-Type
> Access-Control-Request-Method Access-Control-Request-Headers
>
>
>
> I know that I can replace that list by using the filter parameter
> "cors.allowed.headers" and specify my own list of headers. I know
> that. But I have the following questions:
>
&
Hi,
Tomcat brings a special filter that implements the CORS specification. In
this filter, the default list of allowed headers is the following:
Origin
Accept
X-Requested-With
Content-Type
Access-Control-Request-Method
Access-Control-Request-Headers
I know that I can replace that
er.checkPermission(SecurityManager.java:549)
> at java.lang.Thread.setContextClassLoader(Thread.java:1368)
> at
> org.apache.catalina.core.StandardHostValve.event(StandardHostValve.java:174)
> at org.apache.catalina.valves.ValveBase.event(ValveBase.java:200)
&g
Server.stop(StandardServer.java:744)
at org.apache.catalina.startup.Catalina.stop(Catalina.java:633)
at
org.apache.catalina.startup.Catalina$CatalinaShutdownHook.run(Catalina.java:676)
Thanks in advance.
--
View this message in context:
http://www.nabble.com/Tomcat-Access-Control
er will have to access a given object?
>
> I've got the authentication part going with no trouble, but am having
> trouble with the access control side of things.
>
> TIA!
> Dave
>
>
>
> -
> T
.
The spec defines role based access control; the majority of your
problem can be resolved by configuring a Realm and your app so that
restrictions can be applied on a URL by URL basis.
In addition to the response I just posted, this app only has about 5
different url's (.jsp's), only
Sounds like the long route to a solution.
The spec defines role based access control; the majority of your
problem can be resolved by configuring a Realm and your app so that
restrictions can be applied on a URL by URL basis.
In addition to the response I just posted, this app only has abou
Sounds like the long route to a solution.
The spec defines role based access control; the majority of your
problem can be resolved by configuring a Realm and your app so that
restrictions can be applied on a URL by URL basis.
All of this can be done without having to use 'java.sec
route to a solution.
The spec defines role based access control; the majority of your
problem can be resolved by configuring a Realm and your app so that
restrictions can be applied on a URL by URL basis.
In addition to the response I just posted, this app only has about 5
different url
route to a solution.
The spec defines role based access control; the majority of your
problem can be resolved by configuring a Realm and your app so that
restrictions can be applied on a URL by URL basis.
All of this can be done without having to use 'java.security.acl', but
with the
solution.
The spec defines role based access control; the majority of your problem
can be resolved by configuring a Realm and your app so that restrictions
can be applied on a URL by URL basis.
All of this can be done without having to use 'java.security.acl', but
with the facilities provi
...
There isn't a standard way of doing programmatical security of this
nature - the nature of it is such that you have to write it yourself.
That is essentially what I'm trying to do, using various built-in tools
, such as java.security.acl.*, sun.security.acl.AclImpl,
sun.security.acl.Acl
d/write, administration vs general
user, etc) that a given user will have to access a given object?
I've got the authentication part going with no trouble, but am
having trouble with the access control side of things.
TIA!
Dave
---
or email and destroy the original
message without making a copy. Thank you.
- Original Message - From: "David Kerber"
<[EMAIL PROTECTED]>
To: "Tomcat Users List"
Sent: Tuesday, May 08, 2007 10:25 AM
Subject: ACL (access control list) tutorial or example
I posted thi
--- Original Message - From: "David Kerber" <[EMAIL PROTECTED]>
To: "Tomcat Users List"
Sent: Tuesday, May 08, 2007 10:25 AM
Subject: ACL (access control list) tutorial or example
I posted this on comp.lang.java.security yesterday, but haven't
gotten a single answ
l Message - From: "David Kerber" <[EMAIL PROTECTED]>
To: "Tomcat Users List"
Sent: Tuesday, May 08, 2007 10:25 AM
Subject: ACL (access control list) tutorial or example
I posted this on comp.lang.java.security yesterday, but haven't
gotten a single answer, so I&#
.
