Security ignored in JBoss 2.2.2 with Tomcat 3.2.2

[klusi]

I developed a small wep application with the following deployment descriptor:

<?xml version="1.0"?>
<web-app>
 <security-role>
 <role-name>repadmin</role-name>
 </security-role>
 <servlet>
 <servlet-name>controller</servlet-name>
 <servlet-class>com.ifm.util.filemanager.ControllerServlet</servlet-class>
 <security-role-ref>
 <role-name>repadmin</role-name>
 <role-link>repadmin</role-link>
 </security-role-ref>
 </servlet>
 <servlet>
 <servlet-name>upload</servlet-name>
 <servlet-class>com.ifm.util.filemanager.UploadServlet</servlet-class>
 </servlet>
 <servlet-mapping>
 <servlet-name>controller</servlet-name>
 <url-pattern>/main/*</url-pattern>
 </servlet-mapping>
 <servlet-mapping>
 <servlet-name>upload</servlet-name>
 <url-pattern>/uploadFile/*</url-pattern>
 </servlet-mapping>
 <security-constraint>
 <web-resource-collection>
 <web-resource-name>All</web-resource-name>
 <url-pattern>/*</url-pattern>
 <http-method>GET</http-method>
 <http-method>POST</http-method>
 <auth-constraint>
 <role-name>repadmin</role-name>
 </auth-constraint>
 <user-data-constraint>
 <transport-guarantee>NONE</transport-guarantee>
 </user-data-constraint>
 </web-resource-collection>
 </security-constraint>
 <context-param>
 <param-name>uploadDir</param-name>
 <param-value>/home/java/upload</param-value>
 </context-param>
 <context-param>
 <param-name>fileExtension</param-name>
 <param-value>mdc</param-value>
 </context-param>
 <context-param>
 <param-name>renameUploads</param-name>
 <param-value>true</param-value>
 </context-param>
 <login-config>
 <auth-method>BASIC</auth-method>
 <realm-name>ldap-login</realm-name>
 </login-config>
</web-app>

The application deploys to jboss without problems.

My problem is that when I am accessing the page no login dialog appears and I can access the app without any authentication.

Any ideas?

Thanks in advance

Thorsten

[starksm64]

Read the following security tutorial

http://www.jboss.org/documentation/HTML/ch13s70.html

[klusi]

I read this tutorial and installed the examples. They work fine.

In my servlets, no EJBs are used. I only want to secure my web application. I tried to use the example auth.conf-file from the tutorial and specified <security-domain>java:/jaas/example1</security-domain> in the jboss-web.xml deployment descriptor. But it still is ignored and I get into the application without being prompted for a password.
I wondered where to put the roles.properties and the users.properties files within a web-application. I put it in /WEB-INF/classes.

Any further ideas?

Regards

Thorsten

[starksm64]

What does your jboss-web.xml look like?

[klusi]

I figured out why the login didn't work correctly. My web.xml-file had an error in the <web-resource-collection>-section.

Now everything works fine.

Regards

Thorsten