Hi, all - found a weird security problem.
My arch:
- Red Hat 7.1, JDK 1.3.1, JBoss-2.4.3_Tomcat-3.2.3
- using a custom LoginModule we wrote
My app:
- .ear with one .war and a few ejb .jar's
- web.xml has these blocks in it:
...snip...
<servlet-mapping>
<servlet-name>BLAH</servlet-name>
<url-pattern>/BLAH/*</url-pattern>
</servlet-mapping>
...
<security-constraint>
<web-resource-collection>
<web-resource-name>MyApp</web-resource-name>
<url-pattern>/test/*</url-pattern>
<url-pattern>/BLAH/test/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>foobar</role-name>
</auth-constraint>
</security-constraint>
...snip...
Notice that the first url-pattern protected is just content, whereas the
second is a servlet with a specific pathInfo after it. What's good is
that both url-patterns are being protected (we're using BASIC
authentication just for now)...
Whichever url-pattern I hit first, I can see my LoginModule debug that
it's doing work, and surfing to any other page under that first
url-pattern incurs no more work in the LoginModule. *However*, then
surfing to a place underneath the second url-pattern causes the
LoginModule to reprocess. Since my browser is just re-broadcasting my
BASIC authentication, the user doesn't notice anything, BUT I'm worried
(performance-wise) about the LoginModule working again. It keeps
getting invoked after any surfing I do in the second url-pattern. Also,
it doesn't matter which url-pattern I authenticate to first; whichever
one prompted the login only calls the LoginModule once whereas the
second one continuosly calls the LoginModule for every request. Why?
Any ideas?
Thanks,
David
_______________________________________________
JBoss-user mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-user
