Wildfly - Problems with form based authentication after restart

Question

We have what I believe to be a pretty standard form based authentication for a web application running on wildfly 8.2.

The authentication works well, except that when we stop&start the server some users are unable to log in again.

I have managed to reproduce one variant of this: If I open the login page, /xxxx/app, before I restart, and then try to log in after the server is up again, I end up on a blank /xxxx/j_security_check page. In my logs I can see that the actual authentication is run OK.

If I have understood this j_security_check mechanism properly, it goes something like this:

I access /xxxx/app
Wildfly sees that this url requires authentication. It remembers it and forwards me to login.jsp.
When I submit my login form to the magical j_security_check address it replaces it with the remembered /xxxx/app address.

If this is conceptually correct, I can see that a restart can be troublesome; The web server no longer remembers the /xxxx/app address and doesn't know where to redirect me to.

Does anyone have a workaround for this problem? Any way to give wildfly a default page to go to after j_security_check?

Edit: I found this one: It is probably the same underlying cause: Jboss Wildfly 8.1 session timeout on login page

jboss-web.xml:

<jboss-web>
    <security-domain>ptsmc</security-domain>
    <default-encoding>UTF-8</default-encoding>
</jboss-web>

web.xml:

<servlet-mapping>
    <servlet-name>main</servlet-name>
    <url-pattern>/app/*</url-pattern>
</servlet-mapping>

<!--  -->

<welcome-file-list>
    <welcome-file>index.html</welcome-file>
</welcome-file-list>

<security-constraint>
     <display-name>ptsmc</display-name>
     <web-resource-collection>
         <web-resource-name>ptsmc</web-resource-name>
         <url-pattern>/app/*</url-pattern>
     </web-resource-collection>

     <auth-constraint>
         <role-name>WEB</role-name>
     </auth-constraint>

     <user-data-constraint>
         <transport-guarantee>NONE</transport-guarantee>
     </user-data-constraint>
</security-constraint>

<login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
         <form-login-page>/login.jsp</form-login-page>
         <form-error-page>/error.html</form-error-page>
     </form-login-config>
</login-config>

<security-role>
    <description>Users must have this role to be granted access to Application</description>
    <role-name>WEB</role-name>
</security-role>

login.jsp:

<form name="login_form" method="POST" action="<%=response.encodeURL(request.getContextPath() + "/j_security_check")%>">
    <table>
        <tr><td>User id:</td><td><input type=text name=j_username autofocus onblur="this.value = this.value.toUpperCase();"></td></tr>
        <tr><td>Password:</td><td><input type=password name=j_password></td></tr>
        <tr><td>&nbsp;</td><td><input type=submit value="Submit"></td></tr>
    </table>
</form>

Wildfly - Problems with form based authentication after restart

0 Answers0