Verifying access to each jsp

Question

Hello!
I'm developing a web app in which users need to be authenticated.
Users have different profiles and, according the the profile, they may or may not have access to certain pages.
Some pages may be accessed by all user profiles while other pages may only be accessed by one or two profiles..
After the user logs on, I keep the profile in the session.
What is the best way to validate access to each jsp? My app has a big tendency to get bigger and bigger and to have more and more jsps, so I would like the solution to address this issue.
Any help is appreciated...
Nuno Geraldes

Answer 1

You can set up declarative security in your web.xml file.
Basically you have users and roles.
You can restrict access to html/jsp pages based on the role a user is logged in on.
Heres a basic extract from a project: sets up an admin folder, only available to those in the admin role.
This security is part of the servlet spec, and should be supported by all servlet containers.
For Tomcat, you may find this page on setting up realms useful.
http://jakarta.apache.org/tomcat/tomcat-4.1-doc/realm-howto.html
<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/login/login.html</form-login-page>
      <form-error-page>/login/loginerror.html</form-error-page>
    </form-login-config>
  </login-config>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Admin Application</web-resource-name>
      <url-pattern>/admin/*</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
      <description>Administration Application</description>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <description>Administrators Only</description>
    </auth-constraint>
  </security-constraint>Check out the J2EE tutorial Chapter 32 on Security.
http://java.sun.com/j2ee/1.4/docs/tutorial/doc/Security.html#wp268799
Hope this helps,
evnafets