In WAS Form Based Authentication : Exception Servlet Not Found: FormLoginSe

Hi,
I am using form bases athentivation in WebSpahe Application Server.
When I am send the login.jsp then this exception is comming
com.ibm.ws.webcontainer.servlet.exception.ServletNotFoundException: Servlet Not Found: FormLoginServlet
with regards
Siddharth
([email protected])

Similar Messages

Does weblogic 5.1 support form based authentication of servlets

          Hi,
          Does weblogic 5.1 support form based authentication?
          If yes is any setup need to be done?
          <HTML>
          <BODY>
          This is a test for form based authentication
          <FORM action="j_security_check">
          <input type="j_name" value="hi">
          <input type="j_password" value="hi">
               <input type="submit" value="hi">
          </FORM>
          </BODY>
          </HTML>
          If i submit a form to j_security_check, weblogic throws "404 file not found error".
          thanks


          you must add this to yor web.xml file:
          <login-config>
          <auth-method>FORM</auth-method>
          <realm-name>LDAPRealm</realm-name>
          <form-login-config>
          <form-login-page>/logon.jsp</form-login-page>
          <form-error-page>/logonerror.jsp</form-error-page>
          </form-login-config>
          </login-config>
          greetings
          "Cameron Purdy" <[email protected]> wrote:
          >Yes. You have to specify in web.xml per spec.
          >
          >Peace,
          >
          >--
          >Cameron Purdy
          >Tangosol, Inc.
          >http://www.tangosol.com
          >+1.617.623.5782
          >WebLogic Consulting Available
          >
          >
          >"antony" <[email protected]> wrote in message
          >news:[email protected]...
          >>
          >>
          >> Hi,
          >>
          >> Does weblogic 5.1 support form based authentication?
          >> If yes is any setup need to be done?
          >>
          >> <HTML>
          >> <BODY>
          >> This is a test for form based authentication
          >> <FORM action="j_security_check">
          >> <input type="j_name" value="hi">
          >> <input type="j_password" value="hi">
          >> <input type="submit" value="hi">
          >> </FORM>
          >> </BODY>
          >> </HTML>
          >>
          >> If i submit a form to j_security_check, weblogic throws "404 file not
          >found error".
          >>
          >> thanks
          >>
          >
          >

J_security_check in form-based authentication - not checking for blank passwords

I am using the LDAP Security Realm to authenticate against an iPlanet
Directory Server. All works as expected when a user-id and password
are entered for form-based authentication.
However, when a userid is entered but no password, j_security_check
logs the user in successfully. Aparently, this is correct LDAP
behaviour as anonymous login to the LDAP server is permitted. It seems
that the j_security_check servlet should check for blank passwords
before trying to authenticate against the LDAP server and fail
authentication if this is the case.
Has anyone else experienced this problem?

Hi Brian,
I do not believe it is j_security_check's job to check for blank
passwords.
In many security realms, it is "legal" for a user to have a blank
password. j_security_check forwards whatever password was entered so that
even users with blank passwords can be authenticated by the realm on the
backend. For this reason I believe that j_security_check is "doing the
right thing" by just forwarding whatever is presented to it, rather than
having its own logic. It is best if j_security_check just acts as a very
dumb middle man.
If behavior was altered, it is true that your particular problem would be
solved, but then many other people would have a problem with their users
with blank passwords authenticating properly...
Try looking into how to disable anonymous logins on the LDAP end of
things. Hope this helps.
Cheers,
Joe Jerry
brian wrote:
I am using the LDAP Security Realm to authenticate against an iPlanet
Directory Server. All works as expected when a user-id and password
are entered for form-based authentication.
However, when a userid is entered but no password, j_security_check
logs the user in successfully. Aparently, this is correct LDAP
behaviour as anonymous login to the LDAP server is permitted. It seems
that the j_security_check servlet should check for blank passwords
before trying to authenticate against the LDAP server and fail
authentication if this is the case.
Has anyone else experienced this problem?

