Web.xml: security-constraint [un]usable in JSF?

Question

<security-constraint> in web.xml is a simple, effective and portable method of declaring a web application�s security policies.
It's been noted, however, in an earlier topic (http://forum.java.sun.com/thread.jspa?threadID=747919&messageID=4279347) that it has it�s limitations in the context of jsf.
A reasonable solution would be to consult <security-constraint> elements in one�s own web.xml when rendering <h:commandLink>'s on a page according to the security policy.
Unfortunately, there is no standard method of reading web.xml, other than what�s available from the ServletContext.
I found some container specific-implementations in the Cargo project from the http://cargo.codehaus.org,
but I�m looking for a portable solution. Any thoughts?
Thanks, y�all!

Answer 1

Use the <security-role-ref> for the Faces Servlet to map the LDAP roles to the logical role names used by the managed bean to determine if links may be rendered.
Bean code:
this.isAdmin = context.getExternalContext().isUserInRole("admin");web.xml:
        <security-role>
          <role-name>Local Admin Group</role-name>
     </security-role>
     <security-role>
          <role-name>DBA Group</role-name>
     </security-role>
    <!-- Faces Servlet -->
    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <security-role-ref>
              <role-name>admin</role-name>
              <role-link>DBA Group</role-link>
       </security-role-ref>
        <security-role-ref>
              <role-name>admin</role-name>
              <role-link>Local Admin Group</role-link>
       </security-role-ref>
    </servlet>