About login authentication in ADF Security

Question

I have applied ADF Security in application which I learned from the Cue Cards example and I did it successfully but I wanted to change the login page.
So I created a PopUp which I learned from "Oracle JDeveloper 11g Handbook A Guide to Oracle Fusion Web Development" and instead of the Menu Button, I used a Go Link Button as I had done in the Cue Cards example.
But the problem is how to manage the login/logout authentication. As in the book I created a managed bean to handle login and the code is :
package inventory.controller;
import java.io.IOException;
import javax.faces.application.FacesMessage;
import javax.faces.context.FacesContext;
import javax.security.auth.Subject;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginException;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import weblogic.security.SimpleCallbackHandler;
import weblogic.security.services.Authentication;
import weblogic.servlet.security.ServletAuthentication;
public class LoginHandler {
private String _username;
private String _password;
public LoginHandler() {
super();
public String performLogin() {
byte[] pw = _password.getBytes();
FacesContext ctx = FacesContext.getCurrentInstance();
HttpServletRequest request =
(HttpServletRequest)ctx.getExternalContext().getRequest();
CallbackHandler handler = new SimpleCallbackHandler(_username, pw);
try {
Subject mySubject = Authentication.login(handler);
ServletAuthentication.runAs(mySubject, request);
String loginUrl =
"/adfAuthentication?success_url=/faces" + ctx.getViewRoot().getViewId();
HttpServletResponse response =
(HttpServletResponse)ctx.getExternalContext().getResponse();
sendForward(request, response, loginUrl);
} catch (FailedLoginException fle) {
FacesMessage msg =
new FacesMessage(FacesMessage.SEVERITY_ERROR, "Incorrect Username or Password",
"An incorrect Username or Password" +
" was specified");
ctx.addMessage(null, msg);
} catch (LoginException le) {
reportUnexpectedLoginError("LoginException", le);
return null;
private void sendForward(HttpServletRequest request,
HttpServletResponse response, String loginUrl) {
FacesContext ctx = FacesContext.getCurrentInstance();
RequestDispatcher dispatcher = request.getRequestDispatcher(loginUrl);
try {
dispatcher.forward(request, response);
} catch (ServletException se) {
reportUnexpectedLoginError("ServletException", se);
} catch (IOException ie) {
reportUnexpectedLoginError("IOException", ie);
ctx.responseComplete();
private void reportUnexpectedLoginError(String errType, Exception e) {
FacesMessage msg =
new FacesMessage(FacesMessage.SEVERITY_ERROR, "Unexpected Error During Login",
"Unexpected Error during Login (" + errType +
"), please consult logs for detail");
FacesContext.getCurrentInstance().addMessage(null, msg);
e.printStackTrace();
public String performLogout() {
FacesContext ctx = FacesContext.getCurrentInstance();
HttpServletRequest request =
(HttpServletRequest)ctx.getExternalContext().getRequest();
HttpServletResponse response =
(HttpServletResponse)ctx.getExternalContext().getResponse();
String logoutUrl =
"/adfAuthentication?logout=true&end_url=/faces/home";
sendForward(request, response, logoutUrl);
return null;
public void setUsername(String _username) {
this._username = _username;
public String getUsername() {
return _username;
public void setPassword(String _password) {
this._password = _password;
public String getPassword() {
return _password;
But as I run the page and click the login link, it displays the PopUp box but I think it can't get the username and password from the field inserted and displays the error message specified in the above code(ie in try/catch) when I enter the required username and password and click the login button. So is there something in the code, I ran the application TUHRA which I downloaded, which was an example in the book I specified. and it went well and the login popup worked well.
And I want to know that how to work the button by just pressing Enter key without clicking the button ? And also is there procedural change in the ADF configuration in jDev 11.1.1.1.0 and jDev 11.1.1.5.0 as I have jDev 11.1.1.5.0 installed and there was something different in following the steps specified in the book but I managed it by looking at the cure cards example. So is this the steps problem or something else?
Thanks in advance.

Answer 1

I didn't design the login page but I just created a PopUp window and in the popup window I inserted two Input text fields for username and password.
And i set the 'value' of the username field as "#{login.username}" and the 'value' of the password field as "#{login.password}"
Also in the login button the "action" set to #{login.performLogin}.
And the button which I use to display the popup is a Go Link button, the "Destination" is set to "#{securityContext.authenticated ? "/adfAuthentication?logout=true&end_url=/faces/home.jspx" : "/adfAuthentication?success_url=/faces/home.jspx"} ".
I inserted the popup inside the Go Button in the structure window.
And Added the managed bean in the adfc config.xml with the following properties:
Name as “login”
Class as “inventory.controller.LoginHandler”
Scope as “request”
If I don't use the popup and login with the default generated login form , the login is successful
And also when i removed the ADF security configuration, the meta data didn't go away and when i reconfigured the security some error is diplayed in the log details as cannot create or something like rewrite the users.
Please help I don't have much time to complete my project. its an emergency.
Edited by: SudeepShakya on Nov 4, 2011 10:06 AM