Auth constraint that requires a valid user, but does not require any particular role

[jakartaee]

Auth constraint that requires a valid user, but does not require any particular role

[glassfishrobot]

• Issue Imported From: https://github.com/javaee/servlet-spec/issues/34
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @shingwaichan
• Original Issue Closed By:@glassfishrobot

[glassfishrobot]

@glassfishrobot Commented
Reported by elygre

[glassfishrobot]

@glassfishrobot Commented
@shingwaichan said:
According to JSR 115 MR2, "*" means all the roles defined for the web app.
It is not any users there.

[glassfishrobot]

@glassfishrobot Commented
elygre said:
Shing Wai Chan Yes, that is correct. This issue is an enhancement request for a new auth-constraint that does not require roles, but instead just requires any valid user.

The use case is very common. As show above, the google app-engine deviates from the servlet spec and redefines this aspect of web.xml to support the use case. That should be a strong argument that there is a market requirement.

[glassfishrobot]

@glassfishrobot Commented
@shingwaichan said:
"*" is for any roles rather than users as defined in JSR 115.
We need to investigate a backward compatible solution.

One way to achieve this is to have the realm to add a universal role to any authenticated users. This is how GlassFish resolve this issue.
You can find more details in
https://blogs.oracle.com/swchan/entry/assign_groups

[glassfishrobot]

@glassfishrobot Commented
elygre said:
I totally agree that we need a backward compatible solution. The jira issue does not suggest using the role name "*" at all, but clearly states that this "conflicts with the current spec", and suggests that something else is needed, "maybe the something like this would work":

<auth-constraint anyAuthenticatedUserAllowed="true" />

The GlassFish solutions is interesting. I would hope for a servlet-level solution (which would then be supported by all appservers), but at least it serves to further validate the requirement

[glassfishrobot]

@glassfishrobot Commented
@shingwaichan said:
A special role "**" is added to achieve this in the spec.
Please see section 13.3 of the Servlet 3.1 PFD for details.

[glassfishrobot]

@glassfishrobot Commented
@shingwaichan said:
See also section 13.4.1.3 in Servlet 3.1 PFD.

[glassfishrobot]

@glassfishrobot Commented
This issue was imported from java.net JIRA SERVLET_SPEC-34

[glassfishrobot]

@glassfishrobot Commented
Marked as fixed on Thursday, February 28th 2013, 4:29:20 pm