I am trying to set up simple authentication using a database. I am initially trying to secure all web resources, since my application accesses the EJBs via
servlets (and is working fine without security). Later I will tighten things down so that the
EJB's business methods will also have security in place.
It seems that everything is in place but I am unable to authenticate a user when I use a valid login/password combination (I am being redirected to the login error page). No exceptions appear in the
JBoss console, and the database tables appear to be populated with proper values. Hopefully someone reading this can give me a clue as to what is going wrong.
Here is what I have done so far:
1) I have two tables in my database, one for the user_name and password, and another for roles. The database tables look like this:
table name: principals
column: principal_id VARCHAR(64) primary key
column: password VARCHAR(64)
table name: roles
column: principal_id VARCHAR(64)
column: user_role VARCHAR(64)
column: role_group VARCHAR(64)
2) I have added an entry in $JBOSS/server/default/conf/login-config.xml to declare an application policy which uses a DatabaseServerLoginModule. In this entry I have specified the SQl to be used by the module for selecting the password and role, following the example in the JBoss Getting Started Guide (p. 57):
3) I have added a security domain entry in the jboss-web.xml file:
4) I have declared a security constraint in the web.xml file:
5) I have a simple login form (LoginForm.jsp) which encodes j_security_check:
Can anyone see from the above that I have missed something, or that I have done something wrong ?
Is there a way to get more information ? All I see in the access log file are logs of the requests for the servlet, j_security_check, and the login and error pages, and it might be helpful to have a little more information as to what is going on.
Thanks in advance for any insight.
-James
