0

I'm creating a web application using Java ee. I have a glassfish v4 server and right now I'm trying to get the security to work by specifying security constraints in my web.xml file.

My application is called linkUI, and I wanted to try to create a protected area where you had to be logged in to access any of the resources at localhost:8080/linkUI/area, so I added a security constraint for this in the web.xml. But when I try to access this adress I get "HTTP Status 404 - Not Found" (I have not created any resources there yet) instead of being redirected to the login page that I have configured in the deployment descriptor. It does seem to find the deployment descriptor because when I log to the login.jsp directly it redirects me to the expected error page. Although login seems to always fail eventhough I added a user and group on the glassfish server and enabled Default Principal to Role Mapping as specified here: http://docs.oracle.com/javaee/6/tutorial/doc/bncbx.html#bncby.

I'm not sure what to check right now. Any suggestions?

This is my web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
     version="3.1">
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
        <!-- SECURITY CONSTRAINT #1 -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Protected area</web-resource-name>
            <url-pattern>/linkUI/area/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>testgroup</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>file</realm-name>
        <form-login-config>
            <form-login-page>/login.jsp</form-login-page>
            <form-error-page>/loginError.jsp</form-error-page>
        </form-login-config>
    </login-config>
    <security-role>
        <description/>
        <role-name>testgroup</role-name>
    </security-role>
</web-app>
numfar
  • 1,637
  • 4
  • 18
  • 39

2 Answers2

0

Have you create authorized user of testgroup with file realm. If not you should follow the instructions of following link.

http://docs.oracle.com/javaee/6/tutorial/doc/bncbx.html#gjjlk

Masudul
  • 21,823
  • 5
  • 43
  • 58
0

If you are protecting localhost:8080/linkUI/area/*, then linkUI is your context root and, by default, the name of your WAR file. Is this the case?

If so, URL patterns should be relative to the context root, thus:

<url-pattern>/area/*</url-pattern>
pyrosguy
  • 1