在 web.xml 中排除一个角色

Question

我的 Web 应用程序中有一个 web.xml，其中包含类似于以下内容的安全约束。

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Application</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>PUT</http-method>
        <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<security-role>
    <description>Any logged in user can access this application.</description>
    <role-name>*</role-name>
</security-role>

这将允许任何登录用户访问该应用程序。有没有办法允许任何用户访问应用程序，除非他们具有特定角色？

类似这样的：

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Application</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>PUT</http-method>
        <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
    <exclude-role>
        <role-name>exclude</role-name>
    </exclude-role>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<security-role>
    <description>Any logged in user can access this application.</description>
    <role-name>*</role-name>
</security-role>

<security-role>
    <description>Except for users with this role.</description>
    <role-name>exclude</role-name>
</security-role>

我可以列出应该有权访问的每个角色，但是角色数量很多，而且我们不断添加新角色，这些新角色也应该有权访问此应用程序，因此我需要一种方法来仅排除单个角色.

Answer 1

您可以使用过滤器：

在下面的链接中解释得很好

访问http://www.avajava.com/tutorials/lessons/what-is-a-filter-and-how-do-i-use-it.html