+ warName);

        // parse the spec dd

        String specDD = "";

        UnpackedJarFile jarFile = new UnpackedJarFile(path);

        URL specDDUrl = DeploymentUtil.createJarURL(jarFile, "WEB-INF/web.xml");

        // read in the entire specDD as a string

        specDD = DeploymentUtil.readAll(specDDUrl);

        // parse it

        assert !targetPath.endsWith("/") : "targetPath must not end with a '/'";

        // parse the spec dd

        String specDD = null;

        try {

            if (specDDUrl == null) {

                specDDUrl = DeploymentUtil.createJarURL(moduleFile, "WEB-INF/web.xml");

            }

            // read in the entire specDD as a string, we need this for getDeploymentDescriptor

            // on the J2ee management object

            specDD = DeploymentUtil.readAll(specDDUrl);

            // we found web.xml, if it won't parse that's an error.

            XmlObject parsed = XmlBeansUtil.parse(specDD);

            WebAppDocument webAppDoc = convertToServletSchema(parsed);

            webApp = webAppDoc.getWebApp();

            check(webApp);

        } catch (XmlException e) {

            // Output the target path in the error to make it clearer to the user which webapp

            // has the problem.  The targetPath is used, as moduleFile may have an unhelpful

            // value such as C:\geronimo-1.1\var\temp\geronimo-deploymentUtil22826.tmpdir

            throw new DeploymentException("Error parsing web.xml for " + targetPath, e);

        } catch (Exception e) {

            if (!moduleFile.getName().endsWith(".war")) {

                //not for us

                return null;

            }

            //else ignore as jee5 allows optional spec dd for .war's

            if (e instanceof FileNotFoundException) {

                log.warn("Web application " + targetPath + " does not contain a WEB-INF/web.xml. This may indicate a mis-assembled web app.");

            }

        }

        if (webApp == null) {

            webApp = WebAppType.Factory.newInstance();

        }

        // parse vendor dd

        JettyWebAppType jettyWebApp = getJettyWebApp(plan, moduleFile, standAlone, targetPath, webApp);

        contextRoot = getContextRoot(jettyWebApp, contextRoot, webApp, standAlone, moduleFile, targetPath);

        EnvironmentType environmentType = jettyWebApp.getEnvironment();

        Environment environment = EnvironmentBuilder.buildEnvironment(environmentType, defaultEnvironment);

        if (TRUE == distributable) {

            clusteringBuilders.buildEnvironment(jettyWebApp, environment);

        }

        // Note: logic elsewhere depends on the default artifact ID being the file name less extension (ConfigIDExtractor)

        EARContext moduleContext = module.getEarContext();

        AbstractName moduleName = moduleContext.getModuleName();

        WebModule webModule = (WebModule) module;

        JettyWebAppType jettyWebApp = (JettyWebAppType) webModule.getVendorDD();

        GBeanData webModuleData = new GBeanData(moduleName, WebAppContextWrapper.class);

        configureBasicWebModuleAttributes(webApp, jettyWebApp, moduleContext, earContext, webModule, webModuleData);

        // unsharableResources, applicationManagedSecurityResources

        GBeanResourceEnvironmentBuilder rebuilder = new GBeanResourceEnvironmentBuilder(webModuleData);

        //N.B. use earContext not moduleContext

        //TODO fix this for javaee 5 !!!

        try {

            moduleContext.addGBean(webModuleData);

            // configure hosts and virtual-hosts

            configureHosts(earContext, jettyWebApp, webModuleData);

            String contextPath = webModule.getContextRoot();

            if (contextPath == null) {

                throw new DeploymentException("null contextPath");

            }

            if (!contextPath.startsWith("/")) {

                contextPath = "/" + contextPath;

            }

            webModuleData.setAttribute("contextPath", contextPath);

            if (jettyWebApp.isSetWorkDir()) {

                String workDir = jettyWebApp.getWorkDir();

                webModuleData.setAttribute("workDir", workDir);

            }

            if (jettyWebApp.isSetWebContainer()) {

                AbstractNameQuery webContainerName = ENCConfigBuilder.getGBeanQuery(GBeanInfoBuilder.DEFAULT_J2EE_TYPE, jettyWebApp.getWebContainer());

                webModuleData.setReferencePattern("JettyContainer", webContainerName);

            } else {

                webModuleData.setReferencePattern("JettyContainer", jettyContainerObjectName);

            }

            //stuff that jetty used to do

            }

            // configure context parameters.

