Re: Testing JSec?
Guillermo González de Agüero
Hi,
toggle quoted messageShow quoted text
Unfortunately this version of the spec didn't managed to implement the authorization part and basically only deals with authentication. However the Servlet spec has since the beginning the security-constraint element in the web.xml deployment descriptor. This is the only standard way to restrict role access to pages. You have some good information on the Java EE 7 tutorial: https://docs.oracle.com/javaee/7/tutorial/security-webtier002.htm Where restricing based on roles, note that there are two special built-in ones, "*" and "**": - * means any authenticated user which has at least one role, whatever it is, is granted access. - ** means any autenticated user, even users without roles. Regards, Guillermo González de Agüero
El mié., 9 de agosto de 2017 21:51, Saeed <sinaisix@...> escribió:
|
|