JavaServer Faces

Controlling Access to Web Resources

Combining the result of authentication with rules for what different users are allowed to see and do is called authorization. The most basic authorization rule—what type of users are allowed to access certain web resources—can be expressed in the web application deployment descriptor for a Java web application. Other rules can be implemented by the application code with the help of methods in the servlet API.

Both types of authorization require information about users and types of users. How users, and groups of users, are defined depends on the web container you’re using. Some containers use the operating system’s user and group definitions. Others have their own user directory or use an external LDAP server, or let you define this information in a database. The security mechanism defined by the servlet specification describes how to specify the access-control rules for web application resources in terms of roles. Real user and group names for a particular container are mapped to the role names used in the application. How the mapping is done depends on the container, so you need to consult the container documentation if you don’t use Tomcat.

Tomcat, by default, uses a simple XML file to define users and assign them roles at the same time. The file is named tomcat-users.xml and is located in the conf directory. To run the sample application, you must define at least two users like this:

<tomcat-users> <user name="hans" password="secret" roles="employee" ...