2

I'd like to protect a single .jsp-page from anonymous access. I'm trying to do that the following way:

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>
t-webapp</display-name>
<servlet>
<servlet>
    <description>
    </description>
    <display-name>
    ZServlet</display-name>
    <servlet-name>ZServlet</servlet-name>
    <servlet-class>
    a.b.c.d.application.t.ZServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>ZServlet</servlet-name>
    <url-pattern>/ZServlet</url-pattern>
</servlet-mapping>
<welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
</welcome-file-list>
<security-constraint>
    <display-name>
    TTests</display-name>
    <web-resource-collection>
        <web-resource-name>TTests</web-resource-name>
        <url-pattern>/ttests.jsp</url-pattern>
        <http-method>GET</http-method>
        <http-method>PUT</http-method>
        <http-method>HEAD</http-method>
        <http-method>TRACE</http-method>
        <http-method>POST</http-method>
        <http-method>DELETE</http-method>
        <http-method>OPTIONS</http-method>
    </web-resource-collection>
    <auth-constraint>
        <description>
        TServletRoles</description>
        <role-name>role_admin1</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>
<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
        <form-login-page>/login.html</form-login-page>
        <form-error-page>/error.html</form-error-page>
    </form-login-config>
</login-config>
<security-role>
    <description>
    role_admin1</description>
    <role-name>role_admin1</role-name>
</security-role>

But whenever I'm accessing ttests.jsp, I'm getting access immediately - without having to fill username/password... what am I missing?

Thanks a lot!

2
  • 1
    is security enabled on your was profile?
    – svachon
    Feb 21, 2011 at 16:37
  • I just wanted to write the answer: enable global security in the admin console... wow... that's it... thanks for your response (if you write an "official" answer, I will accept it as solution)
    – swalkner
    Feb 21, 2011 at 16:58

1 Answer 1

4

The first step would be to make sure that global security is enabled on your websphere profile with the Enable application security check box checked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.