tomcat authentication not working

[hai sun]

Hi,

Follow the Tomcat [tag:tomcat]'s tutorial for form-based authentication, I've tried it out in localhost.
My purpose is to protect /lvyouzaike/admin/*
I've mapped the domain name www.lyzk.org to $(TomcatPath)/webapps/lvyouzaike directory. I aim to let login.jsp shown when I type http://www.lyzk.org/admin/index.jsp, suppose index.jsp is one of the files to be protected.
Next I post related files.

majority code of web.xml

    	<filter>
    		<filter-name>struts2</filter-name>
    		<filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    	</filter>
    	<filter-mapping>
    		<filter-name>struts2</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<!-- <param-value>/WEB-INF/applicationContext-*.xml,classpath*:applicationContext-*.xml</param-value> -->
    		<param-value>classpath:beans.xml</param-value>
    	</context-param>
    	<resource-ref>
    		<description>DB Connection</description>
    		<res-ref-name>jdbc/auth</res-ref-name>
    		<res-type>javax.sql.DataSource</res-type>
    		<res-auth>Container</res-auth>
    	</resource-ref>
    	
    	<security-constraint>
              <display-name>lyzk Security Constraint</display-name>
    	  <web-resource-collection>
    	    <web-resource-name>admin area</web-resource-name>
    	    <!-- Define the context-relative URL(s) to be protected -->
    	    <url-pattern>/admin/*</url-pattern>
    	    <!-- If you list http methods, only those methods are protected -->
    	    <http-method>DELETE</http-method>
                <http-method>GET</http-method>
                <http-method>POST</http-method>
                <http-method>PUT</http-method>
    	  </web-resource-collection>
    	  <auth-constraint>
                <!-- Anyone with one of the listed roles may access this area -->
                <role-name>admin</role-name>
              </auth-constraint>      
            </security-constraint>
    
        <!-- Default login configuration uses form-based authentication -->
        <login-config>
          <auth-method>FORM</auth-method>
          <realm-name>lvyouzaike</realm-name>
          <form-login-config>
            <form-login-page>/login.jsp</form-login-page>
            <form-error-page>/error_login.jsp</form-error-page>
          </form-login-config>
        </login-config>
    
        <!-- Security roles referenced by this web application -->
        <security-role>
          <role-name>admin</role-name>
        </security-role>
    	
    </web-app>

context.xml under $(TomcatPath)/lvyouzaike/META-INF

    <Context path="/lvyouzaike">
     
      <Resource name="jdbc/auth" auth="Container" type="javax.sql.DataSource"
                   maxActive="100" maxIdle="30" maxWait="10000"
                   username="lvyouzaike" password="sh771919" driverClassName="com.mysql.jdbc.Driver"
                   url="jdbc:mysql://localhost:3306/lvyouzaike"/>
     
    </Context>

related code of server.xml under $(TomcatPath)/conf

    <Engine name="Catalina" defaultHost="localhost">
          <Realm className="org.apache.catalina.realm.DataSourceRealm"
       dataSourceName="jdbc/auth" localDataSource="true"
       userTable="users" userNameCol="user_name" userCredCol="user_pass"
       userRoleTable="user_roles" roleNameCol="role_name"/>
    
          <Host name="localhost"  appBase="webapps"
                unpackWARs="true" autoDeploy="true">
    
            <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                   prefix="localhost_access_log." suffix=".txt"
                   pattern="%h %l %u %t "%r" %s %b" />
    	<Context path="" docBase=".">
    		<Resource auth="Container" driverClassName="com.mysql.jdbc.Driver" maxActive="100" maxIdle="30" maxWait="10000" name="jdbc/auth" password="password" type="javax.sql.DataSource" url="jdbc:mysql://localhost:3306/lvyouzaike" username="username"/>
    	</Context>
          </Host>
          <Host name="www.lyzk.org" appBase="webapps/lvyouzaike"
    	unpackWARs="true" autoDeploy="true"
    	xmlValidation="false" xmlNamespaceAware="false">
    	<Context path="" docBase=".">
    		<Resource auth="Container" driverClassName="com.mysql.jdbc.Driver" maxActive="100" maxIdle="30" maxWait="10000" name="jdbc/auth" password="password" type="javax.sql.DataSource" url="jdbc:mysql://localhost:3306/lvyouzaike" username="username"/>
    	</Context>
    	<Alias>lyzk.org</Alias>
          </Host>
        </Engine>

login.jsp under $(TomcatPath)/lvyouzaike

    <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    
    <title>login page</title>
    </head>
    <body>
    <form method="POST" action="<%= response.encodeURL('j_security_check') %>"> 
      <table border="0" cellspacing="5">
        <tr>
          <th align="right">Username:</th>
          <td align="left"><input type="text" name="j_username"></td>
        </tr>
        <tr>
          <th align="right">Password:</th>
          <td align="left"><input type="password" name="j_password"></td>
        </tr>
        <tr>
          <td align="right"><input type="submit" value="Log In"></td>
          <td align="left"><input type="reset"></td>
        </tr>
      </table>
    </form>
    </body>
    </html>

index.jsp under $(TomcatPath)/lvyouzaike/admin where I wanna protect

    <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <%
      if (request.getParameter("logoff") != null) {
        session.invalidate();
        response.sendRedirect("index.jsp");
        return;
      }
    %>
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    
    <title>admin index</title>
    </head>
    <body>
    	<h2>admin index</h2>
    	If you have configured this app for form-based authentication, you can log
    off by clicking
    	<a href='<%= response.encodeURL("index.jsp?logoff=true") %>'>here</a>.
    This should cause you to be returned to the logon page after the redirect
    that is performed.
    </body>
    </html> 

Notice that in localhost everything runs well: when I type "localhost/admin/index.jsp", the login page is shown and I have to log on with correct name and password. Yet when I input "http://www.lyzk.org/admin/index.jsp", it is there directly without the expected appearance of login.jsp.
So what's the problem? Thanks a lot for your help.

--Harry

[Tim Holloway]

I don't think you're supposed to do an encodeURL on the form doing the j_security_check. The J2EE container login/loginfail forms do not have their own URLs, but are managed entirely by the Tomcat server.

Also, if you define a Context in tomcat's server.xml, it should completely override all elements of a context defined in the WAR it references. The WAR META-INF/context.xml is only used when there's no explict server-defined context.