To create the new role, I opened up the Deployment Descriptor of the Web project and once more clicked on the Security tab on the bottom of the screen. Then I clicked on the Add button, as shown in Figure I, and entered the information for my new role.

FIGURE I


Go back into the Security section of the Web project Deployment Descriptor. Roll over picture for a larger image.

I then used the tabs at the top of the Security Panel to navigate to the Security Constraints section, and used the Add button there to create a new Security Constraint, like you see Figure J.

FIGURE J


Create a new Security Constraint using the Add button. Roll over picture for a larger image.

After entering the description of the new constraint, I clicked on the Add button in the Web Resources Collection section to bring up the Web Resources Collections dialog box, where I defined my collection of resources, shown in Figure K.

FIGURE K


Enter the URL patterns here. Roll over picture for a larger image.

Then, in the Authorized Roles section, I clicked on the Edit button to define the roles authorized for this new collection, as in Figure L.

FIGURE L


Define the roles authorized for the new collection here. Roll over picture for a larger image.

After closing and saving the Web project Deployment Descriptor, there was one last thing to do, and that was to go back into the Deployment Descriptor of the enterprise application project, get into the security section and hit the Gather button to bring in the new role, shown in Figure M.

FIGURE M


Use the Gather button to retrieve the new role. Roll over picture for a larger image.

I clicked on the new role to bring it into focus, then checked the Everyone box in the WebSphere Bindings section to define this role as applying to all users, as you see in Figure N.

FIGURE N


Check the Everyone box to define this role as all system users. Roll over picture for a larger image.

After closing and saving the Deployment Descriptor, I restarted the server to give it what I was sure at this point was going to be my final test.

Almost there . . .
That did what I wanted it to do. I could now go back to the main menu and still be logged on and still have all of the secured tabs available.

There was one more problem though, which I knew about, but had been avoiding in the slim hope that it was just symptomatic of the other security issues. Unfortunately, that wasn't the case.

I was still getting a nasty error whenever I clicked on Page Templates, like you see in Figure O; solving all of these other issues had no impact on that particular problem.

FIGURE O


After all of the other fixes, this problem refused to go away. Roll over picture for a larger image.

However, with this issue there was a stack trace. There were some indications as to what the error was, so it ended up being one of the simplest things to resolve. In fact, I resolved it without even trying!

I had traced the problem down to the Java module org.roller.business.hibernate.HibernateStrategy. I went back out to the Roller CVS site to get myself a copy of the source code in order to throw in some debug statements and track down the problem.

As it turned out, however, the version that I snagged from CVS was a different version than the one I received in the demo package. When I brought it in and tested it, the problem went away.