Re: How do I use JAAS(JbossSX) in Struts?
Thank you for all your help. I finnaly solved it. I had misundestod the servlet login method. Once read 5 times more I got. But again thank you for all your help. Best regards - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
Sorry the late reply, had som problems with me mailserver last night.
*
Why do I need the /DB/home url in web.xml.
Is't this enough url-pattern/HelpDesk/bruger/*/url-pattern in the
security-constraint?
Marc
Adam Hardy wrote:
You need to put that /DB/home url pattern in your web.xml otherwise the
servlet container won't force you to login when requesting it.
Adam
On 07/06/05 13:02nbsp;marc wrote:
Ok seems like it is not working well at all.
Me login is logging me in ok. But it seems like neither me web.xml or
my struts actions is looking in me roles.
I have a admin user wdkmaol, that has the admin role. To test things I
made this code in the login action:
**
Subject testsub = lc.getSubject();
Set testset = testsub.getPrincipals();
Iterator ite = testset.iterator();
while (ite.hasNext()){
System.out.println(CYKLE CYKLE:
+ite.next().toString());
}
***
This prints out:
***
CYKLE CYKLE: wdkmaol
CYKLE CYKLE: Roles(members:admin)
***
So I should be in the right role.
Then I put this in me web.xml:
***
security-constraint
web-resource-collection
web-resource-nameSecure Content/web-resource-name
url-pattern/HelpDesk/bruger/*/url-pattern
/web-resource-collection
auth-constraint
role-nameadmin/role-name
/auth-constraint
user-data-constraint
transport-guaranteeNONE/transport-guarantee
/user-data-constraint
/security-constraint
***
But there is no problem going to /HelpDesk/bruger/adduser, as the
admin.
Last but not least I didt this in some action's to test:
***
action path=/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
roles=admin
forward name=home
path=.dbcontrol.welcome
redirect=false/
/action
***
When I try to access this it comes back with:
***
User is not authorized to access action /DB/home
***
Even thow Im in the admin role.
Im I missing something??
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
Sorry the late reply, had some problems with me mail server.
Yeah I got the security-role.
Why do I need action path=HelpDesk/bruger/DB/home ??
Shouldn't this url-pattern/HelpDesk/bruger/*/url-pattern in me
web.xml, just restrict me to all under this?
Marc
Vance Karimi wrote:
I'm presuming you also have the following in your web.xml:
security-role
descriptionAdmin user allowed to invoke all methods/description
role-nameadmin/role-name
/security-role
to define the security roles used?
If you change your action path to reflect the url pattern for the 'admin'
role secured resource, it should certainly work and should not require the
role attribute like this:
action path=/HelpDesk/bruger/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
Vance
-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc
Sent: Tuesday, 7 June 2005 8:03 PM
To: user@struts.apache.org
Subject: Re: How do I use JAAS(JbossSX) in Struts?
Ok seems like it is not working well at all.
Me login is logging me in ok. But it seems like neither me web.xml or my
struts actions is looking in me roles.
I have a admin user wdkmaol, that has the admin role. To test things I
made this code in the login action:
**
Subject testsub = lc.getSubject();
Set testset = testsub.getPrincipals();
Iterator ite = testset.iterator();
while (ite.hasNext()){
System.out.println(CYKLE CYKLE:
+ite.next().toString());
}
***
This prints out:
***
CYKLE CYKLE: wdkmaol
CYKLE CYKLE: Roles(members:admin)
***
So I should be in the right role.
Then I put this in me web.xml:
***
security-constraint
web-resource-collection
web-resource-nameSecure Content/web-resource-name
url-pattern/HelpDesk/bruger/*/url-pattern
/web-resource-collection
auth-constraint
role-nameadmin/role-name
/auth-constraint
user-data-constraint
transport-guaranteeNONE/transport-guarantee
/user-data-constraint
/security-constraint
***
But there is no problem going to /HelpDesk/bruger/adduser, as the
admin.
Last but not least I didt this in some action's to test:
***
action path=/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
roles=admin
forward name=home
path=.dbcontrol.welcome
redirect=false/
/action
***
When I try to access this it comes back with:
***
User is not authorized to access action /DB/home
***
Even thow Im in the admin role.
Im I missing something??
I followed this howto, to get it work:
http://www.javaworld.com/javaforums/showflat.php?Cat=2Board=JavaSecurity;
Number=2500page=0view=collapsedsb=5o=fpart=1
Vance Karimi wrote:
I use xdoclet and since Struts 1.1 you can do something like this in
your
Action class where you can specify the list of Roles that have access to
this action.
/**
* @struts.action
* name=CustomerCreateForm
* path=/operator/customers/customer/CustomerAddAction
* input=/operator/customers/customer/CustomerCreatePage.jsp
* scope=request
* validate=true
* roles = Admin,Operator
...
