Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=41498

Add info for allRolesMode

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1149582 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 18c3ed9..e3b52df 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -109,6 +109,10 @@
   <subsection name="Web applications">
     <changelog>
       <fix>
+        <bug>41498</bug>: Add the allRolesMode attribute to the Realm
+        configuration page in the documentation web application. (markt)
+      </fix>
+      <fix>
         <bug>51516</bug>: Correct documentation web application to show correct
         system property name for changing the name of the SSO session cookie.
         (markt)

diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml
index 9f20a40..5d6f387 100644 (file)
--- a/webapps/docs/config/realm.xml
+++ b/webapps/docs/config/realm.xml
@@ -107,6 +107,19 @@
 
     <attributes>
 
+      <attribute name="allRolesMode" required="false">
+        <p>This attribute controls how the special role name <code>*</code> is
+        handled when processing authorization constraints in web.xml. By
+        default, the specification compliant value of <code>strict</code> is
+        used which means that the user must be assigned one of the roles defined
+        in web.xml. The alternative values are <code>authOnly</code> which means
+        that the user must be authenticated but no check is made for assigned
+        roles and <code>strictAuthOnly</code> which means that the user must be
+        authenticated and no check will be made for assigned roles unless roles
+        are defined in web.xml in which case the user must be assigned at least
+        one of those roles.</p>
+      </attribute>
+
       <attribute name="connectionName" required="true">
         <p>The database username to use when establishing the JDBC
         connection.</p>
@@ -208,6 +221,19 @@
 
     <attributes>
 
+      <attribute name="allRolesMode" required="false">
+        <p>This attribute controls how the special role name <code>*</code> is
+        handled when processing authorization constraints in web.xml. By
+        default, the specification compliant value of <code>strict</code> is
+        used which means that the user must be assigned one of the roles defined
+        in web.xml. The alternative values are <code>authOnly</code> which means
+        that the user must be authenticated but no check is made for assigned
+        roles and <code>strictAuthOnly</code> which means that the user must be
+        authenticated and no check will be made for assigned roles unless roles
+        are defined in web.xml in which case the user must be assigned at least
+        one of those roles.</p>
+      </attribute>
+
       <attribute name="dataSourceName" required="true">
         <p>The name of the JNDI JDBC DataSource for this Realm.</p>
       </attribute>
@@ -317,6 +343,19 @@
         The default value is "false".</p>
       </attribute>
 
+      <attribute name="allRolesMode" required="false">
+        <p>This attribute controls how the special role name <code>*</code> is
+        handled when processing authorization constraints in web.xml. By
+        default, the specification compliant value of <code>strict</code> is
+        used which means that the user must be assigned one of the roles defined
+        in web.xml. The alternative values are <code>authOnly</code> which means
+        that the user must be authenticated but no check is made for assigned
+        roles and <code>strictAuthOnly</code> which means that the user must be
+        authenticated and no check will be made for assigned roles unless roles
+        are defined in web.xml in which case the user must be assigned at least
+        one of those roles.</p>
+      </attribute>
+
       <attribute name="alternateURL" required="false">
         <p>If a socket connection can not be made to the provider at
         the <code>connectionURL</code> an attempt will be made to use the
@@ -554,6 +593,19 @@
 
     <attributes>
 
+      <attribute name="allRolesMode" required="false">
+        <p>This attribute controls how the special role name <code>*</code> is
+        handled when processing authorization constraints in web.xml. By
+        default, the specification compliant value of <code>strict</code> is
+        used which means that the user must be assigned one of the roles defined
+        in web.xml. The alternative values are <code>authOnly</code> which means
+        that the user must be authenticated but no check is made for assigned
+        roles and <code>strictAuthOnly</code> which means that the user must be
+        authenticated and no check will be made for assigned roles unless roles
+        are defined in web.xml in which case the user must be assigned at least
+        one of those roles.</p>
+      </attribute>
+
       <attribute name="resourceName" required="true">
         <p>The name of the resource that this realm will use for user, password
         and role information.</p>
@@ -583,6 +635,19 @@
 
     <attributes>
 
+      <attribute name="allRolesMode" required="false">
+        <p>This attribute controls how the special role name <code>*</code> is
+        handled when processing authorization constraints in web.xml. By
+        default, the specification compliant value of <code>strict</code> is
+        used which means that the user must be assigned one of the roles defined
+        in web.xml. The alternative values are <code>authOnly</code> which means
+        that the user must be authenticated but no check is made for assigned
+        roles and <code>strictAuthOnly</code> which means that the user must be
+        authenticated and no check will be made for assigned roles unless roles
+        are defined in web.xml in which case the user must be assigned at least
+        one of those roles.</p>
+      </attribute>
+
       <attribute name="digest" required="false">
         <p>The digest algorithm used to store passwords in non-plaintext
         formats. Valid values are those accepted for the algorithm name by the
@@ -656,6 +721,19 @@
 
     <attributes>
 
+      <attribute name="allRolesMode" required="false">
+        <p>This attribute controls how the special role name <code>*</code> is
+        handled when processing authorization constraints in web.xml. By
+        default, the specification compliant value of <code>strict</code> is
+        used which means that the user must be assigned one of the roles defined
+        in web.xml. The alternative values are <code>authOnly</code> which means
+        that the user must be authenticated but no check is made for assigned
+        roles and <code>strictAuthOnly</code> which means that the user must be
+        authenticated and no check will be made for assigned roles unless roles
+        are defined in web.xml in which case the user must be assigned at least
+        one of those roles.</p>
+      </attribute>
+
       <attribute name="appName" required="true">
        <p>The name of the application as configured in your login configuration
        file