0 Replies Latest reply on Nov 23, 2005 12:07 PM by ittay

    using LdapLoginModule with no roles in ldap

    ittay Newbie

      hi,

      i want to use the LdapLoginModule, but not to get roles from ldap. The problem I have that while the user is authenticated fine, it fails to be authorized against the security constraints in web.xml.

      i have a <security-constraint> with <web-resources-collections> i've tried not using <auth-constraint>, using an empty one and using one with an empty role. all fail

      the strangest failure is when there are no roles in <auth-constraint> i get a message:
      005-11-23 18:27:52,022 TRACE [JBossSecurityMgrRealm] (http-0.0.0.0-80-Processor2:) User: qrm is NOT authorized, requiredRoles=[], userRoles=[]

      seems to me that if the requiredRoles are empty, the user should be authorized.

      i'm using jboss 3.2.6

      thanx,
      ittay