Catching authentication exception in form-based authentication

Hi.
I have a custom UserManager that implements a simple authentication of username/password.
The web-application is secured using a form-based login-config in web.xml with a form-login-page and a form-error-page. Both these resources points to the same page (login.jsp).
I want to present a relevant error message when the user fails to log-in (providing wrong username or password, or there is an exception in the UserManager). As far as I can tell there is no way to handle this in a straight-forward manner: When I throw an exception in the UserManager this exception is swallowed by OC4J and never propagates to the form-error-page specified in web.xml. All I can do is to provide a "default" message on the error-page saying "Failed to login". There is no way to tell if the login failed due to invalid username/password or if the login failed due to an unexpected exception in the UserManager implementation (i.e. SQLException).
I can go around this by storing the relevant error message in a ThreadLocal variable from the UserManager and retrieve this message from the error jsp page. But this is ugly :)
Shouldn't the form-error-page receive a Throwable in the exception-object? Or is the behavior in OC4J the "standard" way to handle these issues?
Best Regards //Anders

Since no one is replying I'm refreshing the thread with some more info..
Cut from the Servlet 2.3 Specification (in SRV.12.5.3, Form Based Authentication):
When a user attempts to access a protected web resource, the container checks the user s authentication.
If the user is authenticated and possesses authority to access the resource, the requested web resource is activated and a reference to it is returned.
If the user is not authenticated, all of the following steps occur:
1. The login form associated with the security constraint is sent to the client and the URL path triggering the authentication is stored by the container.
2. The user is asked to fill out the form, including the username and password fields.
3. The client posts the form back to the server.
4. The container attempts to authenticate the user using the information from the form.
5. If authentication fails, the error page is returned using either a forward or a redirect, and the status code of the response is set to 401.
6. If authentication succeeds, the authenticated user s principal is checked to see if it is in an authorized role for accessing the resource.
7. If the user is authorized, the client is redirected to the resource using the stored URL path.
The error page sent to a user that is not authenticated contains information about the failure.
The last sentence could be interpreted as "The container should provide the error page with a valid exception object".
How is this implemented in other servlet containers - JBoss, Websphere, Weblogic, Orion?
//Anders

Faces context not found (Form based authentication)

<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<url-pattern>/jsp/WorkingZone.jsp</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>Example Form-Based Authentication Area</realm-name>
<form-login-config>
<form-login-page>/Login/login.jsp</form-login-page>
<form-error-page>/Login/error.jsp</form-error-page>
</form-login-config>
</login-config>
when i tried to login with valid user the the url shows
http://localhost:8080/FormAuth/jsp/WorkingZone.jsp
how to append faces context automatically.
I am not finding for this faces context.
Plz suggest me a solution soon.
Thanks
Raghavendra Pattar

