Testing Security wiki 2.5
"Claudia Frers" <[email protected]>
| Newsgroups | gmane.comp.java.jspwiki.user |
|---|---|
| Message-ID | <[email protected]> |
My aim is to allow anonymous and asserted users to view and comment all
pages.
Both blocks are identical and look like this one:
grant signedBy "jspwiki",
principal com.ecyrd.jspwiki.auth.authorize.Role "Asserted" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
"view,comment";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"editPreferences";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"editProfile";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
"login";
};
When I restart the container and my browser i get a login page and I am
informed that I am not authorized to view the main page. I have made no
other changes to the policy file and added no ACL's. I have only one
authorized user that is member of one group Admin.
If I login as ClaudiA AND add to Main:
[{ALLOW view Asserted,Authenticated}]
[{ALLOW comment Asserted,Authenticated}]
AND THEN LOG OUT the same occurs except that now I am not allowed as an
authenticated
user member of Admin to edit :-(
Question 1: Where did I go wrong? I expected to see the main page. I also
thought that policy file preceed and overule ACL's
Question 2: Are the role names hard coded or may they be changed? I am
assuming the first case is true.
Ok this must have something to do with only Admins being able to see Main
but
where is this coded in the policy file? Isn't this confusing for a novice?
:-)