Form Auth with HttpClient 4.01 and JAVASSO Partnering Application

Question

I am using Apache Commons HttpClient 4.01 and tyring to perform a form authentication against a web application that is a OC4J 10.1.3 instance using JavaSSO Partnering Application. The stock Login provided by 10.1.3 has 'j_security_check', 'j_username' and 'j_password' form fields.
I am doing a post against the SSOLogin page - (Sample) http://my.localhost.com/jsso/SSOLogin:
<form action="j_security_check" name="loginForm" method="post">
<input class="inputBox" type="text" id="username" name="j_username" maxlength="64" tabindex="1"/>
<input class="inputBox" type="password" id="password" name="j_password" maxlength="64" tabindex="2"/>
<input class="submit" type="submit" name="submit" value="Login" tabindex="3"/>
</form>
Here's the code I'm using to post:
DefaultHttpClient httpclient = new DefaultHttpClient();
HttpGet httpget = new HttpGet("http://my.localhost.com/jsso/SSOLogin");
HttpResponse response = httpclient.execute(httpget);
HttpEntity entity = response.getEntity();
EntityUtils.consume(entity);
List<Cookie> cookies = httpclient.getCookieStore().getCookies();
HttpPost httpost = new HttpPost("http://my.localhost.com/jsso/SSOLogin");
List<NameValuePair> formParams = new ArrayList<NameValuePair>();
formParams.add(new BasicNameValuePair("j_username", "testuser"));
formParams.add(new BasicNameValuePair("j_password", "testpassword123"));
UrlEncodedFormEntity urlCode = new UrlEncodedFormEntity(formParams, HTTP.UTF_8);
httpost.setEntity(urlCode);
response = httpclient.execute(httpost);
entity = response.getEntity();
For whatever reason the page does execute the action tied to 'j_security_check'. I've tried the same code against other sites that use form authentication and it works OK. Is there anything concerning OC4J 10.1.3 and JAVASSO Partnering Application I'm overlooking?
Any insight would be appreciated.

Answer 1

The JavaSSO login is using standard form based login. This means that the client has to be session aware. When the login page (http://my.site.com/jsso/SSOLogin) is accessed, cookie will be set. Ensure that the cookie is set back on the next request sent to the server. The username and password credentials should be posted to http://my.site.com/jsso/j_security_check and not to the URLs you attempted.