Question

I have GWT application deploy on AppEngine. I would like to limit access to the application to administrators only.

I would like to use the built-in security-constraint settings in web.xml but I can’t figure how to make my app respond in /myapp/admin url instead of /myapp
I am using RequestFactory to communicate with the server, I would like the /gwtRequest to be under the same constraint.

Thank you,
Ido.

Answer 1

I don’t know if I understand your question correcty.

If you want only access with admin, you can configure you Application like following:

<security-constraint>
    <web-resource-collection>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

<security-constraint>
    <web-resource-collection>
        <url-pattern>/loginpage</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

Now you have only Admin-Access to every Page, but you still need to have public access to the login-page. (you must replace “loginpage” with the url to your login page)

If you only want to make you gwtRequest under admin-access make it like this:

<security-constraint>
    <web-resource-collection>
        <url-pattern>/gwtRequest/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

I’m sorry I’m not sure if its /gwtRequest/ or /gwtRequest