Hi!
I look for informations also on j_security_check.
What I understood it is that he allows to protect resources
JSP.
In the web.xml file are indicated the JSPs (login.jsp and error.jsp) the security constraints...
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
< !-- Define the context-relative URL(s) to be protected -->
<url-pattern>/jsp/security/protected/*</url-pattern>
< !-- If you list http methods, only those methods are protected -->
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
< !-- Anyone with one of the listed roles may access this area -->
<role-name>
tomcat</role-name>
<role-name>role1</role-name>
</auth-constraint>
</security-constraint>
< !-- Form-based login is enabled by default. If you wish to<br /> try Basic authentication, comment out the <login-config><br /> section below and uncomment the one above.<br /> -->
<login-config>
<auth-method>FORM</auth-method>
<realm-name>Example Form-Based Authentication</realm-name>
<form-login-config> <form-login-page>/jsp/security/login/login.jsp</form-login-page> <form-error-page>/jsp/security/login/error.jsp</form-error-page>
</form-login-config>
</login-config>
For Tomcat 3.2 it exists a file tomcat-users.xml in the conf directory to indicate the user/password pairs.
My form login.jsp.
http://Server:8080/jsp/security/login/login.jsp]http://Server:8080/jsp/security/login/login.jsp After submit the request arrives on Server (
http://Server:8080/jsp/security/login/j_security_check) it gets fields j_username
and j_password and checks if the username/password pair is OK (see org.apache.tomcat.request.AccessInterceptor.java). If OK, it sends back towards the client the new location.
Server side: 1-incoming
Http://Server:8080/jsp/security/login/j_security_check]Http://Server:8080/jsp/security/login/j_security_check HTTP/1.0 302 Found
2-outcoming: it sends back towards the client the new location.
Location:
http://Server:8080/jsp/security/protected/index.jsp Pierre-Fran�ois Lemosquet
pf.lemosquet@wokup.com Wokup!
http://www.wokup.com [This message has been edited by Pierre-Fran�ois Lemosquet (edited August 17, 2001).]
