Using a custom Custom AuthorizatioProvider with security-constraints on webApp?

Question

Hi,
we have adapted the security from the medrec-example to build our own
authorization-provider to fetch our users from an RDBMS. Mainly we want
to secure a web-application using <security-constraint>'s:
The MBean for the AUthorizationProvider gets properly deployed into
<wl-home>/server/lib/mbeantypes
and the log-messages show, that the user gets logged in and the groups
for the user are properly resolved. However, when we access a ressource
in a web-app that is secured using:
<security-constraint>
          <web-resource-collection>
               <web-resource-name>SecureCollection</web-resource-name>
               <description>
These pages are only accessible by members of the dvr.
</description>
               <url-pattern>/htdocs/secure/*</url-pattern>
               <http-method>DELETE</http-method>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
               <http-method>PUT</http-method>
          </web-resource-collection>
          <auth-constraint>
               <description>These are the roles who have access</description>
               <role-name>securegroup</role-name>
          </auth-constraint>
          <user-data-constraint>
               <description>
This is how the user data must be transmitted
</description>
               <transport-guarantee>NONE</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
access to the ressource is denied, although the user is in securegroup.
Is there something else we need?! From the docs I understood, that in
absence of a security-role-assignment in weblogic.xml, the server takes
the rolename as principal, so our weblogic.xml is empty right now....
Any ideas anybody?!
Cheers
stf

Answer 1

As there is obviously noone else to answer this, I had to figure this
out myself: The reason for this is the "REQUIRED"-Controlflag on the
Default-AuthorizationProvider. The docs for the medrec-example forgot to
say, that unless you have your users in both the Database and the
internal LDAP-Server the Default-AuthorizationProvider, you are not
granted access - changing the Flag to optional does the trick.
By the way: Same holds true for the Compatibility-Security you can use
to upgrade your old RDBMS-Realms from 6.1: Without the Control-Flag on
the Default-AuthorizationProvider you can search endlessly for the
reason you can't log in although your realm properly authenticates you....
Stefan Frank wrote:
Hi,
we have adapted the security from the medrec-example to build our own
authorization-provider to fetch our users from an RDBMS. Mainly we want
to secure a web-application using <security-constraint>'s:
The MBean for the AUthorizationProvider gets properly deployed into
<wl-home>/server/lib/mbeantypes
and the log-messages show, that the user gets logged in and the groups
for the user are properly resolved. However, when we access a ressource
in a web-app that is secured using:
<security-constraint>
<web-resource-collection>
<web-resource-name>SecureCollection</web-resource-name>
<description>
These pages are only accessible by members of the dvr.
</description>
<url-pattern>/htdocs/secure/*</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<description>These are the roles who have access</description>
<role-name>securegroup</role-name>
</auth-constraint>
<user-data-constraint>
<description>
This is how the user data must be transmitted
</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
access to the ressource is denied, although the user is in securegroup.
Is there something else we need?! From the docs I understood, that in
absence of a security-role-assignment in weblogic.xml, the server takes
the rolename as principal, so our weblogic.xml is empty right now....
Any ideas anybody?!
Cheers
stf