Authentication and Roles - case sensitivity

[Raible, Matt]

I have the following security role in my web.xml file:

    <security-role>
        <description>Role to allow authentication</description>
        <role-name>Administrator</role-name>
    </security-role>

In my JDBCRealm, I have role_name defined for the user as:

    USERID                      ROLENAME
    ---------------------------------
    tomcat                      ADMINISTRATOR


You can see that the role's case does not match.  If I add the following to
one of my filters:

        log.debug("isUserInRole('Administrator'): " +
request.isUserInRole("Administrator"));
        log.debug("isUserInRole('administrator'): " +
request.isUserInRole("administrator"));
        log.debug("isUserInRole('ADMINISTRATOR'): " +
request.isUserInRole("ADMINISTRATOR"));

I get:

isUserInRole('Administrator'): false
isUserInRole('administrator'): false
isUserInRole('ADMINISTRATOR'): true

The reason I ask this is b/c I'm developing a menu application that filters
on roles and hides/shows menus based on a role name.  What should I do to
mimic Tomcat's behavior?  Should I do an toUpperCase on the rolename and
database role?  

What does Tomcat do?

Thanks,

Matt



---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]