Re: Error matching patterns problem-solved, maybe [OT] cooperation with struts question

I am glad you found a solution to the first problem.

If the browser makes a request for a protected resource (as a result of a
redirect or clicking on a link, etc.) it should invoke the login sequence if
you aren't authenticated, or give a 403 error if you are authenticated but
don't have the required role. I am not really sure what is happening with
the Struts app. Without explicitly protecting /admin/* with securityfilter
Struts has no way to invoke the login sequence on its own, but it sounds
like you have both protected the url pattern with securityfilter and the
action with Struts, so I doubt that is the problem. Sometimes you can get
into some weird infinite redirect loops with various setups for the login
pages, etc.

Using curl or wget to inspect the responses carefully can be a useful method
for debugging what is happening in these circumstances. Here are some curl
commands I use to debug problems on one of our apps. The first one logs the
user in, and the second makes a request for some page. Both save/use cookies
from a cookies.txt file and save the response in output.txt. You might wish
to do skip the login for debugging your current issue, but being able to
login is very useful for other stuff:

curl -c cookies.txt -b cookies.txt -o output.txt -d
"j_username=username&j_password=password"
http://localhost:8080/j_security_check

curl -b cookies.txt -c cookies.txt -o output.txt
http://localhost:8080/admin/index.do

Try this second one (you won't be authenticated since there will be no
session cookie in cookies.txt) and see what you get back. It should be a
redirect to the login page if the url pattern is protected by
securityfilter.

Remember that the sub-apps or modules (not sure what the current name is)
are purely a Struts abstraction -- there can only be one
securityfilter-config.xml for the whole web app, no matter how many Struts
modules it is comprised of. And all the url-patterns in it will be resolved
relative to the context path of the web app (which I think is just / based
on your example -- the root context).

I looked back at your previous post -- you are using /admin/* as the
url-pattern to protect, right? /admin/index.do will not be protected if it
is still /admin/index.jsp, even if /admin/index.do forwards to
/admin/index.jsp. Forwards are not checked for security in the interest of
servlet spec 2.3 conformance (I think 2.4 adds a feature where you can turn
this on, but securityfilter doesn't support this yet).

Sorry to be long-winded; I hope some of that proves useful.

-Max

>
> I have another question:
>
> I user Struts 1.1 and the /admin/* module which is protected from the
> securityfilter to be accessible only for users in admin role.
>
> If I'm not logged in I cannot access the /admin/* module,
> but I don't get redirected to login or error page.
> The browser just waits on empty page
>
> In my struts-config.xml I define global forward that I use to swith to
> admin module
>
> <global-forwards>
>  <forward name="admin" contextRelative="true" path="/admin/index.do"
redirect="true" />
> </global-forwards>
>
> in struts-admin.xml i define action mapping forwarding to index.jsp
>     <action-mappings>
>         <action path="/index" forward="/index.jsp" />
>     </action-mappings>
>
> so when I use the http://localhost:8081/admin/index.do URL in my browser
> it waits on blank page.
>
> How can I define an error or other page so the user receives some info
> and doesn't just get a blank browser windows.
>
> I guess maybe this post is more for the struts-user mail list,
> but it is secutiryfilter related imho.
>
> Thanks again for the help!
>
> --
> Alexander Dimitrov
>
> Forrester: You're the man now, dog!
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>




-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com