Security, Thanks Frank, a question on your example

Question

Frank
Thanks again.
Based on what you said, I am trying your example on "Declarative J2EE auth and auth with JAAS." I will start with container managed security and use J2EE auth and J2EE sec. I will still have to figure out how to selectively manage the tables in my app based on roles. But, more about that later.
I have created the tables needed. I wanted to try first with the default LoginModule and not use any custom LoginModules your sample talks about.
I ran the jaastester.java first and I seem to have some success.
(See Log
pr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] DBUser Principal Name: Han Solo
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] DBRole Principal Name: User
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] DBRole Principal Name: Manager
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] DBRole Principal Name: Content Owner
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] Logon Successful = true
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] Subject contains 0 Principals before auth
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] Local LM commit succeeded
Apr 9, 2007 12:44:39 PM oracle.sample.dbloginmodule.util.JavaLoggerImpl print
INFO: [DBTableLoginModule] Subject contains 4 Principals after auth
Sounds good but one problem (See below)
This is my set up
db_schema="SECURITYTESTER"
db_schema_pw="oracle"
I was excited and tried to run authtest.jsp under DLMTest. However, when I entered "Han Solo" the DBLoginModuleTest did not do anything. What could be wrong. Obviously it did not authorize!!!!
Is there something I have to do so that authtest.jsp connects to the right schema?
Thanks
P.S. Is there a good book that explains some basics? Obviously, I am getting mixed up with J2EE Security and ADF BC Security, J2EE Roles and ADF roles etc.
null

Answer 1

hi,
frank,I have make a application which include three page,first doesnot need authenticate,second authorizate to role searchUser,the third grant to editRole,and second,third grant to manager ,these are put into the web.xml.then i create three user search,edit,manager in MYADFBC-jazn-data.xml，then edit file orion-web.xml to map roles like this
<security-role-mapping impliesAll="false" name="searchUser">
<user name="search"></user>
<user name="manager"></user>
</security-role-mapping>
if i login as search ,i can access the second page,if i login as manager,i can access all page. then i deploy dbtableoradatasourceloginmodule
i can login as user sking ,even i add search,manage to application_role for user sking,http error 403 always displayed,but when i add
<security-role-mapping impliesAll="false" name="searchUser">
<user name="SKING"></user>
</security-role-mapping>
to orion-web.xml ,i can login and access the second page,but i have added the content as below to applicatoin.xml which locate in jdev_home\jdev\system\oracle.j2ee10.1.3.40.66\embeded-oc4j\config
<jazn provider="XML">
<property name="role.mapping.dynamic" value="true"/>
<property name="custom.loginmodule.provider" value="true"/>
</jazn>
what's wrong with me ?Why role.mapping.dynamic does not effect? How can i do?
thanks advance
lixinzhu
2007/5/5
Message was edited by:
lixinzhu