How to protect url-pattern by Role

[susnet]

How do I protect e.g. /admin for users only logged in with Role "admin" in the best way using PicketLink?

This is what I would like to do (in this example I use JEE Security XML):

<security-constraint>

<web-resource-collection>

  <web-resource-name>welcome page</web-resource-name>

<url-pattern>/admin/*</url-pattern>

</web-resource-collection>

  <auth-constraint>

  <role-name>admin</role-name>

  </auth-constraint>

  <user-data-constraint>

  <transport-guarantee>CONFIDENTIAL</transport-guarantee>

  </user-data-constraint>

</security-constraint>

<security-constraint>

  <web-resource-collection>

  <web-resource-name>welcome page</web-resource-name>

<url-pattern>/member/*</url-pattern>

</web-resource-collection>

  <auth-constraint>

  <role-name>member</role-name>

  </auth-constraint>

</security-constraint>

<!-- Configure form authentication -->

<login-config>

  <auth-method>FORM</auth-method>

  <form-login-config>

  <form-login-page>/pages/login.xhtml</form-login-page>

  <form-error-page>/pages/login-error.xhtml</form-error-page>

  </form-login-config>

</login-config>

<!-- Define application roles -->

<security-role>

  <role-name>admin</role-name>

</security-role>

<security-role>

  <role-name>member</role-name>

</security-role>

<security-role>

  <role-name>guest</role-name>

</security-role>

But this JEE Security xml code does not work if not configured properly (of course).

What is the best way to implement this using PicketLink? Is it to integrate JEE Security somehow? Am I suppose to do like the SSO examples? Although I do not need SSO. Should I still implement SSO just for this feature?

Or is there some way to use the PicketLink Authentication Filter to solve the same problem? Like this question: http://stackoverflow.com/questions/24657169/how-to-customize-picketlink-authenticationfilter

I hope you understand my usecase, I guess it is quite common. Please ask me otherwise and I will try to explain it better.

Thank you for answering in advance!
/Susanne

[pcraveiro]

Hi Susanne,   

    Unfortunately, we don't provide a OOTB solution for that yet. We're working in a design to provide Servlet Security for CDI applications. I would suggest you to write your own filter and use what PicketLink already provide to check for roles and groups.

    Please, give us some more time and we'll get this done

Thanks.

[pcraveiro]

Hey Susanne,

    PicketLink 2.7.0.Beta1 is going to provide Http Security. In your case, RBAC for urls will be supported OOTB and fully integrated with PicketLink Identity management and CDI.

    Release is going to happen next week.

Regards.