However I have settled for declarative security with JBossSX and define
the
context relative URLs to protect with specified roles in my web.xml.
But I
presume you are doing this anyway if using JBossSX.
-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc
Sent: Friday, 3 June 2005 10:03 PM
To: user@struts.apache.org
Subject: Re: How do I use JAAS(JbossSX) in Struts?
Yeah looks cool and works with Velocity. I'm working on getting it to
work in me project.
But I still need to have access controls on me different action's.
Vance Karimi wrote:
Have a look at the Struts Menu plugin
http://struts-menu.sourceforge.net/
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
I don't know! It's not clear what you want.
Let me turn the question round: in your web.xml why do you think that
protecting /HelpDesk/bruger/* should also protect /DB/home?
Adam
PS: as an OO developer, your action class's name ToDBAction makes me
writhe in agony - hoping I'm not being patronising - before you write an
app that does more than hello world, you should check out the
commonest design patterns and start using a decent naming and coding
convention - to avoid pain later.
On 08/06/05 10:03nbsp;marc wrote:
Sorry the late reply, had som problems with me mailserver last night.
*
Why do I need the /DB/home url in web.xml.
Is't this enough url-pattern/HelpDesk/bruger/*/url-pattern in the
security-constraint?
Marc
Adam Hardy wrote:
You need to put that /DB/home url pattern in your web.xml otherwise
the servlet container won't force you to login when requesting it.
Adam
On 07/06/05 13:02nbsp;marc wrote:
Ok seems like it is not working well at all.
Me login is logging me in ok. But it seems like neither me web.xml or
my struts actions is looking in me roles.
I have a admin user wdkmaol, that has the admin role. To test things
I made this code in the login action:
**
Subject testsub = lc.getSubject();
Set testset = testsub.getPrincipals();
Iterator ite = testset.iterator();
while (ite.hasNext()){
System.out.println(CYKLE CYKLE:
+ite.next().toString());
}
***
This prints out:
***
CYKLE CYKLE: wdkmaol
CYKLE CYKLE: Roles(members:admin)
***
So I should be in the right role.
Then I put this in me web.xml:
***
security-constraint
web-resource-collection
web-resource-nameSecure Content/web-resource-name
url-pattern/HelpDesk/bruger/*/url-pattern
/web-resource-collection
auth-constraint
role-nameadmin/role-name
/auth-constraint
user-data-constraint
transport-guaranteeNONE/transport-guarantee
/user-data-constraint
/security-constraint
***
But there is no problem going to /HelpDesk/bruger/adduser, as the
admin.
Last but not least I didt this in some action's to test:
***
action path=/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
roles=admin
forward name=home
path=.dbcontrol.welcome
redirect=false/
/action
***
When I try to access this it comes back with:
***
User is not authorized to access action /DB/home
***
Even thow Im in the admin role.
Im I missing something??
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
No /HelpDesk/bruger/* in web.xml should not protect /DB/home. But roles=admin in action path=/DB/home type=wilson.helpdesk.actions.menu.ToDbAction roles=admin when the user has the admin role, should protect it. Should't ?? Marc Adam Hardy wrote: I don't know! It's not clear what you want. Let me turn the question round: in your web.xml why do you think that protecting /HelpDesk/bruger/* should also protect /DB/home? Adam - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
Ok seems like it is not working well at all.
Me login is logging me in ok. But it seems like neither me web.xml or my
struts actions is looking in me roles.
I have a admin user wdkmaol, that has the admin role. To test things I
made this code in the login action:
**
Subject testsub = lc.getSubject();
Set testset = testsub.getPrincipals();
Iterator ite = testset.iterator();
while (ite.hasNext()){
System.out.println(CYKLE CYKLE:
+ite.next().toString());
}
***
This prints out:
***
CYKLE CYKLE: wdkmaol
CYKLE CYKLE: Roles(members:admin)
***
So I should be in the right role.
Then I put this in me web.xml:
***
security-constraint
web-resource-collection
web-resource-nameSecure Content/web-resource-name
url-pattern/HelpDesk/bruger/*/url-pattern
/web-resource-collection
auth-constraint
role-nameadmin/role-name
/auth-constraint
user-data-constraint
transport-guaranteeNONE/transport-guarantee
/user-data-constraint
/security-constraint
***
But there is no problem going to /HelpDesk/bruger/adduser, as the admin.
Last but not least I didt this in some action's to test:
***
action path=/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
roles=admin
forward name=home
path=.dbcontrol.welcome
redirect=false/
/action
***
When I try to access this it comes back with:
***
User is not authorized to access action /DB/home
***
Even thow Im in the admin role.
Im I missing something??
