BUG? Login Module: How many times is login supposed to be called?

Question

Hi all -
I have what I think is a wierd occurrence going on. I have a custom login module configured for the embedded JDev 10.1.3. The login method of my LoginModule does some System.out.println stuff. What is happening is that it is being called every time a page is requested. Is that the correct behavior? Would this still happen if I used a login form instead of BASIC authentication?
My web.xml looks like this:
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>ALL Components</web-resource-name>
      <url-pattern>*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>corporateuser</role-name>
      <role-name>fielduser</role-name>
    </auth-constraint>
  </security-constraint>
  <security-role>
    <description>Corporate user</description>
    <role-name>corporateuser</role-name>
  </security-role>
  <security-role>
    <description>Field user</description>
    <role-name>fielduser</role-name>
  </security-role>Regards,
John

Answer 1

John,
the problem doesn't sound like a JDeveloper, ADF or ADF BC issue but OC4J. Configuring a custom LoginModule and use it for J2EE authentication is supposed to work as follows:
1. The container recognizes a protected web page that requires authentication
2. The container checks if the user is authenticated. If not, the configured authentication routine is initiated
3. If custom LoginModules are used, then the container calls the custom LoginModules and the LoginModule, after successful authentication, adds the J2EE role principles to the authenticated Subject
4.Starting from here the Container keeps the Subject and thus the authorization information stored in here.
5. Any subsequent request will be check against the authenticated session.
I would expect a re-authentication to happen if the session gets lost (invalidated). There should be no difference in using BASIC or FORM based authentication, except that BASIC authentication requires you to explicitly mention a protection domain (realm).
Speaking for OC4J 10.1.2 I never saw re-authentication occuring, but I haven't tested OC4j 10.1.3 yet - so I cannot tell if there is a bug in OC4J 10.1.3 or not (which I don't hope to be the case).
My plan is to work on a new JAAS example over the next couple of weeks, so chances are that I can verify or not. I'll point someone from the OC4J dev team to this thread in case its a known issue.
Frank