Retrieve list of defined roles in java ee 5

Question

I was wondering if it would be possible to retrieve the complete list of security roles defined in a web.xml file in the java code? And if so how to do it?

I am aware of the 'isUserInRole' method but I also want to handle cases where a role is requested but not defined (or spelled differently) in the web.xml file.

Answer 1

As far as I know, there's no way do do this within the Servlet API. However, you can parse web.xml directly and extract the values yourself. I used dom4j below, but you can use whatever XML processing stuff you like:

protected List<String> getSecurityRoles() {
 List<String> roles = new ArrayList<String>();
 ServletContext sc = this.getServletContext();
 InputStream is = sc.getResourceAsStream("/WEB-INF/web.xml");

 try {
  SAXReader reader = new SAXReader();
  Document doc = reader.read(is);

  Element webApp = doc.getRootElement();

  // Type safety warning:  dom4j doesn't use generics
  List<Element> roleElements = webApp.elements("security-role");
  for (Element roleEl : roleElements) {
   roles.add(roleEl.element("role-name").getText());
  }
 } catch (DocumentException e) {
  e.printStackTrace();
 }

 return roles;
}