I followed this howto, to get it work:
http://www.javaworld.com/javaforums/showflat.php?Cat=2Board=JavaSecurityNumber=2500page=0view=collapsedsb=5o=fpart=1
Vance Karimi wrote:
I use xdoclet and since Struts 1.1 you can do something like this in your
Action class where you can specify the list of Roles that have access to
this action.
/**
* @struts.action
* name=CustomerCreateForm
* path=/operator/customers/customer/CustomerAddAction
* input=/operator/customers/customer/CustomerCreatePage.jsp
* scope=request
* validate=true
*roles = Admin,Operator
...
However I have settled for declarative security with JBossSX and define the
context relative URLs to protect with specified roles in my web.xml. But I
presume you are doing this anyway if using JBossSX.
-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc
Sent: Friday, 3 June 2005 10:03 PM
To: user@struts.apache.org
Subject: Re: How do I use JAAS(JbossSX) in Struts?
Yeah looks cool and works with Velocity. I'm working on getting it to
work in me project.
But I still need to have access controls on me different action's.
Vance Karimi wrote:
Have a look at the Struts Menu plugin
http://struts-menu.sourceforge.net/
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
RE: How do I use JAAS(JbossSX) in Struts?
I'm presuming you also have the following in your web.xml:
security-role
descriptionAdmin user allowed to invoke all methods/description
role-nameadmin/role-name
/security-role
to define the security roles used?
If you change your action path to reflect the url pattern for the 'admin'
role secured resource, it should certainly work and should not require the
role attribute like this:
action path=/HelpDesk/bruger/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
Vance
-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc
Sent: Tuesday, 7 June 2005 8:03 PM
To: user@struts.apache.org
Subject: Re: How do I use JAAS(JbossSX) in Struts?
Ok seems like it is not working well at all.
Me login is logging me in ok. But it seems like neither me web.xml or my
struts actions is looking in me roles.
I have a admin user wdkmaol, that has the admin role. To test things I
made this code in the login action:
**
Subject testsub = lc.getSubject();
Set testset = testsub.getPrincipals();
Iterator ite = testset.iterator();
while (ite.hasNext()){
System.out.println(CYKLE CYKLE:
+ite.next().toString());
}
***
This prints out:
***
CYKLE CYKLE: wdkmaol
CYKLE CYKLE: Roles(members:admin)
***
So I should be in the right role.
Then I put this in me web.xml:
***
security-constraint
web-resource-collection
web-resource-nameSecure Content/web-resource-name
url-pattern/HelpDesk/bruger/*/url-pattern
/web-resource-collection
auth-constraint
role-nameadmin/role-name
/auth-constraint
user-data-constraint
transport-guaranteeNONE/transport-guarantee
/user-data-constraint
/security-constraint
***
But there is no problem going to /HelpDesk/bruger/adduser, as the
admin.
Last but not least I didt this in some action's to test:
***
action path=/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
roles=admin
forward name=home
path=.dbcontrol.welcome
redirect=false/
/action
***
When I try to access this it comes back with:
***
User is not authorized to access action /DB/home
***
Even thow Im in the admin role.
Im I missing something??
I followed this howto, to get it work:
http://www.javaworld.com/javaforums/showflat.php?Cat=2Board=JavaSecurity;
Number=2500page=0view=collapsedsb=5o=fpart=1
Vance Karimi wrote:
I use xdoclet and since Struts 1.1 you can do something like this in
your
Action class where you can specify the list of Roles that have access to
this action.
/**
* @struts.action
* name=CustomerCreateForm
* path=/operator/customers/customer/CustomerAddAction
* input=/operator/customers/customer/CustomerCreatePage.jsp
* scope=request
* validate=true
*roles = Admin,Operator
...
However I have settled for declarative security with JBossSX and define
the
context relative URLs to protect with specified roles in my web.xml.
But I
presume you are doing this anyway if using JBossSX.
-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc
Sent: Friday, 3 June 2005 10:03 PM
To: user@struts.apache.org
Subject: Re: How do I use JAAS(JbossSX) in Struts?
Yeah looks cool and works with Velocity. I'm working on getting it to
work in me project.
But I still need to have access controls on me different action's.
Vance Karimi wrote:
Have a look at the Struts Menu plugin
http://struts-menu.sourceforge.net/
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
You need to put that /DB/home url pattern in your web.xml otherwise the
servlet container won't force you to login when requesting it.
Adam
On 07/06/05 13:02nbsp;marc wrote:
Ok seems like it is not working well at all.
Me login is logging me in ok. But it seems like neither me web.xml or my
struts actions is looking in me roles.
I have a admin user wdkmaol, that has the admin role. To test things I
made this code in the login action:
**
Subject testsub = lc.getSubject();
Set testset = testsub.getPrincipals();
Iterator ite = testset.iterator();
while (ite.hasNext()){
System.out.println(CYKLE CYKLE: +ite.next().toString());
}
***
This prints out:
***
CYKLE CYKLE: wdkmaol
CYKLE CYKLE: Roles(members:admin)
***
So I should be in the right role.
