Login Filter is not invoked

[Thorsten Mueller]

Hi all,

I want to implement a filter that redirects the user after she authenticated herself. The resultpage depends on the users security role (here: subject or supervisor).
When I start my application, you are prompted to identify yourself by an authentication dialog (I'm using BASIC authentication). Afterwards the welcome-page "index.xhtml" is rendered, which is located directly under the root directory.

The filter should apply for "index.xhtml", however the filter is never invoked. In my web.xml there are no further filter-settings. I also tried to remove the annotations and place the filter-rule and mapping in the web.xml but i did not help.

When I replace the urlPattern with "/*" it is invoked but throws an exception because after the forward it seems to be invoked endlessly (?)). However, I only want to apply the filter to index.xhtml (also tried index.jsf and /faces/index.xhtml without success).

do you see the error?

@WebFilter(filterName = "LoginFilter", urlPatterns = "/index.xhtml",
dispatcherTypes = {DispatcherType.FORWARD, DispatcherType.REQUEST})
public class LoginFilter implements Filter {

 // ...

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain)
            throws IOException, ServletException {
        // we need to access HttpRequest.isUserInRole()-method. Therefore we
        // wrap the request in a httpRequest object
        HttpServletRequest HttpRequest = (HttpServletRequest) request;

        String redirectPage = null;
        if (httpRequest.isUserInRole("Supervisor")) {
            logger.info("User is in Role \"Supervisor\"");
            redirectPage = supervisorWelcome;
        } else if (httpRequest.isUserInRole("Subject")) {
            logger.info("User is in Role \"Subject\"");
            redirectPage = subjectWelcome;
        } else {
            logger.warning("User is in unknown Role");
            redirectPage = errorPage;
        }
        // redirect user based on user's security role
        try {
            request.getServletContext().getRequestDispatcher(redirectPage).forward(request, response);
        } catch (Exception e) {
            // redirect failed
            logger.warning(e.getMessage());
        }