Require Login (Form based)

Question

Hi all,
I want to control my website so that all pages require a logged in user, some pages are only visible for certain roles. In the web.xml description there is a remark for the <login-config> element:
If this element is present, the user must be authenticated in order to access any resource that is constrained by a <security-constraint> defined in the Web application. Once authenticated, the user can be authorized to access other resources with access privileges.
one for all pages:
<security-constraint>
<web-resource-collection>
<web-resource-name>all pages</web-resource-name>
<description>desc</description>
<url-pattern>/*</url-pattern>
</web-resource-collection>
</security-constraint>
one with restriction for roles:
<security-constraint>
<web-resource-collection>
<web-resource-name>role rescricted</web-resource-name>
<description>...</description>
<url-pattern>/control/requirements/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>aRoleName</role-name>
</auth-constraint>
</security-constraint>
my <login-config> element:
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/control/Login</form-login-page>
<form-error-page>/control/Login</form-error-page>
</form-login-config>
</login-config>
The role restriction works fine. But also a user who is not logged in, can access the other pages and is not redirected to the login page.
Any ideas??

Answer 1

The Security-constraint for "all pages" doesn't specify an auth-constraint ie no role. I think that the default role is applied ie "Anonymous" which is everyone in the special group called "everyone" which course includes all not logged in users.
create a role in your weblogic.xml called Users and make it contain the principal "users" which is a default group of all authenticated users.
Then add the role "Users" to the "all pages" constraint, it will force an authentication.
for info on default groups see:
http://e-docs.bea.com/wls/docs81/secwlres/usrs_grps.html#1179347
Note that if you create your own Authentication Provider you should probably make it add the WLSGroup principal "everyone" an "users" as well as other groups when a user sucessfully logs in. NB the groupname "everyone" is not guaranteed and you should get the principal name of the everyone group from API:
weblogic.security.WLSPrincipals.getEveryoneGroupname() or
weblogic.security.WLSPrincipals.getUsersGroupname()
cheers
Karl