Security Constraint problem

[Manuel Manhart]

Hi!

I got the following problem:
I have a J2EE web application and added a security constraint for it, so that we are able to use the security of the application server (e.g. LDAP).
But the "normal" login procedure should not be touched in any way, so it should be possible that users may login over a standard login as well.

We use struts (to make everything a little more complex ;-) and two login modules.

web.xml:
      <security-constraint id="SecurityConstraint_1147855544844">
         <web-resource-collection id="WebResourceCollection_1147855544844">
            <web-resource-name>WebConnect</web-resource-name>
            <url-pattern>/login/j2ee.jsp</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
         </web-resource-collection>
         <auth-constraint id="AuthConstraint_1147855544844">
            <role-name>WebConnect</role-name>
         </auth-constraint>
      </security-constraint>
      <login-config id="LoginConfig_1147855544844">
         <auth-method>FORM</auth-method>
         <form-login-config id="FormLoginConfig_1147855544844">
            <form-login-page>/externalLDAPTool</form-login-page>
            <form-error-page>/login/j2ee_error.jsp</form-error-page>
         </form-login-config>
      </login-config>
      <security-role id="SecurityRole_1147855544844">
         <role-name>WebConnect</role-name>
      </security-role>

application.xml:
      <security-role id="SecurityRole_1048883909584">
         <role-name>WebConnect</role-name>
      </security-role>

struts-config.xml:
    <action input="/login/login.jsp" name="loginForm" path="/login/login" scope="session" type="com.webconnect.user.actions.LoginAction">
      <forward name="success" path="/secure/window.jsp" redirect="true" />
      <forward name="error" path="/login/login.jsp" redirect="false" />
      <forward name="singleSignOnError" path="/login/singleSignOnError.jsp" redirect="false" />
      <forward name="expired" path="/secure/changepwd.jsp" redirect="false" />
      <forward name="noejb" path="/secure/logout.do" redirect="false" />
    </action>
    <action input="/login/j2ee.jsp" name="loginForm" path="/login/login" scope="session" type="com.webconnect.user.actions.LoginAction">
      <forward name="success" path="/secure/window.jsp" redirect="true" />
      <forward name="error" path="/login/login.jsp" redirect="false" />
      <forward name="singleSignOnError" path="/login/j2ee_login.jsp" redirect="false" />
      <forward name="expired" path="/secure/changepwd.jsp" redirect="false" />
      <forward name="noejb" path="/secure/logout.do" redirect="false" />
    </action>

My problem is, if I use the normal login, instead of the login.do the j2ee_login.jsp is called which is absolutly nonsense.

I am not sure if it lies in my struts-config.xml or if my application.xml and/or web.xml is wrong.

The j2ee_login.jsp login form should only be shown if the user calls the url j2ee.jsp and is not authenticated.

I hope anyone can help me with this. (and that security is the right forum to post this...)

thanks a lot, Manuel

[ May 23, 2006: Message edited by: Manuel Manhart ]
[ May 23, 2006: Message edited by: Manuel Manhart ]