We maintain an empty group which only has read permissions.
When we want to prevent any changes, we put a group of all non admin users (which weupdate when we addusers to the system)into that read-only group. Thus we can temporarily provide read-only access to all but a limited set of privileged users..
HTH,
Vincent
In Reply to Jess Holle:
How about just editing the Apache config to require the admin user ala:
|Require user wcadmin|
and then restarting Apache?
That's one fairly simple thought.
You could instead add a servlet filter that rejects any request for
which getRemoteUser() returns a non-null user that's not in a desired
list/group. You could add a JMX and/or JSP toggle for this (complete
with cluster-wide multi-cast) to allow this to be toggled on the fly.
--
Jess Holle
