RDBMSRealm, everyone group, guest user

Question

Hi folks, I'm having some fun with the rdbms realm lately and have a few
questions.
We're using the RDBMSRealm example with form based auth under WLS 5.1 SP 9 and
have the following in web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>All Pages</web-resource-name>
     <description>These pages are only accessible by all authorised xyz users.</description>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>These are the roles that have access</description>
<role-name>
xyz
</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<description>All application users</description>
<role-name>
xyz
</role-name>
</security-role>
which basically says that every page in the web-app requires a user to be in the
xyz role and does seem to work fine.
Now, what I'd like to do is to allow everyone to access one particular page
within the application (that is, this page does not require the xyz role). So
something like the following would be great.
<security-constraint>
<web-resource-collection>
<web-resource-name>Some Particular Page</web-resource-name>
     <description>This page is accessible to everyeone.</description>
<url-pattern>/particular/page.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>everyone can get at this page.</description>
<role-name>everyone</role-name>
</auth-constraint>
</security-constraint>
However, this doesn't seem to work, I get redirected to the form based login
page and once I've logged in can get to the page that I'm hoping shouldn't
require a logged in user.
So I'm wondering about the xml syntax and semantics.
- What are the rules around specific and general mappings, like will a
more specific mapping be used before falling back to the general mapping?
- Are the mappings applied in order (first to last) and the first match
taken?
- Are the rules according to section 10 of the servlet spec applicable here?
Now my problem might also be the RDBMSRealm its self -- I'm also having some
problems with the everyone group and the guest user. If I remove the first
constraint above and only include the /particular/page.jsp constraint to the
everyone group things still don't seem to work right.
I can see the realm call getGroup("everyone") and getUser("guest) but both
calls return null, since these principals are not in our database
tables. However, if I hit http://localhost:7001/AdminRealm I do see a list of
all groups that our RDBMSRealm knows about and I also see the everyone group
which contains system and guest users and so I have more questions.
- Does CachingRealm fall back to the standard properties realm if it gets nulls
from the RDBMSDelegate?
- Does the everyone group include unauthenticated users (i.e. guest) as I'm
hoping?
I've tried adding an instance of weblogic.security.acl.Everyone to my
RDBMSDelegate class and checking if the call to getGroup is looking for
"everyone" in which case I return this instance but this doesn't seem to do
anything either. I also tried adding this everyone group to the list returned
by getGroups but that didn't help and I carried the idea through to getUser and
getUsers with a guest user but again no luck. I'm always forced to authenticate
before I can get to the page that should allow anyone (everyone) to see it.
Any help, ideas, advice, beer, etc. would be much appreciated!
Thanks,
Derek

Answer 1

THorner <[email protected]> writes:
RDBMSRealm, everyone group, guest user
Update-I've got it working.
AS well as the isMember change mentioned below I altered getPrincipal
for both the RDBMSRealm class
if(name.equals("guest")){return createUser("guest","guest");}
if(name.equals("everyone")){return new Everyone(this);}
and RDBMSDelegate
if(name.equals("guest")){return realm.createUser("guest","guest");}
if(name.equals("everyone")){return new
weblogic.security.acl.Everyone(realm);}
did something to RDBMSUser so that guest always authenticates
(alternatively you could put the guest user on the database, surely?)I did see various examples of the guest and everyone additions to the realm
code, but I also read some stuff that indicated that if the rdbms realm returns
null for these requests then the caching realm should fall back to the standard
properties realm which does have the guest user and everyone group defined.
With the debugging turned on this does seem to be what it does and the
guest/everyone code doesn't seem to be needed. I also checked the
http://localhost:7001/AdminRealm servlet and did see the everyone group with
system and guest users as part of it.
>
Allow guest access to the file servlet (otherwise they can't be sent any
HTML pages - my best guess would be that this is your problem).This was probably part of the problem, judging by the messages from the realm
debugging.
Also I altered weblogicURL.policy to allow 'everyone' access to the page
that was to be unrestricted - so I guess you should set
I hope this helps, if not (and you haven't already) turn on RDBMSRealm
debugging - eventually I found the information useful (in that it tends
to tell you what it has last been looking for, and the methods used)In the end, I found that specifying that the everyone group is required for a
particular resource didn't seem to work. Instead I protected the majority of my
application with a set of rules and left all other pages without any matching
rules and the guest user then seems to work ok.
The servlet 2.3 spec has an addition to the <role-name> tag which allows a * to
indicate all roles but this isn't in the 2.2 spec.
Thanks for the help!
Cheers,
Derek
>
terry
-----Original Message-----
From: THorner
I am working on something similar (although not in a war),
which isn't working yet, but I can tell you a couple of
things that I have come across.
-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Derek
Scherger
Posted At: Mon 04 June 2001 22:13
Posted To: weblogic.developer.interest.security
Conversation: RDBMSRealm, everyone group, guest user
Subject: RDBMSRealm, everyone group, guest user
Hi folks, I'm having some fun with the rdbms realm lately and
have a few
questions.
We're using the RDBMSRealm example with form based auth under
WLS 5.1 SP 9 and
have the following in web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>All Pages</web-resource-name>
     <description>These pages are only accessible by all
authorised xyz users.</description>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>These are the roles that have
access</description>
<role-name>
xyz
</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<description>All application users</description>
<role-name>
xyz
</role-name>
</security-role>
which basically says that every page in the web-app requires
a user to be in the
xyz role and does seem to work fine.
Now, what I'd like to do is to allow everyone to access one
particular page
within the application (that is, this page does not require
the xyz role). So
something like the following would be great.
<security-constraint>
<web-resource-collection>
<web-resource-name>Some Particular Page</web-resource-name>
     <description>This page is accessible to
everyeone.</description>
<url-pattern>/particular/page.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>everyone can get at this page.</description>
<role-name>everyone</role-name>
</auth-constraint>
</security-constraint>
However, this doesn't seem to work, I get redirected to the
form based login
page and once I've logged in can get to the page that I'm
hoping shouldn't
require a logged in user.
So I'm wondering about the xml syntax and semantics.
- What are the rules around specific and general mappings, like will a
more specific mapping be used before falling back to the
general mapping?
- Are the mappings applied in order (first to last) and the
first match
taken?
- Are the rules according to section 10 of the servlet spec
applicable here?
Now my problem might also be the RDBMSRealm its self -- I'm
also having some
problems with the everyone group and the guest user. If I
remove the first
constraint above and only include the /particular/page.jsp
constraint to the
everyone group things still don't seem to work right.
I can see the realm call getGroup("everyone") and
getUser("guest) but both
calls return null, since these principals are not in our database
tables. However, if I hit http://localhost:7001/AdminRealm I
do see a list of
all groups that our RDBMSRealm knows about and I also see the
everyone group
which contains system and guest users and so I have more questions.
- Does CachingRealm fall back to the standard properties
realm if it gets nulls
from the RDBMSDelegate?
- Does the everyone group include unauthenticated users (i.e.
guest) as I'm
hoping?
I've tried adding an instance of weblogic.security.acl.Everyone to my
RDBMSDelegate class and checking if the call to getGroup is
looking for
"everyone" in which case I return this instance but this
doesn't seem to do
anything either. I also tried adding this everyone group to
the list returned
by getGroups but that didn't help and I carried the idea
through to getUser and
getUsers with a guest user but again no luck. I'm always
forced to authenticate
before I can get to the page that should allow anyone
(everyone) to see it.
Any help, ideas, advice, beer, etc. would be much appreciated!
Thanks,
Derek