Then I put this in me web.xml:
***
security-constraint
web-resource-collection
web-resource-nameSecure Content/web-resource-name
url-pattern/HelpDesk/bruger/*/url-pattern
/web-resource-collection
auth-constraint
role-nameadmin/role-name
/auth-constraint
user-data-constraint
transport-guaranteeNONE/transport-guarantee
/user-data-constraint
/security-constraint
***
But there is no problem going to /HelpDesk/bruger/adduser, as the
admin.
Last but not least I didt this in some action's to test:
***
action path=/DB/home
type=wilson.helpdesk.actions.menu.ToDbAction
roles=admin
forward name=home
path=.dbcontrol.welcome
redirect=false/
/action
***
When I try to access this it comes back with:
***
User is not authorized to access action /DB/home
***
Even thow Im in the admin role.
Im I missing something??
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
How do I use JAAS(JbossSX) in Struts?
Now I have made a Struts app, that uses a LoginContext (Using jbossSX/JAAS) to login. And this works fin. But now I what to use the attibutes from the logincontext for more. And what to be able to make menu's based on what role the user have. I what to be able to set access controls to different action's base on user roles. And other fancy things. Is there a easy way to do this in struts. A plugin or something? Or do anybody now some where I can read more abort it? best regards and you all have a nice weekend. \-Marc-/ - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
RE: How do I use JAAS(JbossSX) in Struts?
Have a look at the Struts Menu plugin http://struts-menu.sourceforge.net/ -Original Message- From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc Sent: Friday, 3 June 2005 5:51 PM To: user@struts.apache.org Subject: How do I use JAAS(JbossSX) in Struts? Now I have made a Struts app, that uses a LoginContext (Using jbossSX/JAAS) to login. And this works fin. But now I what to use the attibutes from the logincontext for more. And what to be able to make menu's based on what role the user have. I what to be able to set access controls to different action's base on user roles. And other fancy things. Is there a easy way to do this in struts. A plugin or something? Or do anybody now some where I can read more abort it? best regards and you all have a nice weekend. \-Marc-/ - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: How do I use JAAS(JbossSX) in Struts?
Yeah looks cool and works with Velocity. I'm working on getting it to work in me project. But I still need to have access controls on me different action's. Vance Karimi wrote: Have a look at the Struts Menu plugin http://struts-menu.sourceforge.net/ -Original Message- From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc Sent: Friday, 3 June 2005 5:51 PM To: user@struts.apache.org Subject: How do I use JAAS(JbossSX) in Struts? Now I have made a Struts app, that uses a LoginContext (Using jbossSX/JAAS) to login. And this works fin. But now I what to use the attibutes from the logincontext for more. And what to be able to make menu's based on what role the user have. I what to be able to set access controls to different action's base on user roles. And other fancy things. Is there a easy way to do this in struts. A plugin or something? Or do anybody now some where I can read more abort it? best regards and you all have a nice weekend. \-Marc-/ - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
RE: How do I use JAAS(JbossSX) in Struts?
I use xdoclet and since Struts 1.1 you can do something like this in your Action class where you can specify the list of Roles that have access to this action. /** * @struts.action * name=CustomerCreateForm * path=/operator/customers/customer/CustomerAddAction * input=/operator/customers/customer/CustomerCreatePage.jsp * scope=request * validate=true *roles = Admin,Operator ... However I have settled for declarative security with JBossSX and define the context relative URLs to protect with specified roles in my web.xml. But I presume you are doing this anyway if using JBossSX. -Original Message- From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc Sent: Friday, 3 June 2005 10:03 PM To: user@struts.apache.org Subject: Re: How do I use JAAS(JbossSX) in Struts? Yeah looks cool and works with Velocity. I'm working on getting it to work in me project. But I still need to have access controls on me different action's. Vance Karimi wrote: Have a look at the Struts Menu plugin http://struts-menu.sourceforge.net/ -Original Message- From: news [mailto:[EMAIL PROTECTED] On Behalf Of marc Sent: Friday, 3 June 2005 5:51 PM To: user@struts.apache.org Subject: How do I use JAAS(JbossSX) in Struts? Now I have made a Struts app, that uses a LoginContext (Using jbossSX/JAAS) to login. And this works fin. But now I what to use the attibutes from the logincontext for more. And what to be able to make menu's based on what role the user have. I what to be able to set access controls to different action's base on user roles. And other fancy things. Is there a easy way to do this in struts. A plugin or something? Or do anybody now some where I can read more abort it? best regards and you all have a nice weekend. \-Marc-/ - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
