File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
The moose likes JBoss/WildFly and the fly likes Simple form-based authentication using JAAS Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Products » JBoss/WildFly
Bookmark "Simple form-based authentication using JAAS" Watch "Simple form-based authentication using JAAS" New topic

Simple form-based authentication using JAAS

James Adams
Ranch Hand

Joined: Sep 12, 2003
Posts: 188
I am trying to set up simple authentication using a database. I am initially trying to secure all web resources, since my application accesses the EJBs via servlets (and is working fine without security). Later I will tighten things down so that the EJB's business methods will also have security in place.
It seems that everything is in place but I am unable to authenticate a user when I use a valid login/password combination (I am being redirected to the login error page). No exceptions appear in the JBoss console, and the database tables appear to be populated with proper values. Hopefully someone reading this can give me a clue as to what is going wrong.
Here is what I have done so far:
1) I have two tables in my database, one for the user_name and password, and another for roles. The database tables look like this:
table name: principals
column: principal_id VARCHAR(64) primary key
column: password VARCHAR(64)
table name: roles
column: principal_id VARCHAR(64)
column: user_role VARCHAR(64)
column: role_group VARCHAR(64)

2) I have added an entry in $JBOSS/server/default/conf/login-config.xml to declare an application policy which uses a DatabaseServerLoginModule. In this entry I have specified the SQl to be used by the module for selecting the password and role, following the example in the JBoss Getting Started Guide (p. 57):

3) I have added a security domain entry in the jboss-web.xml file:

4) I have declared a security constraint in the web.xml file:

5) I have a simple login form (LoginForm.jsp) which encodes j_security_check:

Can anyone see from the above that I have missed something, or that I have done something wrong ?
Is there a way to get more information ? All I see in the access log file are logs of the requests for the servlet, j_security_check, and the login and error pages, and it might be helpful to have a little more information as to what is going on.
Thanks in advance for any insight.

James Adams
Ranch Hand

Joined: Sep 12, 2003
Posts: 188
The problem was that I had a duplicate principalsQuery instead of a rolesQuery in the application-policy section of the login-config.xml. Now that this has been fixed I am authenticating as expected.

I agree. Here's the link:
subject: Simple form-based authentication using JAAS
It's not a secret anymore!