I need a simple ACL sample

Question

Hi:
I have a servlet named "joanservlet" and on the URI "http"//localhost:7001/joantest2/joanservlet".
I want to establish a ACL on this resource, could someone tell me how to configure?
only use administrator console, or need to write additional configure in web.xml??
thanks..

Answer 1

Hi Joan,
The easiest way to do this is with BASIC authentication in your web application.
Here's the simplest deployment descriptor possible to do basic security
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 1.2//EN"
"http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">
<web-app>
<security-constraint>
<web-resource-collection>
<web-resource-name>myName</web-resource-name>
<url-pattern>/myDirectory/myFile.html</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>
MyGroupName
</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<security-role>
<role-name>
MyGroupName
</role-name>
</security-role>
</web-app>
Change the following tags to reflect your own needs:
url-pattern (the actual directory or files that you need protected)
role-name (put the user or group that you are allowing access to -- make sure that the two role-name
tags both have the same entry, the same way it is outlined above)
Now throw in a weblogic.xml file in the same directory. Simplest example is:
<!DOCTYPE weblogic-web-app (View Source for full doctype...)>
- <weblogic-web-app>
<description>WebLogic Descriptor</description>
- <security-role-assignment>
<role-name>MyGroupName</role-name>
<principal-name>MyGroupName</principal-name>
</security-role-assignment>
</weblogic-web-app>
The part after "principal-name" has to be the name of a user or group that exists in the WebLogic
server.
Now you have security on the URL that you specified under "url-pattern" and the weblogic user or group
that you declared under "principal-name" can access it.
This is all in the servlet 2.2 specification which you can grab somewhere at www.javasoft.com if you
need more detailed information.
Hope this helps.
Joe Jerry
joan wang wrote:
Hi:
I have a servlet named "joanservlet" and on the URI "http"//localhost:7001/joantest2/joanservlet".
I want to establish a ACL on this resource, could someone tell me how to configure?
only use administrator console, or need to write additional configure in web.xml??
thanks..