Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <49A725DE.1040801@apache.org>
Date: Thu, 26 Feb 2009 23:29:34 +0000
From: Mark Thomas <markt@apache.org>
User-Agent: Thunderbird 2.0.0.19 (Windows/20081209)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: Request not forwarded to login page with
 		security-constraintafter
 session time-out
References: <BDA447EF-42FA-4EF8-A54B-6A514D0D0649@frightanic.com>
 			<a2d59f0d0902260659g49e95fe2s10cb584c4405e0f6@mail.gmail.com>
 			<49A6B367.6020006@frightanic.com>
 		<49A6E9DD.8020809@christopherschultz.net>
 		<28C96583-A5CA-4101-BFFC-6F38101F50FA@frightanic.com>
 		<0AAE5AB84B013E45A7B61CB66943C17215B85F79D0@USEA-EXCH7.na.uis.unisys.com>
 	<49A70B52.6030706@apache.org>
 	<0AAE5AB84B013E45A7B61CB66943C17215B85F7DF4@USEA-EXCH7.na.uis.unisys.com>
 <49A71B3B.5080505@apache.org>
 <0AAE5AB84B013E45A7B61CB66943C17215B85F7E7E@USEA-EXCH7.na.uis.unisys.com>
In-Reply-To: 
 <0AAE5AB84B013E45A7B61CB66943C17215B85F7E7E@USEA-EXCH7.na.uis.unisys.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Caldarale, Charles R wrote:
>> From: Mark Thomas [mailto:markt@apache.org]
>> Subject: Re: Request not forwarded to login page with
>> security-constraintafter session time-out
>>
>> If "*" is all roles defined and you have no roles
>> defined then you are basically preventing anyone
>> from accessing that resource
> 
> That's not quite what it says.  The actual wording:
> 
> "The special role name "*" is a shorthand for all role names defined in the deployment descriptor.  An authorization constraint that names no roles indicates that access to the constrained requests must not be permitted under any circumstances."

I think the current implementation follows from that. "*" is all roles
defined. If there no roles defined then the auth constraint names no
roles and all users are blocked.

> In the OP's case, the authorization constraint does name roles, albeit just the shorthand version.

"*" makes no sense in
<security-role><role-name>*</role-name></security-role>

I suspect what Tomcat is doing is creating a role named "*". Since no
user has been assigned to that role, no user is permitted access.

What the spec is not explicit about is the combination of "*" with an
empty or non-existant <security-role> list.

I think it is quite clear. It means no-one gets access.

The OP (and others) have interpreted the "*" and no <security-role> list
to indicate no roles are needed for authorization.

Indeed. So did Tomcat for many versions.

For all we know, the intent of the spec writers may have been to allow that.

I know that that was not the intent. The current behaviour was the intent.

Mark


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org