Page security on ui pipeline

Hi,

is it possible, that the security constraint wasn't checked in the ui 
pipeline on added portlets?


I have defined a security contraint in page.security file:

<security-constraints-def name="MY_CONSTRAINT">
<security-constraint>
<roles>MY_ROLE</roles>
<permissions>view,edit</permissions>
</security-constraint>
</security-constraints-def>

The jetspeed-portlet.xml looks like this:

<portlet>
<portlet-name>MyPortlet</portlet-name>
<js:security-constraint-ref>MY_CONSTRAINT</js:security-constraint-ref>
</portlet>

If I remove the Role from my user, the portlet will not be shown in the 
toolbox, but it's always accessable on the already added portlet.

In Jetspeed 2.2.0 was checked this and the message "you have no 
permission for the portlet" was shown in the portlet.


kind regards,

Frank