            configureContextParams(webApp, webModuleData);

            // configure listeners.

            configureListeners(webApp, webModuleData);

            webModuleData.setAttribute(WebAppContextWrapper.GBEAN_ATTR_SESSION_TIMEOUT,

                            defaultSessionTimeoutSeconds);

            webModuleData.setAttribute("distributable", distributable);

            if (TRUE == distributable) {

                clusteringBuilders.build(jettyWebApp, earContext, moduleContext);

                if (webModuleData.getReferencePatterns(WebAppContextWrapper.GBEAN_REF_SESSION_HANDLER_FACTORY) == null) {

                    log.warn("No clustering builders configured: app will not be clustered");

                    configureNoClustering(moduleContext, webModuleData);

                }

            } else {

                configureNoClustering(moduleContext, webModuleData);

            }

            // configure mime mappings.

            configureMimeMappings(webApp, webModuleData);

            // configure welcome file lists.

            configureWelcomeFileLists(webApp, webModuleData);

            // configure local encoding mapping lists.

            configureLocaleEncodingMappingLists(webApp, webModuleData);

            // configure error pages.

            configureErrorPages(webApp, webModuleData);

            // configure tag libs.

            Set<String> knownServletMappings = new HashSet<String>();

            Set<String> knownJspMappings = new HashSet<String>();

            Map<String, Set<String>> servletMappings = new HashMap<String, Set<String>>();

            if (jspServlet != null) {

                configureTagLibs(module, webApp, webModuleData, servletMappings, knownJspMappings, jspServlet.getServletName());

                GBeanData jspServletData = configureDefaultServlet(jspServlet, earContext, moduleName, knownJspMappings);

                knownServletMappings.addAll(knownJspMappings);

                module.getSharedContext().put(DEFAULT_JSP_SERVLET_KEY, jspServletData);

            }

            // configure login configs.

            configureAuthentication(module, webApp, jettyWebApp, webModuleData);

            // Make sure that servlet mappings point to available servlets and never add a duplicate pattern.

            buildServletMappings(module, webApp, servletMappings, knownServletMappings);

            //be careful that the jsp servlet defaults don't overrride anything configured in the app.

            if (jspServlet != null) {

                GBeanData jspServletData = (GBeanData) module.getSharedContext().get(DEFAULT_JSP_SERVLET_KEY);

                Set<String> jspMappings = (Set<String>) jspServletData.getAttribute("servletMappings");

                jspMappings.removeAll(knownServletMappings);

                jspMappings.addAll(knownJspMappings);

                jspServletData.setAttribute("servletMappings", jspMappings);

            }

            //"previous" filter mapping for linked list to keep dd's ordering.

            AbstractName previous = null;

            //add default filters

            if (defaultFilters != null) {

                previous = addDefaultFiltersGBeans(earContext, moduleContext, moduleName, previous);

            }

            //add default filtermappings

//            if (defaultFilterMappings != null) {

//                for (Iterator iterator = defaultFilterMappings.iterator(); iterator.hasNext();) {

//                    Object defaultFilterMapping = iterator.next();

//                    GBeanData filterMappingGBeanData = getGBeanData(kernel, defaultFilterMapping);

//                    String filterName = (String) filterMappingGBeanData.getAttribute("filterName");

//                    ObjectName defaultFilterMappingObjectName;

//                    if (filterMappingGBeanData.getAttribute("urlPattern") != null) {

//                        String urlPattern = (String) filterMappingGBeanData.getAttribute("urlPattern");

//                        defaultFilterMappingObjectName = NameFactory.getWebFilterMappingName(null, null, null, null, filterName, null, urlPattern, moduleName);

//                    } else {

//                        Set servletNames = filterMappingGBeanData.getReferencePatterns("Servlet");

//                        if (servletNames == null || servletNames.size() != 1) {

//                            throw new DeploymentException("Exactly one servlet name must be supplied");

//                        }

//                        ObjectName servletObjectName = (ObjectName) servletNames.iterator().next();

//                        String servletName = servletObjectName.getKeyProperty("name");

//                        defaultFilterMappingObjectName = NameFactory.getWebFilterMappingName(null, null, null, null, filterName, servletName, null, moduleName);

//                    }

//                    filterMappingGBeanData.setName(defaultFilterMappingObjectName);

//                    filterMappingGBeanData.setReferencePattern("JettyFilterMappingRegistration", webModuleName);

