Protected WebResource access granted even though user doesn't have the required role

Question

Apologies in advance - this must be a real newbie question, but I've read thru
alot of documentation/newsgroup info and haven't found the answer.
I'm using WL 7.0 SP1, and deploying an exploded web-app. (contents in attached
Login.zip). The web.xml defines a single protected web-resource (/yeslogin.jsp)
and a single role (PortalUser).
I've got a realm configured with all the Default* providers, and have defined
a user, a group, and the PortalUser role that hooks them together.
If I do not check the Security->Realms->myrealm->General->"Ignore security data
in deployment descriptors" checkbox, my user never seems to be associated with
the role I've defined. (I can see this from the output of the DefaultAuditor set
to INFORMATION severity) when access control checks are done - so I always get
a 403 (Access denied).
If I do check the "Ignore security data in deployment descriptors" box, reboot
WL and re-deploy my web-application then the audit trail does show that my user
is associated with my role, and I am able to run the application.
The problem is, when configured this way if I have another user who does not have
that role, they are also able to use the application. The DefaultAuditRecorder.log
file show that the "Role Manager Audit Event" for checking access to the protected
resource has been invoked, but then the status is SUCCEED!?!?!
Any pointer to what I've done wrong, or the docs that tell me how to do this right
would be WAY appreciated.
This same web-application works across a range of various J2EE 1.3 compliant web-containers,
but I have not figured out how to configure WL 7.0 to let it work.
[Login.zip]

Answer 1

I tried your web app and it worked for me. I hit the URL that you protected:
http://localhost:7001/login/login_page.jsp
Logging in as a bad users popped up your error page.
Logging in as a users in the PortalUser role ( I changed that to a role I
already had) let me hit the
your login page.
One thing. Usually, you let the users hit your protected page and you let
the web container do the work and pop
up your login form instead of you programmatically sending them to the login
page. If you change web.xml to:
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>myrealm</realm-name>
</login-config>
It will just pop up the browsers dialog.
Also, don't check the "ignore security data in deployment descriptors". In
your case you ARE using the deployment
descriptor.
BTW. I can ONLY get web app deployment descriptor security to work in WLS
7.0 sp1 and CAN NOT get the
console web app security policy to work! I have an unanswered post on this.
See the post:
Console based web app security
"Dave Clegg" <[email protected]> wrote in message
news:[email protected]...
>
Apologies in advance - this must be a real newbie question, but I've readthru
alot of documentation/newsgroup info and haven't found the answer.
I'm using WL 7.0 SP1, and deploying an exploded web-app. (contents inattached
Login.zip). The web.xml defines a single protected web-resource(/yeslogin.jsp)
and a single role (PortalUser).
I've got a realm configured with all the Default* providers, and havedefined
a user, a group, and the PortalUser role that hooks them together.
If I do not check the Security->Realms->myrealm->General->"Ignore securitydata
in deployment descriptors" checkbox, my user never seems to be associatedwith
the role I've defined. (I can see this from the output of theDefaultAuditor set
to INFORMATION severity) when access control checks are done - so I alwaysget
a 403 (Access denied).
If I do check the "Ignore security data in deployment descriptors" box,reboot
WL and re-deploy my web-application then the audit trail does show that myuser
is associated with my role, and I am able to run the application.
The problem is, when configured this way if I have another user who doesnot have
that role, they are also able to use the application. TheDefaultAuditRecorder.log
file show that the "Role Manager Audit Event" for checking access to theprotected
resource has been invoked, but then the status is SUCCEED!?!?!
Any pointer to what I've done wrong, or the docs that tell me how to dothis right
would be WAY appreciated.
This same web-application works across a range of various J2EE 1.3compliant web-containers,
but I have not figured out how to configure WL 7.0 to let it work.