17.4. Use Role-Based Security In Servlets

Procedure 17.2. Add Role-Based Security to Servlets

1. Add mappings between servlets and URL patterns.

   Use <servlet-mapping> elements in the web.xml to map individual servlets to URL patterns. The following example maps the servlet called DisplayOpResult to the URL pattern /DisplayOpResult.

   <servlet-mapping>
       <servlet-name>DisplayOpResult</servlet-name>
       <url-pattern>/DisplayOpResult</url-pattern>
   </servlet-mapping>		
   
   

2. Add security constraints to the URL patterns.

   To map the URL pattern to a security constraint, use a <security-constraint>. The following example constrains access from the URL pattern /DisplayOpResult to be accessed by principals with the role eap_admin. The role needs to be present in the security domain.

   <security-constraint>
   	<display-name>Restrict access to role eap_admin</display-name>
   	<web-resource-collection>
   		<web-resource-name>Restrict access to role eap_admin</web-resource-name>
   		<url-pattern>/DisplayOpResult/*</url-pattern>
   	</web-resource-collection>
   	<auth-constraint>
   		<role-name>eap_admin</role-name>
   	</auth-constraint>	
   </security-constraint>	
   
   <security-role>
     <role-name>eap_admin</role-name>
   </security-role>
   
   
   <login-config>
       <auth-method>BASIC</auth-method>
   </login-config>
   
   

   You need to specify the authentication method, which can be any of the following: BASIC, FORM, DIGEST, CLIENT-CERT, SPNEGO. This example uses BASIC authentication.

3. Specify the security domain in the WAR's jboss-web.xml

   Add the security domain to the WAR's jboss-web.xml in order to connect the servlets to the configured security domain, which knows how to authenticate and authorize principals against the security constraints. The following example uses the security domain called acme_domain.

   <jboss-web>
   	...
   	<security-domain>acme_domain</security-domain>
   	...
   </jboss-web>