Permissions Portal Pages and Portlets

[engela]

I'm using Jboss portal 2.4.0 and Jboss AS 4.0.4 GA.

Portal Page Permissions
----------------------------
When I create a new page the security setting for the page for Unchecked is set to viewrecursive, but I would like to restrict the access to the page to certain admininstrators only. How can I achieve this?

Portlet Permissions
----------------------
Within a portal page I have a Portlet A and a Portlet B. I would like to restrict the access of Portlet A to Administrators. I went to the security settings page for the portal page and set the security setting from viewrecursive to view for all users. Then I went to the security settings for Portlet A and set the security settings only an Administrator to View. Despite this Portlet A can be viewed by whoever can access the page.
How can change the settings to achieve my goal i.e. that only administrators can view Portlet A?

Thanks...

[peterj]

Regarding Portal page permissions, add the following to each page entry:

<page>
 . . .
 <security-constraint>
 <policy-permission />
 </security-constraint>
</page>

You have to explicitly give an empty permission or the default (Unchecked, viewrecursive) is applied.

Regarding portlet permissions, you cannot set permissions on a portlet window (actually you can, the Managament Portlet will let you, but the portal ignores the setting). Instead, set the permission on the portlet instance. To do this, in the Management Portlet, click on the Instances link at the top of the portlet window, then scroll through the list of instances until you find the instance for Portlet A, click the instance link (not the portlet link!) then click on Security at the right side of the window. Then you can set the security (only view access shows up for the various roles). (Wish I could post a screen shot...)