1

What's the difference between:

<auth-constraint><role-name>tomcat</role-name></auth-constraint>

and:

<security-role><role-name>tomcat</role-name></security-role>

in a security constraint declaration?

For example if I'm defining BASIC authentication as below, which should I use?

<login-config><auth-method>BASIC</auth-method></login-config>
kenorb
  • 155,785
  • 88
  • 678
  • 743
  • Does the first link on a [Google search](https://www.google.com/search?safe=off&es_sm=122&q=difference+between+auth-constraint+and+security-role) not address this properly? – LittleBobbyTables - Au Revoir Apr 10 '15 at 14:36
  • @LittleBobbyTables It could, but it's 8-years old and it doesn't address if I need both for BASIC authentication. Tested with Tomcat and it seems it require both to be defined, so I'm not quite understand why. – kenorb Apr 10 '15 at 14:46

1 Answers1

1

The fundamental difference is between the authentication mechanism which is addressed by auth-method - authentication is the means for an application to confirm "are you really who you say you are?" - authentication mechinisms can be of many types but there are some that are supported out of the box by a standard servlet container - one that you have pointed out is BASIC - which is what prompts a browser to prompt a dialogue box for logging in - this should ideally not be used in prod scenarios as it transfers your credentials in plain text to the server also it is not customizable in any browser that I know off. Typically in prod scenarios FORM is used along with setting up SSL at the server or other infrastructure layer. FORM is highly customizable and most popular when the out of the box feature of servlet web-container authentication is used.

The Role Name is an abstraction which will eventually be used by the application code to perform authorization. "Ok, so you are who you say you are, but are you allowed to access this page, button, or the web application?" - How the application handles this internally is not an ask here but there are Declarative (Annotation based) Servlet APIs and Server specific mappings are involved here. Here is a way to do so programmatically - How to get user roles in a JSP / Servlet

Community
  • 1
  • 1
Y123
  • 915
  • 13
  • 30