The FacesContext is created by FacesServlet which is
definied in the web.xml with an url-pattern.
If you just follow the url-pattern of this
FacesServlet, usually /faces/ or *.faces, or *.jsf,
then the FacesContext will be created.Hi balu,
this is the web.xml that i am using
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>server</param-value>
</context-param>
<context-param>
    <param-name>javax.faces.CONFIG_FILES</param-name>
    <param-value>/WEB-INF/navigation.xml,/WEB-INF/managed-beans.xml</param-value>
</context-param>
<context-param>
    <param-name>com.sun.faces.validateXml</param-name>
    <param-value>true</param-value>
</context-param>
<context-param>
    <param-name>com.sun.faces.verifyObjects</param-name>
    <param-value>false</param-value>
</context-param>
<filter>
    <filter-name>UploadFilter</filter-name>
    <filter-class>com.sun.rave.web.ui.util.UploadFilter</filter-class>
    <init-param>
      <description>
          The maximum allowed upload size in bytes. If this is set
          to a negative value, there is no maximum. The default
          value is 1000000.
        </description>
      <param-name>maxSize</param-name>
      <param-value>1000000</param-value>
    </init-param>
    <init-param>
      <description>
          The size (in bytes) of an uploaded file which, if it is
          exceeded, will cause the file to be written directly to
          disk instead of stored in memory. Files smaller than or
          equal to this size will be stored in memory. The default
          value is 4096.
        </description>
      <param-name>sizeThreshold</param-name>
      <param-value>4096</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>UploadFilter</filter-name>
    <servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet>
    <servlet-name>ThemeServlet</servlet-name>
    <servlet-class>com.sun.rave.web.ui.theme.ThemeServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>ThemeServlet</servlet-name>
    <url-pattern>/theme/*</url-pattern>
</servlet-mapping>
<welcome-file-list>
    <welcome-file></welcome-file>
     </welcome-file-list>
<jsp-config>
    <jsp-property-group>
      <url-pattern>*.jspf</url-pattern>
      <is-xml>true</is-xml>
    </jsp-property-group>
</jsp-config>
<security-constraint>
    <display-name>Example Security Constraint</display-name>
    <web-resource-collection>
      <web-resource-name>Protected Area</web-resource-name>
      <url-pattern>/secure/*</url-pattern>
        <http-method>GET</http-method>
      <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>manager</role-name>
    </auth-constraint>
</security-constraint>

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Example Form-Based Authentication Area</realm-name>
    <form-login-config>
      <form-login-page>/Login/login.jsp</form-login-page>
      <form-error-page>/Login/error.jsp</form-error-page>
    </form-login-config>
</login-config>

<security-role>
    <role-name>manager</role-name>
</security-role>
</web-app>1)My requirement is Login page should be the first page
If enter the valid user and password
then i will get directory structure
when i click the secured JSF page inside secure
i got this URL
http://localhost/secure/WorkingZone.jsp
obiviously /faces is missing
and i am getting faces context not found.
If u need further clarification i will send u..
Plz reply me...

Form Based Authentication not working for my sharepoint site.

I am using FIM 2010 r2 on Sharepoint -80 . I tried to use forms based authentication instead of default windows based auth. But the site is not even redirecting to the custom login page i am trying to connect .
Any suggestions ?

Issue has been resolved. There was no interesting work-a-round or fix involved.

Logout Functionality in Form Based Authentication Not Working Properly

Hi All,
I am using Form Based Authentication in ADF. In this I followed the following steps:-
1.Login On Page.
2.In successful login page ,copy the url
3.Click on "Logout"
4.Paste the url in login page and click enter
5.System taking me back to that page where I can perform all the actions.
But the Login operation should not happen just by entering the url. Please provide any help how to stop redirecting to my authenticated page just by typing the url. This is a big security constraint.Any Assistance to this is highly appreciated.
Thanks & Regards
Lovenish Garg

Hi BaiG,
For Login I am using the form based authentication and for logout here is my code:-
public void logout() {
ExternalContext ectx =
FacesContext.getCurrentInstance().getExternalContext();
HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
HttpSession session = (HttpSession)ectx.getSession(false);
session.invalidate();
response.setHeader("Cache-Control", "no-cache");
response.setHeader("expires", "0");
response.setHeader("Pragma", "no-cache");
try {
response.sendRedirect("AdminLogin.html");
} catch (IOException e) {
logger.severe(e.getMessage());
//Inform JSF to not take the response in hands
FacesContext.getCurrentInstance().responseComplete();
logger.info("session invalidated");
Thanks,
Lovenish Garg

