Hi,
My config : JSPWiki v2.8.4 Ubuntu 10.04 tomcat6 6.0.24-2, sun-java6-jdk
1.6.0_26-b03 ActiveDirectory LDAP.
I use an custom authentication (Container-Managed Authentication) via
AD. It runs well.
I create a AD group for a specific role. Any user in this AD group can
rename, edit,..
The AD users who are authentificated and are not in the AD group cannot
edit the page.
Jspwiki.policy bellow doesn't work "grant principal
com.ecyrd.jspwiki.auth.authorize.Role "Authenticated" {" see the entire
file bellow
I read on the mailing list archive than there are an "overlap" between
"local user database" and "Container-Managed Authentification".
I don't find the solution.
Below my web.xml, jspwiki.policy
-------------------------------------
Web.xml (AD group cname is "eri_wiki"
-------------------------------------
<security-constraint>
<web-resource-collection>
<web-resource-name>Administrative Area</web-resource-name>
<url-pattern>/Delete.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>eri_wiki</role-name>
<role-name>Admin</role-name>
</auth-constraint>
<!--
<auth-constraint>
<role-name>Admin</role-name>
</auth-constraint>
-->
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Authenticated area</web-resource-name>
<url-pattern>/Edit.jsp</url-pattern>
<url-pattern>/Comment.jsp</url-pattern>
<url-pattern>/Login.jsp</url-pattern>
<url-pattern>/NewGroup.jsp</url-pattern>
<url-pattern>/Rename.jsp</url-pattern>
<url-pattern>/Upload.jsp</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>HEAD</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<web-resource-collection>
<web-resource-name>Read-only Area</web-resource-name>
<url-pattern>/attach</url-pattern>
<http-method>DELETE</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>Admin</role-name>
<role-name>eri_wiki</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/LoginForm.jsp</form-login-page>
<form-error-page>/LoginForm.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>
This logical role includes all authenticated users
</description>
<role-name>Authenticated</role-name>
</security-role>
<security-role>
<description>
This logical role includes all administrative users
</description>
<role-name>Admin</role-name>
</security-role>
<security-role>
<description>
This logical role includes all eri wiki users
</description>
<role-name>eri_wiki</role-name>
</security-role>
-----------------------------------------------------------
Jspwiki.policy
-----------------------------------------------------------
grant principal com.ecyrd.jspwiki.auth.authorize.Role "All" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
"view";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"editPreferences";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"editProfile";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"login";
};
grant principal com.ecyrd.jspwiki.auth.authorize.Role "Anonymous" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
"modify";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"createPages";
};
grant principal com.ecyrd.jspwiki.auth.authorize.Role "Asserted" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
"modify";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"createPages";
permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:*",
"view";
};
grant principal com.ecyrd.jspwiki.auth.authorize.Role "Authenticated" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
"modify,rename";
permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:*",
"view";
permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:*",
"edit";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"createPages,createGroups";
};
grant principal com.ecyrd.jspwiki.auth.authorize.Role "Admin" {
permission com.ecyrd.jspwiki.auth.permissions.AllPermission "*";
};
grant principal com.ecyrd.jspwiki.auth.authorize.Role "eri_wiki" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
"modify,rename";
permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:*",
"view";
permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:*",
"edit";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"createPages,createGroups";
};
Thanks
Eric