//                    moduleContext.addGBean(filterMappingGBeanData);

//                }

//            }

            // add filter mapping GBeans.

            addFilterMappingsGBeans(earContext, moduleContext, moduleName, webApp, previous);

            // add filter GBeans.

            addFiltersGBeans(earContext, moduleContext, moduleName, webApp);

            //add default servlets

            if (defaultServlets != null) {

                addDefaultServletsGBeans(earContext, moduleContext, moduleName, knownServletMappings);

            }

            //set up servlet gbeans.

            addServlets(moduleName, webModule, servletTypes, servletMappings, moduleContext);

            if (jettyWebApp.isSetSecurityRealmName()) {

                configureSecurityRealm(earContext, webApp, jettyWebApp, webModuleData);

            }

            //See Jetty-386, GERONIMO-3738

            if (jettyWebApp.getCompactPath()) {

                webModuleData.setAttribute("compactPath", Boolean.TRUE);

            }

            //TODO this may definitely not be the best place for this!

            for (ModuleBuilderExtension mbe : moduleBuilderExtensions) {

                mbe.addGBeans(earContext, module, cl, repository);

            }

            //not truly metadata complete until MBEs have run

                module.setOriginalSpecDD(module.getSpecDD().toString());

            }

            webModuleData.setAttribute("deploymentDescriptor", module.getOriginalSpecDD());

            if (!module.isStandAlone()) {

        URI resolutionUri = invertURI(baseUri);

        earContext.getCompleteManifestClassPath(module.getModuleFile(), baseUri, resolutionUri, manifestcp, moduleLocations);

            if (!hasSecurityRealmName) {

                throw new DeploymentException("web.xml for web app " + module.getName() + " includes security elements but Geronimo deployment plan is not provided or does not contain <security-realm-name> element necessary to configure security accordingly.");

            }

        }

        if (hasSecurityRealmName) {

    public void testParsing() throws Exception {

        URL srcXml = classLoader.getResource("security/web1.xml");

        WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options);

        SpecSecurityBuilder builder = new SpecSecurityBuilder();

        ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType);

        PermissionCollection unchecked = permissions.getUncheckedPermissions();

        assertTrue(unchecked.implies(new WebResourcePermission("/login.do", "!")));

        assertTrue(unchecked.implies(new WebResourcePermission("/foo", "!")));

     */

    public void testAllMethodsConstraint() throws Exception {

        URL srcXml = classLoader.getResource("security/web2.xml");

        WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options);

        SpecSecurityBuilder builder = new SpecSecurityBuilder();

        ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType);

        Permission p = new WebResourcePermission("/Test/Foo", "GET,POST");

        assertTrue(implies(p, permissions, "Admin"));

        assertFalse(implies(new WebResourcePermission("/Test", ""), permissions, null));

    public void testExcludedConstraint() throws Exception {

        URL srcXml = classLoader.getResource("security/web3.xml");

        WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options);

        SpecSecurityBuilder builder = new SpecSecurityBuilder();

        ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType);

        Permission p = new WebResourcePermission("/Test/Foo", "GET,POST");

        assertTrue(implies(p, permissions, "Admin"));

        assertFalse(implies(p, permissions, null));

    }

    public void testExcludedRemovesRoleConstraint() throws Exception {

        URL srcXml = classLoader.getResource("security/web4.xml");

        WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options);

        SpecSecurityBuilder builder = new SpecSecurityBuilder();

        ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType);

        // test excluding longer path than allowed

        Permission p = new WebResourcePermission("/Foo/Baz", "GET");

        assertTrue(implies(p, permissions, "Admin"));

    //overlapping excluded and role constraint, excluded constraint wins.

    public void testExcludedAndRoleConstraint() throws Exception {

        URL srcXml = classLoader.getResource("security/web5.xml");

        WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options);

        SpecSecurityBuilder builder = new SpecSecurityBuilder();

        ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType);

        // test excluding longer path than allowed

        Permission p = new WebResourcePermission("/foo/Baz", "GET");

        assertFalse(implies(p, permissions, "user"));

    public void testDifferentRoleDifferentHttpMethod() throws Exception {

        URL srcXml = classLoader.getResource("security/web6.xml");

        WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options);

        SpecSecurityBuilder builder = new SpecSecurityBuilder();

        ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType);

        Permission p = new WebResourcePermission("/app/*", "GET");

        assertTrue(implies(p, permissions, "userGet"));

        assertFalse(implies(p, permissions, "userPost"));