JavaServer Pages, 3rd Edition

Controlling Access to Web Resources

All the authentication mechanisms described so far rely on two pieces of information: user definitions and information about the type of access control needed for the web application resources.

How users, and groups of users, are defined depends on the server you’re using. Some web servers, such as Microsoft’s Internet Information Server (IIS), can use the operating system’s user and group definitions. Others, such as the iPlanet Web Server (formerly Netscape Enterprise Server), let you use their own user directory or an external LDAP server. The security mechanism defined by the servlet specification describes how to specify the access-control constraints for a web application, but access is granted to a role instead of directly to a user or a group. Real user and group names for a particular server are mapped to the role names used in the application. How the mapping is done depends on the server, so you need to consult your web server and servlet container documentation if you use a server other than Tomcat.

By default, the Tomcat server uses a simple XML file to define users and assign them roles at the same time. The file is named tomcat-users.xml and is located in the conf directory. To run the examples in this chapter, you need to define at least two users and assign one of them the role admin and the other the role user, like this:

<tomcat-users> <user name="paula" password="boss" roles="admin" /> <user name="hans" password="secret" roles="user" ...