Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I assume port <code>&lt;C&gt;</code> is HTTP and since you have configured <code>&lt;transport-guarantee&gt; CONFIDENTIAL &lt;/transport-guarantee&gt;</code> hence port <code>&lt;C&gt;</code> is blocked.</p> <p>Port <code>&lt;B&gt;</code> does uses SSL which satisfies <code>&lt;transport-guarantee&gt; CONFIDENTIAL &lt;/transport-guarantee&gt;</code> hence it is not blocked. </p> <p>.</p> <p>You are missing few elements in your web.xml configuration. You don't have any authorization constraints on your web resources. Hence when you access from port <code>&lt;B&gt;</code> even though you are not authneticated you are still authorized to access the resources as you have not put any auth-constraints on your resourses.</p> <p>You need to have list of <code>&lt;security-role&gt;</code> containing <code>&lt;role-name&gt;</code> that can access this application.</p> <p><code>&lt;security-constraint&gt;</code> for <code>&lt;web-resource-collection&gt;</code> should have <code>&lt;auth-constraint&gt;</code> telling which <code>&lt;role-name&gt;</code> to give access to and others will be restricted.</p> <p>The roles configured above are Java EE roles. <strong>The container (JBoss) needs to be configured to map authenticated roles to Java EE roles.</strong> </p> <p><strong>Reference:</strong> </p> <p><a href="http://java.sun.com/javaee/5/docs/tutorial/doc/bncbe.html" rel="nofollow noreferrer">http://java.sun.com/javaee/5/docs/tutorial/doc/bncbe.html</a></p> <p><a href="http://community.jboss.org/wiki/RoleMappingLoginModule" rel="nofollow noreferrer">http://community.jboss.org/wiki/RoleMappingLoginModule</a></p> <p>.</p> <p><strong>Updated copy of above web.xml</strong></p> <pre><code>&lt;!-- Force SSL for entire site as described here: http://wiki.metawerx.net/wiki/ForcingSSLForSectionsOfYourWebsite --&gt; &lt;security-constraint&gt; &lt;!-- defines resources to be protected (in this case everything)--&gt; &lt;web-resource-collection&gt; &lt;!-- name for the resource, can be anything you like --&gt; &lt;!-- Question: is this referenced anywhere else? --&gt; &lt;web-resource-name&gt; Entire Application &lt;/web-resource-name&gt; &lt;!-- protect the entire application --&gt; &lt;url-pattern&gt; /* &lt;/url-pattern&gt; &lt;/web-resource-collection&gt; &lt;auth-constraint&gt; &lt;description&gt;Authorized Roles&lt;/description&gt; &lt;role-name&gt;ALL_AUTHENTICATED&lt;/role-name&gt; &lt;/auth-constraint&gt; &lt;!-- defines protection level for protected resource --&gt; &lt;user-data-constraint&gt; &lt;!-- data cannot be observed or changed --&gt; &lt;!-- how it works in tomcat: --&gt; &lt;!-- if (set to integral or confidential &amp;&amp; not using ssl) --&gt; &lt;!-- redirect sent to client, redirecting them to same url --&gt; &lt;!-- but using the port defined in the redirect port --&gt; &lt;!-- attribute in the &lt;Connector&gt; element of server.xml --&gt; &lt;!-- default is 443, so in other words user is redirected --&gt; &lt;!-- to same page using ssl. --&gt; &lt;!-- BUT it is differnt for JBOSS!! See this link: http://wiki.metawerx.net/wiki/ForcingSSLForSectionsOfYourWebsite --&gt; &lt;transport-guarantee&gt; CONFIDENTIAL &lt;/transport-guarantee&gt; &lt;/user-data-constraint&gt; &lt;/security-constraint&gt; &lt;login-config&gt; &lt;!-- Client-side SSL certificate based authentication. The cert is passed to the server to authenticate --&gt; &lt;!-- I am pretty sure that CLIENT-CERT should have a dash NOT an underscore see: http://www.mail-archive.com/tomcat-user@jakarta.apache.org/msg139845.html --&gt; &lt;!-- CLIENT-CERT uses a client's AND server's certificates. See: http://monduke.com/2006/01/19/the-mysterious-client-cert/ --&gt; &lt;auth-method&gt; CLIENT-CERT &lt;/auth-method&gt; &lt;/login-config&gt; &lt;security-role&gt; &lt;description&gt;All authenticated users&lt;/description&gt; &lt;role-name&gt;ALL_AUTHENTICATED&lt;/role-name&gt; &lt;/security-role&gt; </code></pre> <p>.</p> <p>In security there are two things, authentication and authorization. </p> <p><strong>Authentication:</strong> the act of verifying that a user is a subject and granting the user certain principals; "who you are." </p> <p><strong>Authorization:</strong> the act of verifying that a user is allowed to access a certain resource; "what you may do." </p> <p><code>&lt;auth-method&gt;</code> tell how to authenticate a user or how to ask who you are. If user does not have client certificate, he is unauthenticated user. It does not tell what user can do.</p> <p>However <code>&lt;auth-constraint&gt;</code> is what you may do. If you put <code>&lt;auth-constraint&gt;</code>, then only roles mentioned in there can access the respective web resource. You could still have user who is not authenticated but is authorized to access certain resources if resources are not constrainted to certian roles.</p>
    singulars
    1. This table or related slice is empty.
    1. POChanges to JBoss web.xml have no effect
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USArjan Tijms
    1. USGladwin Burboz
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POChanges to JBoss web.xml have no effect
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTBountyClose
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    1. COHey Gladwin, thanks for the feed back. My assumption was that if I did not include roles the auth-method woudl apply to all of the roles. Is this assumption incorrect?
      singulars
      1. PO
      1. USsixtyfootersdude
    2. COI have updated my answer at the end to explain your doubts.
      singulars
      1. PO
      1. USGladwin Burboz
    3. CO>`The container (JBoss) needs to be configured to map authenticated roles to Java EE roles` - this is not entirely true. JBoss has never required role mapping and the entire process of role mapping is always server specific. It's true that (too) many servers require role mapping (even when it's completely unnecessary), but JBoss is not such a server.
      singulars
      1. PO
      1. USArjan Tijms
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload