IBM WebSphere V5.0 Security - CGISecurity

For servlets, WebSphere Application Server allows you to protect the resourceson the method level. For example, the POST method of a servlet can be part of adifferent security constraint than the GET method. The full list of predefinedmethods that can be secured is as follows:► GET► POST► PUT► DELETE► HEAD► OPTION► TRACEUsing method level security constraints for servlets, you may want to separatedynamic content that all the users can view from the administrative functions thatonly privileged users will be allowed to access. In WebSphere Application Server,this is done using different security constraints for the different servlet methods.Configuring Security Constraints with the ApplicationAssembly ToolThe following steps will show how to define security constraints with theApplication Assembly Tool.1. Load the itsobank.ear application file into the Application Assembly Tool.2. Expand itsobank -> Web Modules -> itsobankWeb and select SecurityConstraints. Right click Security Constraint and select New. You will bepresented with the New Security Constraint window.3. In the Authorization Constraints section panel, next to Roles, click Add. Youwill be presented with a dialog box listing all the security roles that are definedfor your Web module of ITSOBank application. Select the clerk and theManager roles and click OK.4. Click OK to save the security constraint. You should see your new securityconstraint listed in the Constraints panel.5. In the left-hand pane, expand the new constraint and select Web ResourceCollections. Right-click Web Resource Collections and select New. Youwill be presented with the New Web Resource Collection entry window.6. Enter the Web Resource Name: Customer transfer.7. Next to HTTP Methods click Add. You will be presented with the Add HTTPmethods dialog box.Chapter 4. Securing Web components 53