- Original Message -
From: "David Kerber" <[EMAIL PROTECTED]>
To: "Tomcat Users List"
Sent: Tuesday, May 08, 2007 10:25 AM
Subject: ACL (access control list) tutorial or example
I posted this on comp.lang.java.security yesterday, but haven't gotten a
s
g with no trouble, but am having
trouble with the access control side of things.
TIA!
Dave
-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
for the user password authentication but still use my JDBCRealm
>> for access control through roles. I was hoping you could point me in the
>> right direction. I am running on Solaris 9, java 1.5.0_10 with tomcat
>> 5.5.17
>>
>> I really appreciate any help you could give me!
&g
Workman, Joe wrote:
> I have an application that runs on tomcat that by default uses a
> JDBCRealm to query a database for authentication. I would like to use
> Kerberos for the user password authentication but still use my JDBCRealm
> for access control through roles. I was hoping you
I have not seen any response to this . . . . Can anyone help? Please?!?
Cheers
Joe
From: Workman, Joe
Sent: Friday, December 15, 2006 12:30 PM
To: 'users@tomcat.apache.org'
Subject: Using 2 Realms for authentication and access control
I have an a
I have an application that runs on tomcat that by default uses a
JDBCRealm to query a database for authentication. I would like to use
Kerberos for the user password authentication but still use my JDBCRealm
for access control through roles. I was hoping you could point me in the
right direction
Hi every one,
I want to control access to my application running on tomcat by Host names,
I tried the class
"org.apache.catalina.valves.RemoteHostValve" in the following manner
I know that it takes a regular expression in the allow values, so I use (\.)
to represent the dot(.) and
>
> From: "Zohar" <[EMAIL PROTECTED]>
> Date: 2006/04/06 Thu AM 11:46:27 EDT
> To: "Tomcat Users List" ,
>
> Subject: Re: access control
>
> Can I grant access to some jsp pages and deny access to others (in the same
> context)?
&g
Can I grant access to some jsp pages and deny access to others (in the same
context)?
- Original Message -
From: "Markus Schönhaber" <[EMAIL PROTECTED]>
To: "Tomcat Users List"
Sent: Thursday, April 06, 2006 17:23
Subject: Re: access control
Zohar wro
Zohar wrote:
> They used to be all "interface" servlets, but then I unified all external
> interface access into one simple servlet that forwards the request to the
> appropriate service. This way it should be easier to control the access to
> that context (e.g., protect it with a password, deny ac
"internal"
services, etc.). The "internal" contexts also provide service to other
internal servers.
- Original Message -
From: "Markus Schönhaber" <[EMAIL PROTECTED]>
To: "Tomcat Users List"
Sent: Thursday, April 06, 2006 17:23
Subject: R
Zohar wrote:
> I have a few servlets which are deployed to different contexts (each
> servlet to its own context). One of these servlets acts as an interface to
> clients, and it forwards the requests from clients to the appropriate
> servlets. I don't want any of the non-interface servlets to be a
Hello list,
I have a few servlets which are deployed to different contexts (each servlet to
its own context).
One of these servlets acts as an interface to clients, and it forwards the
requests from clients to the appropriate servlets.
I don't want any of the non-interface servlets to be accessib
over development of an existing Tomcat web application.
There is already an application level scheme for authenticating users
via a login page and stored login/password in a relational database.
However, access control was poorly implemented across the JSP's.
I cannot use JDBCRealm without m
added this to slapd.conf
access to *
by anonymous auth
by users read
Because I don't want to let anonymous users query ldap.
Now when I login, I get http status 403 (access denied).
Without ldap access control set, request.getUserPrincipal() prints
this: GenericPrincipal[gary
slapd.conf
access to *
by anonymous auth
by users read
Because I don't want to let anonymous users query ldap.
Now when I login, I get http status 403 (access denied).
Without ldap access control set, request.getUserPrincipal() prints
this: GenericPrincipal[gary(member,)]
32 matches
Mail list logo
