在基于表单的身份验证中添加另一个角色

Question

我是初学者，正在学习基于表单的身份验证。到目前为止，我有我的 "admin" user/role 并且它工作得很好，但现在我想添加另一个权限有限的角色。我在网上搜索过，但教程只有管理员角色。我应该在 web.xml 文件中的什么地方添加角色？

当前 web.xml:

<security-constraint>
    <display-name>Security Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <url-pattern>/protected/*</url-pattern>
        <http-method>DELETE</http-method>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>PUT</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>manager</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Form-Based Authentication Area</realm-name>
    <form-login-config>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
</login-config>
<security-role>
    <description> An administrator </description>
    <role-name>manager</role-name>
</security-role>

我是否会添加另一个安全约束和另一个安全角色标签，或添加到它，或其他东西？

Answer 1

我又加了一个

<security-constraint> 标签指定不同的保护区，以及另一个

<security-role>指定角色。见下文：

<security-constraint>
    <display-name>Admin Security Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>Admin Area</web-resource-name>
        <url-pattern>/protected/*</url-pattern>
        <url-pattern>/admin/*</url-pattern>
        <http-method>DELETE</http-method>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>PUT</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>manager</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<security-constraint>
    <display-name>Regular User Security Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <url-pattern>/protected/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>employee</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Form-Based Authentication Area</realm-name>
    <form-login-config>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
</login-config>
<security-role>
    <description> An administrator </description>
    <role-name>manager</role-name>
</security-role>
<security-role>
    <description> A regular user </description>
    <role-name>employee</role-name>
</security-role>

在基于表单的身份验证中添加另一个角色

Adding another role in form based authentication

jsp

authorization

web.xml

roles