Hi,

I'm trying to restrict access to specific servlets and jsps.
I followed the instructions on
http://www.weblogic.com/docs51/admindocs/urlacl.html
and created a policy file to control access on URLs.
But even though I have full access to system user and 'everyone' group, I
still get prompted
for a username/password any time I try to access the page.

Here are my policy entries:
grant Principal weblogic.security.acl.User "system" { Permission
weblogic.security.acl.URLAcl "weblogic.url", "-";};
grant Principal weblogic.security.acl.GroupImpl "everyone" { Permission
weblogic.security.acl.URLAcl "weblogic.url", "-";};

I checked the enries with the PolicyParser utilities, no syntax errors were
found...
The policy file is define in the properties file.

What am I doing wrong here? Also, is this the correct way of restricting
access to a servlet.

Thanks in advance,
Cagan

Platform:
Weblogic 5.1 SP 5 running on Redhat linux 6.1