Re: keeps redirecting to logon page....
Jason Lea <[email protected]> Sat, 09 Aug 2003 17:46:31 +1200
| Newsgroups | gmane.comp.java.securityfilter.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Rubens, I think I have an idea why you are being thrown back to the logon page. Your 'Security 1' constraint might be causing the problem. It isn't needed. Here is my guess at what is happening: 1. You go to the logon.jsp page to authenticate. 2. logon.jsp is under the security contraint 'Security 1' which has the following: > <auth-constraint> > <role-name>*</role-name> > </auth-constraint> This means the user must be authenticated before they can access this resource. SecurityFilter would then redirect you to the <form-login-page> which is also login.jsp. SecurityFilter would also record this as the original request location, so that after authenticating it can redirect you back there. 3. You enter username/password and atre authenticated. 4. You are redirected to the original request location = logon.jsp If you remove the 'Security 1' security-constraint then you will be sent to the <form-default-page> because there is no original request location stored. --jason Rubens Carlos de Souza Gomes wrote: > I am using JDBCRealm on Tomcat 4 along with Struts and security filter. > When after passing thru the logon page, I try to access a link in the > /secure area the server redirects to the logon page. I had this problem > when using container management security, and then I switched to using the > security filter. But the same problem remains. Can someone check my > configurations below for any potential problems? Do I need to implement any > code to make security management to work? > > <?xml version="1.0" encoding="ISO-8859-1"?> > <!-- > Author : Rubens S. Gomes > Date : $Date: 2003/08/07 16:30:57 $ (UTC - Greenwich Mean Time) > File : web.xml > Revision : $Revision: 1.13 $ > > Purpose : > Web NMS Application deployment descriptor. > original path: <container>/webapps/webnms/WEB-INF/web.xml > > Limitations: > Written and tested on Tomcat running on Sun UNIX Solaris > > ident "@(#)$Id: web.xml,v 1.13 2003/08/07 16:30:57 rgomes Exp $" > --> > > <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application > 2.3//EN" > "http://java.sun.com/dtd/web-app_2_3.dtd"> > > <web-app> > > <display-name>Web NMS Application Portal</display-name> > <description> > Web based NMS Application Portal to run several internal applications. > </description> > > <!-- Parameters for the application --> > <context-param> > <param-name>timezone</param-name> > <param-value>America/Sao_Paulo</param-value> > </context-param> > > <!-- Filtering --> > <filter> > <filter-name>Security Filter</filter-name> > <filter-class>org.securityfilter.filter.SecurityFilter</filter-class> > <init-param> > <param-name>security-config</param-name> > <param-value>/WEB-INF/securityfilter-config.xml</param-value> > <description>Security Configuration File</description> > </init-param> > <init-param> > <param-name>validate</param-name> > <param-value>true</param-value> > <description>Validate config file if set to true</description> > </init-param> > </filter> > > <!-- map all requests to the SecurityFilter, control what it does with > configuration settings --> > <filter-mapping> > <filter-name>Security Filter</filter-name> > <url-pattern>/*</url-pattern> > </filter-mapping> > > <!-- Struts Servlet Configuration --> > <servlet> > <servlet-name>action</servlet-name> > <display-name>action</display-name> > <description>Struts Action Servlet</description> > <servlet-class>org.apache.struts.action.ActionServlet</servlet-class> > <init-param> > <param-name>application</param-name> > > <param-value>diveo.nms.webclient.locale.ApplicationResources</param-value> > </init-param> > <init-param> > <param-name>config</param-name> > <param-value>/WEB-INF/struts-config.xml</param-value> > </init-param> > <init-param> > <param-name>debug</param-name> > <param-value>1</param-value> > </init-param> > <init-param> > <param-name>detail</param-name> > <param-value>1</param-value> > </init-param> > <load-on-startup>2</load-on-startup> > </servlet> > > <!-- Action Servlet Mapping --> > <servlet-mapping> > <servlet-name>action</servlet-name> > <url-pattern>*.do</url-pattern> > </servlet-mapping> > > <!-- Session Timeout --> > <session-config> > <session-timeout>15</session-timeout> <!