Return-Path: 
 <dev-return-86016-apmail-geronimo-dev-archive=geronimo.apache.org@geronimo.apache.org>
Delivered-To: apmail-geronimo-dev-archive@www.apache.org
Received: (qmail 15187 invoked from network); 26 Sep 2010 08:49:56 -0000
Received: from unknown (HELO mail.apache.org) (140.211.11.3)
  by 140.211.11.9 with SMTP; 26 Sep 2010 08:49:56 -0000
Received: (qmail 13462 invoked by uid 500); 26 Sep 2010 08:49:56 -0000
Delivered-To: apmail-geronimo-dev-archive@geronimo.apache.org
Received: (qmail 13214 invoked by uid 500); 26 Sep 2010 08:49:53 -0000
Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:dev-help@geronimo.apache.org>
list-unsubscribe: <mailto:dev-unsubscribe@geronimo.apache.org>
List-Post: <mailto:dev@geronimo.apache.org>
Reply-To: dev@geronimo.apache.org
List-Id: <dev.geronimo.apache.org>
Delivered-To: mailing list dev@geronimo.apache.org
Received: (qmail 13207 invoked by uid 99); 26 Sep 2010 08:49:53 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 26 Sep 2010 08:49:53 +0000
X-ASF-Spam-Status: No, hits=-2000.0 required=10.0
	tests=ALL_TRUSTED
X-Spam-Check-By: apache.org
Received: from [140.211.11.22] (HELO thor.apache.org) (140.211.11.22)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 26 Sep 2010 08:49:52 +0000
Received: from thor (localhost [127.0.0.1])
	by thor.apache.org (8.13.8+Sun/8.13.8) with ESMTP id o8Q8nW7j000762
	for <dev@geronimo.apache.org>; Sun, 26 Sep 2010 08:49:32 GMT
Message-ID: <7410674.405811285490972408.JavaMail.jira@thor>
Date: Sun, 26 Sep 2010 04:49:32 -0400 (EDT)
From: "Ivan (JIRA)" <jira@apache.org>
To: dev@geronimo.apache.org
Subject: [jira] Assigned: (GERONIMO-5578) incorrect behaviour of
 security-constraint configuration in web.xml
In-Reply-To: <6012449.57521283879494327.JavaMail.jira@thor>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


     [ https://issues.apache.org/jira/browse/GERONIMO-5578?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ivan reassigned GERONIMO-5578:
------------------------------

    Assignee: Ivan  (was: Han Hong Fang)

> incorrect behaviour of security-constraint configuration in web.xml 
> --------------------------------------------------------------------
>
>                 Key: GERONIMO-5578
>                 URL: https://issues.apache.org/jira/browse/GERONIMO-5578
>             Project: Geronimo
>          Issue Type: Bug
>      Security Level: public(Regular issues) 
>          Components: Tomcat
>    Affects Versions: 3.0
>            Reporter: Han Hong Fang
>            Assignee: Ivan
>         Attachments: GERONIMO-5578.patch, web7.xml
>
>
> When have following configuration in web.xml, GET and POST can be accessed by both "RoleA" and "RoleB".
> <security-constraint>
>         <web-resource-collection>
>             <web-resource-name>resource2</web-resource-name>
>             <url-pattern>/SampleServlet2</url-pattern>
>             <http-method>GET</http-method>
>         </web-resource-collection>
>         <auth-constraint>
>             <role-name>RoleA</role-name>
>         </auth-constraint>
>     </security-constraint>
>     
>     <security-constraint>
>         <web-resource-collection>
>             <web-resource-name>resource3</web-resource-name>
>             <url-pattern>/SampleServlet2</url-pattern>
>             <http-method>POST</http-method>
>         </web-resource-collection>
>         <auth-constraint>
>             <role-name>RoleB</role-name>
>         </auth-constraint>
>     </security-constraint>

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.