I'm using Jboss4.00 and using JAAS security for authentication and authoriztion of my application.
i setup the web.xml,for the security constraint.
the login-config.xml and jboss-web.xml.
but when i tried to view the req.isUserInRole("admin") the output is false,
can anybody explain me why.
but when i deploy my application in
jboss 3.2xxx it returns true.
here's some of my setup
web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure Pages</web-resource-name>
<url-pattern>*.do</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>application</realm-name>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/loginerror.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>admin</role-name>
</security-role>
jboss-web.xml
<security-domain>
java:/jaas/application</security-domain>
login-config.xml
<application-policy name = "application">
<authentication>
<login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag = "required">
<module-option name = "dsJndiName">java:/MySqlDS</module-option>
<module-option name = "principalsQuery">select password from user where user_id=?</module-option>
<module-option name = "rolesQuery">SELECT role, 'Roles' FROM roles WHERE user_id = ?</module-option>
<module-option name = "unauthenticatedIdentity">guest</module-option>
</login-module>
</authentication>
</application-policy>