it is because you need to secure your portlet. when you access the portal, you are either authenticated or not against the portal. in both case if you access the portal then you can hit any servlet in the server, servlet container security will not apply.
the security you set a the war level only applies when you direcly hit the web app using its context. so you should probably use isUserInRole in your portlet before dispatching to the portlet and force users to be authenticated against the portal to reach the jsp. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3871311#3871311 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3871311 ------------------------------------------------------- This SF.net email is sponsored by: 2005 Windows Mobile Application Contest Submit applications for Windows Mobile(tm)-based Pocket PCs or Smartphones for the chance to win $25,000 and application distribution. Enter today at http://ads.osdn.com/?ad_id=6882&alloc_id=15148&op=click _______________________________________________ JBoss-Development mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/jboss-development
