Need Help with FORM Based Authentication

[K DeLucia]

I'm trying to get Tomcat FORM based authentication to work and I'm not having any luck. I'm sure it's something stupid I'm missing, but I haven't been able to figure it out.

I have the following in my <tomcatRoot>\webapps\RFS7\WEB-INF\web-xml

  
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" 

xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 

http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <display-name>TestServlet</display-name>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
  <servlet>
   <servlet-name>SendMailServlet</servlet-name>
   <servlet-class>rfs.SendMailServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>SendMailServlet</servlet-name>
    <url-pattern>/SendMailServlet/*</url-pattern>
 </servlet-mapping>

 <security-constraint>
 	<web-resource-collection>
 		<web-resource-name>Request For Service</web-resource-name>
		<url-pattern>/RFS7/*</url-pattern>
		<!-- <http-method>POST</http-method>
		<http-method>GET</http-method>
		Without the above two, security applies to all http methods -->
	</web-resource-collection>
	<auth-constraint>
		<description>everyone has to log in</description>
		<role-name>rfs</role-name>
	</auth-constraint>
</security-constraint>

<security-role> 
	<description>RFS Users</description> 
	<role-name>rfs</role-name>
</security-role>

<login-config>
  <auth-method>FORM</auth-method>
  <form-login-config>
    <form-login-page>/login.html</form-login-page>
    <form-error-page>/loginerror.html</form-error-page>
  </form-login-config>
</login-config>

</web-app>

I have the following in my <tomcatRoot>\webapps\RFS7\WEB-INF\rfs7.xml (I want this login/security to only apply to this application, at least for now)

   
<?xml version="1.0" encoding="UTF-8"?>
<Realm className="org.apache.catalina.realm.MemoryRealm" />
 

I have the following in the <TomcatRoot>\conf\tomcat-users.xml file:

  
<?xml version="1.0" encoding="UTF-8"?>
<Realm className="org.apache.catalina.realm.MemoryRealm" />
 

And my login form contains (among other things) this:

  
<tr><td>Username:</td>
<td><input type="text" name="j_username" class="inputfld" onfocus="formInUse = true;"></td></tr>
<tr><td>Password:</td>
<td><input type="password" name="j_password" class="inputfld" onfocus="formInUse = true;"></td></tr>
  

When I bring up the application at this url: http://localhost/RFS7/request.jsp the page comes up perfectly, but I'm not prompted to login like I expected. What am I doing wrong?

Do I need to edit the server.xml at all? Any pointers or help are much appreciated. Thanks!

[Ulf Dittmer]

<url-pattern>/RFS7/*</url-pattern>

URL patterns are relative to the web app root; try "/*" instead.

I have the following in my <tomcatRoot>\webapps\RFS7\WEB-INF\rfs7.xml

What's the significance of this file?

I have the following in the <TomcatRoot>\conf\tomcat-users.xml file:

That file should contain the users and their password and roles; I'm surprised this doesn't cause an exception.

[K DeLucia]

Thank you! It's working now. The main problem was the url-pattern.

The rfs7.xml was something I added as I tried to work through this. Somewhere I found information about adding an xml file specific to the application, but I'll just forget all about that. ;-) I deleted it.

And my tomcat-users did contain users, passwords and roles. I mistakenly posted the wrong file contents.

In any case, thank you very much for the help!
Karen