-- 15 minutes --> > </session-config> > > <!-- Welcome file list --> > <welcome-file-list> > <welcome-file>logon.jsp</welcome-file> > </welcome-file-list> > > <!-- Error Pages --> > <error-page> > <error-code>400</error-code> > <location>/400.jsp</location> > </error-page> > <error-page> > <error-code>403</error-code> > <location>/403.jsp</location> > </error-page> > <error-page> > <error-code>404</error-code> > <location>/404.jsp</location> > </error-page> > <error-page> > <error-code>500</error-code> > <location>/500.jsp</location> > </error-page> > <error-page> > <error-code>503</error-code> > <location>/503.jsp</location> > </error-page> > > <!-- Tag Library --> > <taglib> > <taglib-uri>/WEB-INF/struts-bean.tld</taglib-uri> > <taglib-location>/WEB-INF/struts-bean.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/struts-tiles.tld</taglib-uri> > <taglib-location>/WEB-INF/struts-tiles.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/struts-html.tld</taglib-uri> > <taglib-location>/WEB-INF/struts-html.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/struts-logic.tld</taglib-uri> > <taglib-location>/WEB-INF/struts-logic.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/struts-nested.tld</taglib-uri> > <taglib-location>/WEB-INF/struts-nested.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/taglibs-datetime.tld</taglib-uri> > <taglib-location>/WEB-INF/taglibs-datetime.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/taglibs-session.tld</taglib-uri> > <taglib-location>/WEB-INF/taglibs-session.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/c.tld</taglib-uri> > <taglib-location>/WEB-INF/c.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/fmt.tld</taglib-uri> > <taglib-location>/WEB-INF/fmt.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/taglibs-log.tld</taglib-uri> > <taglib-location>/WEB-INF/taglibs-log.tld</taglib-location> > </taglib> > <taglib> > <taglib-uri>/WEB-INF/webnms.tld</taglib-uri> > <taglib-location>/WEB-INF/webnms.tld</taglib-location> > </taglib> > > <!-- JNDI name reference for the UserDAO Object Factory --> > <resource-env-ref> > <description>Object Factory for User DAO Instance</description> > <resource-env-ref-name>dao/UserDAOFactory</resource-env-ref-name> > > <resource-env-ref-type>diveo.nms.client.dao.user.UserDAO</resource-env-ref-t > ype> > </resource-env-ref> > > <!-- JNDI name reference for Oracle DB connection pool --> > <resource-ref> > <description>DB Connection</description> > <res-ref-name>jdbc/oracle</res-ref-name> > <res-type>javax.sql.DataSource</res-type> > <res-auth>Container</res-auth> > </resource-ref> > > </web-app> > > > > <?xml version="1.0" encoding="ISO-8859-1"?> > <!-- > Author : Rubens S. Gomes > Date : $Date: 2003/08/07 16:30:56 $ (UTC - Greenwich Mean Time) > File : securityfilter-config.xml > Revision : $Revision: 1.1 $ > > Purpose : > Security Filter configuration. > > Limitations: > Written and tested on Tomcat running on Sun UNIX Solaris > > ident "@(#)$Id: securityfilter-config.xml,v 1.1 2003/08/07 16:30:56 rgomes > Exp $" > --> > <!DOCTYPE securityfilter-config PUBLIC > "-//SecurityFilter.org//DTD Security Filter Configuration 1.0//EN" > "http://www.securityfilter.org/dtd/securityfilter-config_1_0.dtd"> > > <securityfilter-config> > > <security-constraint> > <display-name>Security 1</display-name> > <web-resource-collection> > <web-resource-name>encripted_area</web-resource-name> > <url-pattern>/logon.jsp</url-pattern> > <http-method>DELETE</http-method> > <http-method>GET</http-method> > <http-method>POST</http-method> > <http-method>PUT</http-method> > </web-resource-collection> > <auth-constraint> > <role-name>*</role-name> > </auth-constraint> > <user-data-constraint> > <transport-guarantee>CONFIDENTIAL</transport-guarantee> > </user-data-constraint> > </security-constraint> > > <security-constraint> > <display-name>Security 2</display-name> > <web-resource-collection> > <web-resource-name>secure_area</web-resource-name> > <url-pattern>/secure/*</url-pattern> > <http-method>DELETE</http-method> > <http-method>GET</http-method> > <http-method>POST</http-method> > <http-method>PUT</http-method> > </web-resource-collection> > <auth-constraint> > <role-name>ADMINISTRATOR</role-name> > <role-name>OPERATOR</role-name> > </auth-constraint> > <user-data-constraint> > <transport-guarantee>NONE</transport-guarantee> > </user-data-constraint> > </security-constraint> > > <login-config> > <auth-method>FORM</auth-method> > <form-login-config> > <form-login-page>/logon.jsp</form-login-page> > <form-error-page>/logon_error.jsp</form-error-page> > <form-default-page>/secure/index.jsp</form-default-page> > </form-login-config> > </login-config> > > <security-role> > <description>Administrator