Hi to all,

I need to implement authentication and authorization in my portlets using JAAS. I am using JBoss Portlet Bridge 2.3.1, JSF 1.2, RichFaces 3.3.3, eXo Platform 3 (JBoss 5.1)

I did a test using a normal web application and everything worked perfectly. However I'm having problems to implement the same scenario with portlets, I read the portlet specification, examples and everything.

I put this in my portlet.xml:

<?xml version="1.0" encoding="UTF-8"?>

<portlet-app xmlns="http://java.sun.com/xml/ns/portlet/portlet-app_2_0.xsd"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xsi:schemaLocation="http://java.sun.com/xml/ns/portlet/portlet-app_2_0.xsd http://java.sun.com/xml/ns/portlet/portlet-app_2_0.xsd"

    version="2.0">

    <portlet>

        <portlet-name>RichFacesEchoPortlet</portlet-name>

        <portlet-class>javax.portlet.faces.GenericFacesPortlet</portlet-class>

        <init-param>

            <name>javax.portlet.faces.defaultViewId.view</name>

            <value>/pages/restrito/iprocess.xhtml</value>

        </init-param>

        <init-param>

            <name>javax.portlet.faces.preserveActionParams</name>

            <value>true</value>

        </init-param>

        <expiration-cache>-0</expiration-cache>

        <supports>

            <mime-type>text/html</mime-type>

            <portlet-mode>VIEW</portlet-mode>

        </supports>

        <portlet-info>

            <title>RichFaces Echo Portlet</title>

        </portlet-info>

    </portlet>

    <security-constraint id="minhaConstraint">

        <display-name>Portlets Restritos</display-name>

        <portlet-collection>

            <portlet-name>RichFacesEchoPortlet</portlet-name>

        </portlet-collection>

        <user-data-constraint>

            <transport-guarantee>CONFIDENTIAL</transport-guarantee>

        </user-data-constraint>

    </security-constraint>

...

And I put this in my web.xml:

<security-constraint id="SecurityConstraint_1">

        <web-resource-collection id="WebResourceCollection_1">

            <web-resource-name>Protected Area</web-resource-name>

            <url-pattern>/RichFacesEchoPortlet/*</url-pattern>

        </web-resource-collection>

        <auth-constraint id="AuthConstraint_1">

            <role-name>adm</role-name>

        </auth-constraint>

    </security-constraint>

<login-config>

        <auth-method>FORM</auth-method>

        <form-login-config>

            <form-login-page>/pages/login.xhtml</form-login-page>

            <form-error-page>/pages/login.xhtml</form-error-page>

        </form-login-config>

    </login-config>

    <security-role>

        <role-name>adm</role-name>

    </security-role>

But the portlet RichFacesEchoPorlet are being called without asking for login.

Can anyone give me any tips?