-module id="webapp" path="webapp.war"/>
<persistence path="persistence"/>
<principals path="principals.xml"/>
<jazn provider="LDAP">
<property name="ldap.user" value="cn=orcladmin"/>
<property name="ldap.password" value="!ias_admin10g"/>
</jazn>
<log>
<file path="application.log"/>
</log>
<namespace-access>
<read-access>
<namespace-resource root="">
<security-role-mapping>
<group name="jazn.com/administrators"/>
</security-role-mapping>
</namespace-resource>
</read-access>
<write-access>
<namespace-resource root="">
<security-role-mapping>
<group name="jazn.com/administrators"/>
</security-role-mapping>
</namespace-resource>
</write-access>
</namespace-access>
</orion-application>
orion-web.xml
<orion-web-app servlet-webdir="/servlets/">
<security-role-mapping impliesAll="false" name="user">
<group name="realm_1/users"/>
<group name="realm_2/myusers"/>
</security-role-mapping>
</orion-web-app>
What do I have to configure to get access to the JSP with both realms?
Best regards,
Tobias