Tomcat caching roles

[Santos, Paulo]

Just had a couple of questions related to roles and tomcat:

1. When a user logs in does tomcat cache the role?
   I've noticed that if I change a user's role without restarting tomcat
the user will still have the old role associated with them.

2. If tomcat does cache a user's role is there any way to disable the
caching and what may be potential risks of disabling it?

Thanks in advance for your time and any answers to these questions. 

Read further if you want some more details.

I have a web app that allows a system administrator to assign the roles
to the users. In some cases the role name is generated dynamically and
added to our database. We're using a database for authentication. When
the user, that was assigned a new role by the administrator, logs in
they still have the old roles associated with them. In this scenario the
roles were changed by the admin but tomcat was never restarted. If
tomcat is restarted after the new roles are applied then when the user
logs in they will have the new roles associated with them. 
I'd like to be able to change the roles for a user and the next time
they log in they get the new roles without having to restart tomcat. I'm
just trying to find out if it's possible.

Thanks again,

-Paulo

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

SSL login page question

[Santos, Paulo]

Hi,

 

I have a form based login page and I want to make sure that HTTPS is
always used when logging in. But the catch is that the URL the user is
trying to go to may not be using HTTPS but HTTP. We just want to make
sure that the user logs into the web app using SSL always. The security
constraint for the login page is CONFIDENTIAL.  Is there any way to
ensure that the user logs in using SSL even though the URL they want to
go to uses HTTP?

 

Thanks in advance I'd appreciate any help,

 

Paulo

 

Example:  

 

User wants to go to http://someHostName/index.jsp

 

The login page comes up.

 

The user logs in and goes to the URL listed above.

 

I need to make sure that the login name and password are encrypted when
they submit the login data.