Re: filter-mapping

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============7473155274455213145==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="------------enigB6E594C4ACFE9903485D21B6"

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigB6E594C4ACFE9903485D21B6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Martin,

On 2/13/2009 2:53 PM, Martin Dubuc wrote:
> On Wed, Feb 11, 2009 at 3:36 PM, Christopher Schultz <chris@christopher=
schultz.net> wrote:
>>
>> Can you explain a little more about the CGI stuff? I don't see why
>> securityfilter would be interfering with your CGI scripts. Can you giv=
e
>> me some more details?
>=20
> I think I figured out what the problem is. The CGI scripts on my Web se=
rver
> were global to all applications. Is it possible that in that context wh=
en
> they are invoked, since they are not part of my application, the server=

> thinks it needs to authenticate the user once again, which triggers the=
 Web
> server to invoke the securityfilter? I solved my issue by moving the CG=
I
> scripts inside the application and now things are working as expected.

If your CGI scripts were deployed under another context, securityfilter
shouldn't have been involved at all. securityfilter will only be applied
to the URLs that are being served by the context (webapp) in which
securityfilter is configured. If you have multiple webapps, each with
securityfilter running, they don't communicate, so you'll have to
authentication separately for each one.

If you had your CGI scripts deployed into the ROOT application (that is,
the default app that is used if no other context prefixes match (like
/my-app), and you had securityfilter running both in the ROOT and some
other context (like /my-app), then you could be running into this
separate authentication problem.

>> Do you have container-managed security set up in Tomcat's server.xml a=
s
>> well as securityfilter? That might be confusing things. Remember that
>> securityfilter-config.xml should contain all your <security-constraint=
>
>> setup, and web.xml should have none of this stuff leftover. Otherwise,=

>> you'll have sf and Tomcat fighting each other.
>=20
>=20
> I am not sure if it makes any difference, but I had kept the security-r=
ole
> inside web.xml. I have since moved it into securityfilter-config.xml. I=
t
> doesn't seem to make a difference one way or another.

I don't believe <security-role> is enough to trigger the use of Tomcat's
container-managed authentication and authorization. I think you need
<security-constraint> in order for TC to start doing that. So, you
should be okay.

> Thanks for your help. It was important for me to be told that securityf=
ilter
> should be able to work with error handling and CGI emulation.

Yeah, securityfilter hardly does anything at all, really. If
authentication is necessary, it sends those requests to the login page.
Submitting the login page obviously invokes securityfilter to do the
authentication. After that, URLs are checked for authorization
requirements and 403 responses are sent for requests for which
authenticated users are not authorized.

There's no messing with headers, proxying of requests or anything like
that (except that, after successful authentication, the original request
that triggered the authentication is "re-played" back to the servlet
container). You should be able to wrap nearly everything to
securityfilter and it should work (relatively) transparently.

-chris


--------------enigB6E594C4ACFE9903485D21B6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkmV5KQACgkQ9CaO5/Lv0PAXuACeIwQ7WIcopkaZFTDyWtccw5yK
2wIAnjq/d0VANy8gZLK1jXV0WqUkeWsf
=TtaN
-----END PGP SIGNATURE-----

--------------enigB6E594C4ACFE9903485D21B6--


--===============7473155274455213145==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
--===============7473155274455213145==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
securityfilter-user mailing list
securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/securityfilter-user

--===============7473155274455213145==--