1

我做了以下更改以在 tomcat 中实现声明性安全性（在 struts2 应用程序中）

我在 tomcat-users.xml 中添加了以下内容

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="Manager"/>
  <user username="manager1" password ="password1" roles="Manager"/>
</tomcat-users>

在我的 web.xml 中，我做了以下更改

<security-role>
  <role-name>Manager</role-name>
</security-role>
<login-config>
  <auth-method>BASIC</auth-method>
</login-config>  

<security-constraint>
  <web-resource-collection>     
    <web-resource-name>MANAGER Access</web-resource-name>    
    <url-pattern>/manager/*</url-pattern>   
    <http-method>DELETE</http-method>    
    <http-method>PUT</http-method>    
    <http-method>HEAD</http-method>   
    <http-method>OPTIONS</http-method>   
    <http-method>TRACE</http-method>     
    <http-method>GET</http-method>    
    <http-method>POST</http-method>  
  </web-resource-collection>  

  <auth-constraint>
    <role-name>Manager</role-name>
  </auth-constraint>
</security-constraint>

当我访问 URL appcontextname/manager/something.action 时，它会提示输入用户名和密码，在我提供详细信息后它会给我以下错误

HTTP 状态 403 - 访问请求的资源已被拒绝

4

0 回答 0