IBM WebSphere V5.0 Security - CGISecurity

higher level of protection. User Data Constraint allows an application deployerto introduce such protection.If global security is enabled, and a security constraint is set for a particularresource, then the resource is secured.4.3 Securing Web componentsThis section presents simple scenarios on how to secure different Webcomponents. We assume that the roles are defined for the application as in theITSOBank sample application.4.3.1 Static contentStatic resources of the enterprise application can be secured only if they areserved by WebSphere. WebSphere cannot manage access to the static contentthat resides on the Web server. All the static content that needs to be protectedby WebSphere Application Server must be packaged into the Web module (.war,Web Archive file). Static HTML pages can be served by the servlet thatimplements file serving behavior.The following instructions show how to set up security constraint to protect staticcontent for the Web application module using the Application Assembly Tool.This section will only provide information for the Application Assembly Tool, sincesecuring static contents within WebSphere does not differ from securing dynamiccontent in WebSphere; the book will provide information for WebSphere studio inthe next section, where dynamic components will be secured.1. Start the Application Assembly Tool and load the ITSOBank sampleenterprise application archive file (itsobank.ear).2. Expand itsobank -> Web Modules -> itsobankWeb and select SecurityConstraints.3. Right-click Security Constraints and select New, a dialog window NewSecurity Constraint will be opened.4. Enter the security constraint name Constraints for bank access. Click Addnext to the Roles area. You will be presented with a dialog box listing thesecurity roles that are defined for your application.5. Select Everyone and click OK. You should be presented with the followingwindow.50 IBM WebSphere V5.0 Security Handbook