Question

For my Java web application I am using JAAS for authentication and authorization. Anything is protected, but the login and error page, thus I configured my Jetty with:

ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/*");

Now I would like to offer a sign up page, is there a way to define an exception for the path spec? Regular expression do not work here as far as I have tested and seen in the source code.

Answer 1

This can be solved with constraint relaxation.
You can add another constraint to your constraint mapping, which will relax the more general constraint for /*:

Constraint relaxation = new Constraint();
relaxation.setName(Constraint.ANY_ROLE);
relaxation.setAuthenticate(false);

ConstraintMapping rm = new ConstraintMapping();
rm.setConstraint(relaxation);
rm.setPathSpec("/signup");

Then you add this constraint as well to your ContextSecurityHandler

csh.addConstraintMapping(rm);