Novell Access Manager 3.1 SP 2, Руководство пользователя, Страница: 71 / 126

Preparing the Applications and the J2EE Servers 71
n
ov
do
cx (e
n)
16
Ap
ril 20
10
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Content</web-resource-name>
<url-pattern>/protected/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>authenticated</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<description></description>
<role-name>authenticated</role-name>
</security-role>
The role must be declared with the
<security-role>
tags when it is used inside a security
constraint.
4.3 Configuring Applications on the WebSphere
Server
Š
Section 4.3.1, “Configuring for Authentication,” on page 71
Š
Section 4.3.2, “Configuring for RunAs Roles,” on page 71
Š
Section 4.3.3, “Configuring the Trust Association Interceptor Module for WebSphere
Application,” on page 73
4.3.1 Configuring for Authentication
You need to create policies that deny access to the anonymous user. You can do this either with the
web.xml
file within the
.war
file or with Access Manager policies. In Access Manager, you deny
access to the anonymous user by creating an authorization policy that denies access to anyone who
has not been assigned the
authenticated
role. Anonymous users who haven’t authenticated do not
have this role, and users who have authenticated to Access Manager are automatically assigned this
role.
If you have pages that call Enterprise JavaBeans that are protected, you should assign a policy to
these pages that denies access to users who have not authenticated.
4.3.2 Configuring for RunAs Roles
An Enterprise JavaBean deployment descriptor can state that an Enterprise JavaBean must run with
a particular role. The the sample application (
PayrollApp.ear
) includes such a statement in its
descriptor:
<security-identity>
<run-as>
<role-name>Manager</role-name>
</run-as>
</security-identity>
Without configuring WebSphere to map a RunAs role to a user, WebSphere ignores this statement. If
a user is mapped to a RunAs role, the agent cannot know which J2EE roles the user has unless the
role is also mapped.