Form based login

[Murtuza Akhtari]

I am using form based authentication for my application. I have a page viewSummary.htnl in a folder called "secure". To access this page users have to logon. but whn i click on a link for the viewSummary page. It does not take me to the login page....it sends me directly to the viewSummary.html

my login-config is as follows:

<login-config>
  <auth-method>FORM</auth-method>
  <form-login-config>
    <form-login-page>/login.html</form-login-page>
    <form-error-page>/error.jsp</form-error-page>
  </form-login-config>
</login-config>

Also if i run my login page directly and put in username and password...i get a ServletNotFoundException : FormLoginServlet
the stack trace is as follows:

 
[11/9/04 11:37:31:611 CST] 152f637c WebGroup      E SRVE0026E: [Servlet Error]-[FormLoginServlet]: com.ibm.ws.webcontainer.servlet.exception.ServletNotFoundException: Servlet Not Found: FormLoginServlet
at com.ibm.ws.webcontainer.webapp.WebAppServletManager.getServletReference(WebAppServletManager.java:385)
at com.ibm.ws.webcontainer.webapp.WebApp.getServletReference(WebApp.java:589)
at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcherInfo.calculateInfo(WebAppRequestDispatcherInfo.java:140)
at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcherInfo.<init>(WebAppRequestDispatcherInfo.java:59)
at com.ibm.ws.webcontainer.webapp.WebApp.getRequestDispatcher(WebApp.java:1415)
at com.ibm.ws.webcontainer.webapp.WebApp.getRequestDispatcher(WebApp.java:1376)
at com.ibm.ws.webcontainer.srt.WebAppInvoker.handleInvocationHook(WebAppInvoker.java:196)
at com.ibm.ws.webcontainer.cache.invocation.CachedInvocation.handleInvocation(CachedInvocation.java:71)
at com.ibm.ws.webcontainer.srp.ServletRequestProcessor.dispatchByURI(ServletRequestProcessor.java:182)
at com.ibm.ws.webcontainer.oselistener.OSEListenerDispatcher.service(OSEListener.java:331)
at com.ibm.ws.webcontainer.http.HttpConnection.handleRequest(HttpConnection.java:56)
at com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnection.java:432)
at com.ibm.ws.http.HttpConnection.run(HttpConnection.java:343)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:592)

Please help me....been at it since the last 2 days

Thanks in advance

[Jeff Bosch]

That looks suspiciously like a CLASSPATH problem or a similar issue.

[Murtuza Akhtari]

got rid of the ServletNotFoundException.....seems I had forgotten to enable global security in the WebSphere Server.

But I still have the first problem.I have and index.html page...where i have and anchor to the /secure/viewSummary.html
Whn I click that link....it take me to the secured page even before login.

my security constraint is as follows:

<security-constraint>
<web-resource-collection>
  <web-resource-name>SecurePages</web-resource-name>
 <description>Security constraint /secure</description>
 <url-pattern>/LDAPAuth/secure/viewSummary.html</url-pattern>
  <http-method>POST</http-method>
  <http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<description>only let the admin users login</description>
<role-name>admin</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
 
<login-config>
  <auth-method>FORM</auth-method>
   <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/login.jsp?failed=true</form-error-page>
  </form-login-config>
</login-config>
<security-role>
<description>Only admins gain access</description>
<role-name>admin</role-name>
</security-role>

Please help !!

[David O'Meara]

I'm moving this to the IBM/Websphere forum, but I have to ask: which version are you using? I didn't try WAS 5, but in 4 (from memory) form based authentication only worked in 4.0.3 and 4.0.5 It was broken in other versions.

[Murtuza Akhtari]

I am using WSAD 5.0/WAS 5.....Please tell me it works for 5.0 !!!