of the system</description> > <role-name>ADMINISTRATOR</role-name> > </security-role> > <security-role> > <description>All the operators</description> > <role-name>OPERATOR</role-name> > </security-role> > > <realm className="org.securityfilter.realm.catalina.CatalinaRealmAdapter" > /> > <realm className="org.apache.catalina.realm.JDBCRealm"> > <realm-param name="driverName" value="oracle.jdbc.driver.OracleDrive"/> > <realm-param name="debug" value="99"/> > <realm-param name="connectionURL" > value="jdbc:oracle:thin:@oracle.noc.spo.dcn:1521:NMSTEST"/> > <realm-param name="connectionName" value="nms"/> > <realm-param name="connectionPassword" value="nms"/> > <realm-param name="userTable" value="APPLICATION_USER"/> > <realm-param name="userNameCol" value="USER_ID"/> > <realm-param name="userCredCol" value="PASSWORD"/> > <realm-param name="userRoleTable" value="APPLICATION_USER_ROLE"/> > <realm-param name="roleNameCol" value="ID"/> > </realm> > > </securityfilter-config> > > <!-- > > Author : Rubens S. Gomes > Date : $Date: 2003/08/07 16:30:56 $ (UTC - Greenwich Mean Time) > File : webnms.xml > Revision : $Revision: 1.6 $ > Purpose : > Context configuration for the WebNMS front end system. > original path: <container>/webapps/webnms.xml > > Limitations: > Written and tested on Tomcat running on Sun UNIX Solaris > > ident "@(#)$Id: webnms.xml,v 1.6 2003/08/07 16:30:56 rgomes Exp $" > > --> > > <!-- ************************** --> > <!-- WebNMS Application Context --> > <!-- ************************** --> > > <Context path="/webnms" > docBase="webnms.war" > reloadable="true" > cookies="true" > debug="99" > useNaming="true" > workDir="/var/opt/webnms/work"> > > <Logger className="org.apache.catalina.logger.FileLogger" > verbosity="1" > directory="/var/opt/webnms/logs" > prefix="tomcat_webnms." suffix=".log" > timestamp="true"/> > > <!-- Database Realm --> > > <Realm className="org.apache.catalina.realm.JDBCRealm" > debug="99" > driverName="oracle.jdbc.driver.OracleDriver" > connectionURL="jdbc:oracle:thin:@oracle.noc.spo.dcn:1521:NMSTEST" > connectionName="nms" > connectionPassword="nms" > userTable="APPLICATION_USER" > userNameCol="USER_ID" > userCredCol="PASSWORD" > userRoleTable="APPLICATION_USER_ROLE" > roleNameCol="ID"/> > > <!-- JNDI User DAO Factory Resource --> > > <Resource name="dao/UserDAOFactory" > auth="Container" > type="diveo.nms.client.dao.user.UserDAO" > scope="shareable" > description="UserDAO Factory"/> > > <ResourceParams name="dao/UserDAOFactory"> > <parameter> > <name>factory</name> > <value>diveo.nms.client.dao.user.UserDAOFactory</value> > </parameter> > </ResourceParams> > > <!-- JNDI Oracle Database Resource --> > > <Resource name="jdbc/oracle" > auth="Container" > type="javax.sql.DataSource" > scope="shareable" > description="Database for WebNMS Application"/> > > <ResourceParams name="jdbc/oracle"> > <parameter> > <name>factory</name> > <value>org.apache.commons.dbcp.BasicDataSourceFactory</value> > </parameter> > <parameter> > <name>driverClassName</name> > <value>oracle.jdbc.driver.OracleDriver</value> > </parameter> > <parameter> > <name>url</name> > <value>jdbc:oracle:thin:@oracle.noc.spo.dcn:1521:NMSTEST</value> > </parameter> > <parameter> > <name>username</name> > <value>nms</value> > </parameter> > <parameter> > <name>password</name> > <value>nms</value> > </parameter> > <parameter> > <name>maxActive</name> > <value>50</value> > </parameter> > <parameter> > <name>maxIdle</name> > <value>10</value> > </parameter> > <parameter> > <name>maxWait</name> > <value>5</value> > </parameter> > <parameter> > <name>validationQuery</name> > <value>select sysdate from dual</value> > </parameter> > <parameter> > <name>defaultAutoCommit</name> > <value>true</value> > </parameter> > <parameter> > <name>removeAbandoned</name> > <value>true</value> > </parameter> > <parameter> > <name>removeAbandonedTimeout</name> > <value>60</value> > </parameter> > </ResourceParams> > > </Context> > ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01