Java Reference
In-Depth Information
</auth-constraint>
</security-constraint>
Form-based login is specified for all web pages under
/admin
. Access to those
pages will be allowed only to users in the
ADMINS
role.
7. Assign security roles to users or groups of users in the realm.
To assign a security role to a group or to a user, add a
security-role-map-
ping
element to the application server-specific deployment descriptor, in this case
glassfish-web.xml
:
<security-role-mapping>
<role-name>USERS</role-name>
<group-name>USERS</group-name>
</security-role-mapping>
<security-role-mapping>
<role-name>ADMINS</role-name>
<group-name>ADMINS</group-name>
</security-role-mapping>
Since GlassFish Server users are assigned to groups during the user creation pro-
cess, this is more efficient than mapping security roles to individual users.
Securing HTTP Resources
When a request URI is matched by multiple constrained URL patterns, the constraints that
apply to the request are those that are associated with the best matching URL pattern. The
servlet matching rules defined in
Chapter 12
, “Mapping Requests To Servlets,” in the Java
Servlet 3.0 Specification, are used to determine the best matching URL pattern to the re-
quest URI. No protection requirements apply to a request URI that is not matched by a
constrained URL pattern. The HTTP method of the request plays no role in selecting the
best matching URL pattern for a request.
When HTTP methods are listed within a constraint definition, the protections defined by
the constraint are applied to the listed methods only.
When HTTP methods are not listed within a constraint definition, the protections defined
by the constraint apply to the complete set of HTTP methods, including HTTP extension
methods.
When constraints with different protection requirements apply to the same combination of
URL patterns and HTTP methods, the rules for combining the protection requirements are
as defined in Section 13.8.1, “Combining Constraints,” in the Java Servlet 3.0 Specifica-
tion.
