Return-Path: <Bryan.Basham@central.sun.com>
Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Delivered-To: mailing list tomcat-user@jakarta.apache.org
Received: (qmail 853 invoked from network); 28 Sep 2000 16:54:51 -0000
Received: from mercury.sun.com (192.9.25.1)
  by locus.apache.org with SMTP; 28 Sep 2000 16:54:51 -0000
Received: from amon.Central.Sun.COM ([129.147.4.240])
	by mercury.Sun.COM (8.9.3+Sun/8.9.3) with ESMTP id JAA13903
	for <tomcat-user@jakarta.apache.org>; Thu, 28 Sep 2000 09:54:43 -0700 (PDT)
Received: from basham (basham [129.147.48.71])
	by amon.Central.Sun.COM (8.9.3+Sun/8.9.3/ENSMAIL,v1.7) with SMTP id KAA25853
	for <tomcat-user@jakarta.apache.org>; Thu, 28 Sep 2000 10:41:52 -0600 (MDT)
Message-Id: <200009281641.KAA25853@amon.Central.Sun.COM>
Date: Thu, 28 Sep 2000 10:41:51 -0600 (MDT)
From: Bryan Basham <Bryan.Basham@central.sun.com>
Reply-To: Bryan Basham <Bryan.Basham@central.sun.com>
Subject: WAR security question
To: tomcat-user@jakarta.apache.org
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
Content-MD5: Qafrh83Tu75wjKjho2AW2Q==
X-Mailer: dtmail 1.2.1 CDE Version 1.2.1 SunOS 5.6 sun4u sparc 
X-Spam-Rating: locus.apache.org 1.6.2 0/1000/N

Here's my question in a nutshell:
When using HTTP-based authentication how does the developer
(or WAR deployer) configure the password of a given "security role"?

Details:
I am trying to test the HTTP authentication mechanisms.  I have a sample
Web application that has a simple servlet and I have created a security
role in the web.xml file:

    <secturity-role>
      <role-name>USER</role-name>
    </secturity-role>

I then added a security constraint:

    <security-constraint>
      <web-resource-collection>
        <web-resource-name>ProtectedResource</web-resource-name>
	<url-pattern>/message</url-pattern>
	<http-method>GET</http-method>
      </web-resource-collection>
      <auth-constraint>
        <role-name>USER</role-name>
      </auth-constraint>
    </security-constraint>

When I deploy this WAR and access this servlet, my browser prompts me
for a login/password.  I give the USER login, but I don't know what
password it will accept.  Shouldn't there be a field in the WAR Dep. Desc.
that specifies the password?

Thanks for your help,
Bryan


+---------------------------------------+--------------------------------------+
| Bryan Basham                          | "You are not an isolated entity, but
| Java Courseware Developer             |  a unique, irreplaceable part of the
| Sun Educational Services              |  cosmos.  Don't forget this.  You are
|   Phone: 1-303-272-8766  (x78766)     |  an essential piece of the puzzle of
|  E-mail: Bryan.Basham@Sun.COM         |  humanity."
| Address: 500 Eldorado Blvd            |
|          MailStop: UBRM05-135         |  -- The Art of Living, Epictetus
|          Broomfield, CO 80021         |     (trans. Sharon Lebell)
+---------------------------------------+--------------------------------------+