Security with jsf

Question

Hello,
my website has 5 roles groups and each one can access to differents pages.
How can i forbid the access to pages of the role group 1 to the others?
In fact, a bean has a "level" variable which contain the role group of the user.
I would like to test this value and if it is the good one, give access.
Otherwise, i would like to redirect the user to the login page
Thx u in advance !
PS: All is made with JSF

Answer 1

Hi
Put this in Ur web.xml
<filter>
          <filter-name>SecurityFilter</filter-name>
          <filter-class>adjuvant.poa.util.SecurityFilter</filter-class>
     </filter>
     <filter-mapping>
          <filter-name>SecurityFilter</filter-name>
          <url-pattern>*.jsf</url-pattern>
     </filter-mapping>
here is ur security class
adjuvant.poa.util.SecurityFilter
* [email protected]
package adjuvant.poa.util;
import javax.servlet.Filter;
import javax.servlet.FilterConfig;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.util.Iterator;
import java.util.Set;
import java.util.HashSet;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import adjuvant.poa.jsf.backingbeans.UserBean;
* This Filter class handle the security of the application.
* <p>
* It should be configured inside the web.xml.
public class SecurityFilter implements Filter {
     //the login page uri
     private static final String LOGIN_PAGE_URI = "login.jsf";
     private static final String ADMIN_LOGIN_PAGE_URI = "../login.jsf";
     private static final String USER_BEAN = "nurse";
     //the logger object
     private Log logger = LogFactory.getLog(this.getClass());
     //a set of restricted resources
     private Set restrictedResources;
     * Initializes the Filter.
     public void init(FilterConfig filterConfig) throws ServletException {
          this.restrictedResources = new HashSet();
          this.restrictedResources.add("/assessment.jsf");
          this.restrictedResources.add("/patients.jsf");
          this.restrictedResources.add("/anesthetic.jsf");
          this.restrictedResources.add("/baseline.jsf");
          this.restrictedResources.add("/drugs.jsf");
          this.restrictedResources.add("/endocrine.jsf");
          this.restrictedResources.add("/haematological.jsf");
          this.restrictedResources.add("/labwork.jsf");
          this.restrictedResources.add("/medication.jsf");
          this.restrictedResources.add("/neurologocal.jsf");
          this.restrictedResources.add("/newpatient.jsf");
          this.restrictedResources.add("/patientdetails.jsf");
          this.restrictedResources.add("/renal.jsf");
          this.restrictedResources.add("/respiratory.jsf");
          this.restrictedResources.add("/riskassessment.jsf");
          this.restrictedResources.add("/summary.jsf");
          this.restrictedResources.add("/minimalquestions.jsf");
          //admin Pages
          this.restrictedResources.add("/admin/admin.jsf");
          this.restrictedResources.add("/admin/drugs.jsf");
          this.restrictedResources.add("/admin/drugs.jsf");
          this.restrictedResources.add("/admin/editdrugs.jsf");
          this.restrictedResources.add("/admin/nurses.jsf");
          this.restrictedResources.add("/admin/newnurse.jsf");
          this.restrictedResources.add("/admin/transaction.jsf");
     * Standard doFilter object.
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
               throws IOException, ServletException {
          this.logger.debug("doFilter");
          String contextPath = ((HttpServletRequest)req).getContextPath();
          String requestUri = ((HttpServletRequest)req).getRequestURI();
          this.logger.debug("contextPath = " + contextPath);
          this.logger.debug("requestUri = " + requestUri);
          if (this.contains(requestUri, contextPath) && !(requestUri.contains("admin") ? this.authorizeAdmin((HttpServletRequest)req) : this.authorize((HttpServletRequest)req))) {
               this.logger.debug("authorization failed");
               ((HttpServletRequest)req).getRequestDispatcher(LOGIN_PAGE_URI).forward(req, res);
          else {
               this.logger.debug("authorization succeeded");
               chain.doFilter(req, res);
     public void destroy() {}
     private boolean contains(String value, String contextPath) {
          Iterator ite = this.restrictedResources.iterator();
          while (ite.hasNext()) {
               String restrictedResource = (String)ite.next();
               if ((contextPath + restrictedResource).equalsIgnoreCase(value)) {
                    return true;
          return false;
     private boolean authorize(HttpServletRequest req) {
          UserBean user = (UserBean)req.getSession().getAttribute(USER_BEAN);          
          if (user != null ) {
               //user logged in
               return true;
          else {
               return false;
     private boolean authorizeAdmin(HttpServletRequest request) {
          UserBean user = (UserBean)request.getSession().getAttribute(USER_BEAN);
          if (user != null && user.getUserId() != null && user.getUserId().equals("admin") ) {
               //user logged in
               return true;
          else {
               return false;
}