IBM WebSphere V5.0 Security - CGISecurity

higher level of protection. User Data Constraint allows an application deployer
to introduce such protection.
If global security is enabled, and a security constraint is set for a particular
resource, then the resource is secured.
4.3 Securing Web components
This section presents simple scenarios on how to secure different Web
components. We assume that the roles are defined for the application as in the
ITSOBank sample application.
4.3.1 Static content
Static resources of the enterprise application can be secured only if they are
served by WebSphere. WebSphere cannot manage access to the static content
that resides on the Web server. All the static content that needs to be protected
by WebSphere Application Server must be packaged into the Web module (.war,
Web Archive file). Static HTML pages can be served by the servlet that
implements file serving behavior.
The following instructions show how to set up security constraint to protect static
content for the Web application module using the Application Assembly Tool.
This section will only provide information for the Application Assembly Tool, since
securing static contents within WebSphere does not differ from securing dynamic
content in WebSphere; the book will provide information for WebSphere studio in
the next section, where dynamic components will be secured.
1. Start the Application Assembly Tool and load the ITSOBank sample
enterprise application archive file (itsobank.ear).
2. Expand itsobank -> Web Modules -> itsobankWeb and select Security
Constraints.
3. Right-click Security Constraints and select New, a dialog window New
Security Constraint will be opened.
4. Enter the security constraint name Constraints for bank access. Click Add
next to the Roles area. You will be presented with a dialog box listing the
security roles that are defined for your application.
5. Select Everyone and click OK. You should be presented with the following
window.
50 IBM WebSphere V5.0 Security Handbook