How to secure a single url in a weblogic application? - security

Question

UPDATE 2:
What seems to be the root of the problem is that I can only succesfully secure the root of the application (e.g. the "/"). When I try to secure any other url, it gives me a 403. Unsecured urls work without problem.
ORIGINAL QUESTION:
I made this basic application where I want to be able have one secured page and one unsecured page. I currently get a 403 whenever I try to access my secured page (after giving the correct login data). Below I've posted my web.xml I have been trying to work with. I can access the unsecured page with no problem.
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_10" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>Login test</display-name>
<!-- Servlet config -->
<servlet>
<servlet-name>AfterLoginServlet</servlet-name>
<servlet-class>test.AfterLoginServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>AfterLoginServlet</servlet-name>
<url-pattern>/secured</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>UnsecuredServlet</servlet-name>
<servlet-class>test.UnsecuredServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>UnsecuredServlet</servlet-name>
<url-pattern>/unsecured</url-pattern>
</servlet-mapping>
<!-- Login and security config -->
<servlet>
<servlet-name>Login</servlet-name>
<servlet-class>test.Login</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Login</servlet-name>
<url-pattern>/login</url-pattern>
</servlet-mapping>
<security-role>
<role-name>demorole</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>secured pages</web-resource-name>
<url-pattern>/secured</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>demorole</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>MyRealm</realm-name>
<form-login-config>
<form-login-page>/login</form-login-page>
<form-error-page>/error</form-error-page>
</form-login-config>
</login-config>
<session-config>
<session-timeout>20</session-timeout>
</session-config>
</web-app>
I've tried a few other options to make sure my application was working.
Turned security off completely: this worked without a hitch.
Set security to everything: I adapted the security-constraint to have the url-pattern be /*. This made me able to access only / (if I changed my servlet mapping).
So I succeed at securing either all pages or none of my pages, but I don't manage to secure only a portion of them. I don't really know what I could be doing wrong (though I'm sure it's something stupid).
UPDATE 1:
I have 2 working options now (for my simple test case):
http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
Login test
<!-- Servlet config -->
<servlet>
<servlet-name>AfterLoginServlet</servlet-name>
<servlet-class>test.AfterLoginServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>AfterLoginServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>UnsecuredServlet</servlet-name>
<servlet-class>test.UnsecuredServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>UnsecuredServlet</servlet-name>
<url-pattern>/unsecured</url-pattern>
</servlet-mapping>
<!-- Login and security config -->
<servlet>
<servlet-name>Login</servlet-name>
<servlet-class>test.Login</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Login</servlet-name>
<url-pattern>/login</url-pattern>
</servlet-mapping>
<security-role>
<role-name>demorole</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>unsecured</web-resource-name>
<url-pattern>/unsecured</url-pattern>
</web-resource-collection>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>secured pages</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>demorole</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>MyRealm</realm-name>
<form-login-config>
<form-login-page>/login</form-login-page>
<form-error-page>/error</form-error-page>
</form-login-config>
</login-config>
<session-config>
<session-timeout>20</session-timeout>
</session-config>
</web-app>
I can also change the servlet mapping for AfterLoginServlet to /*. This still works on the / url, but not anything else...
UPDATE 3: Roles
So I actually have several applications that all suffer that same problem with security having to be /*.
I've used to possible configurations for roles that work:
The one you see here with demorole (defined role in web.xml and defined security-role assigment in weblogic.xml)
For this one, when I look in Security Realms -> [realm name] -> Roles and Policies -> Realm Roles, I see for every application that uses that role URL Pattern:/ Role:demorole in -> Web module -> Url Patterns and Role
One where I do not define a role and I just use All in the security constraint (no extra definitions in web.xml or weblogic.xml):
.
<security-constraint>
<web-resource-collection>
<web-resource-name>all</web-resource-name>
<url-pattern>*</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>All</role-name>
</auth-constraint>
</security-constraint>

Answer 1

Try putting this in the weblogic.xml file:
<security-role-assignment>
<role-name>demorole</role-name>
<externally-defined/>
</security-role-assignment>