Performing form based authentication with entities

Hey everyone,
Im in a major dilemma.Im trying to perform form-based authentication using entities.I have created the entity class from the database,and I used a SLSB to access the bean method via JNDI(when I tried using dependency injection,there was an exception).I also cannot use hibernate as a persistent provider.I used toplink since it is the default in netbeans 5.5.1 and it did not raise any issues.But then,I noticed that toplink is most compatible with the oracle application server,and I use sun java system application server 9.1.I have not been able to successfully perform the authentication.
here's the code:note,there are still bugs as ive been going back and forth trying to find a solution and also because Ive been working with preexisting code.
model:
SLSB
* userValidationBean.java
* Created on 26 March 2008, 18:25
* To change this template, choose Tools | Template Manager
* and open the template in the editor.
package Entities;
import javax.ejb.Stateless;
import javax.ejb.Remote;
import java.util.List;
import javax.persistence.PersistenceContext;
import javax.persistence.EntityManager;
import javax.persistence.Query;
import Entities.UserTable;
import javax.transaction.UserTransaction;
import javax.annotation.Resource;
//the reason for the many comments is that im still debugging and there are still some bugs.Ive also been trying to go back and forth just
//to get a solution.
//the other accompanying classes had preexisting code i wrote earlier.
* @author Ayo
@Stateless
@Remote(userValidationRemote.class)
public class userValidationBean implements Entities.userValidationRemote {
@PersistenceContext private EntityManager manager;
@Resource private javax.transaction.UserTransaction tran;
/** Creates a new instance of userValidationBean */
public userValidationBean() {
//"SELECT u.username,u.password FROM UserTable u WHERE u.username =?1 and u.password=?2"
public boolean checkUser()
try
tran.begin();
UserTable user=new UserTable();
Query query=manager.createQuery("select u.username,u.password from u.user_table where u.username=:username and u.password=:password");
/*query.set("username",user.getUsername());
query.setParameter("password",user.getPassword());*/
query.setParameter("username",user.getUsername());
query.setParameter("password",user.getPassword());
userValidationBean ubean=(userValidationBean)query.getSingleResult();
boolean result=ubean==null?true:false;
tran.commit();
catch(Exception e)
System.out.println("Error:"+e);
// boolean result=ubean==null?true:false;
return result;
remote interface
package Entities;
import javax.ejb.Remote;
import Entities.UserTable;
* This is the business interface for userValidation enterprise bean.
@Remote
public interface userValidationRemote {
public boolean checkUser();
controller:servlet
* userCheck.java
* Created on 15 March 2008, 22:41
package servlets;
import Entities.UserTable;
import Entities.userValidationBean;
import javax.annotation.*;
import Entities.userValidationRemote;
import java.io.*;
import java.net.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
import javax.ejb.*;
import javax.naming.*;
import javax.persistence.*;
* @author Ayo
* @version
public class userCheck extends HttpServlet {
//@EJB userValidationRemote userRemote;
boolean checkUser;
String username,password;
/** Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
* @param request servlet request
* @param response servlet response
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
/*con=null;
ps=null;
rs=null;
s=null;
*/response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
username=request.getParameter("username");
password=request.getParameter("password");
if(username==""||password=="")
//RequestDispatcher de=request.getRequestDispatcher("admin_error.jsp");
//de.forward(request,response);
//showError("<b><font color=\"red\">Invalid Login details!</font></b>",request,response);
showError("<b><font color=\"red\">Please fill in the required blanks.</font></b>",request,response);
else
try
Context ctx=new InitialContext();
userValidationRemote userRemote=(userValidationRemote)ctx.lookup("Entities.userValidationRemote");
checkUser= userRemote.checkUser();
//checkUser= userRemote.checkUser();
//return;
//checkUser(UserTable user);
catch(Exception e)
out.println("Error:"+e);
//userValidation.checkUser(UserTable user);
if(checkUser==true)
RequestDispatcher d=request.getRequestDispatcher("blah.jsp");
d.forward(request,response);
else if(checkUser==false)
// RequestDispatcher d=request.getRequestDispatcher("admin_error.jsp");
//d.forward(request,response);
showError("<b><font color=\"red\">Invalid Login details!</font></b>",request,response);
//call bean(stateless or stateful)which access method on entity that validates.
// checkUser(request,response);
/* TODO output your page here
out.println("<html>");
out.println("<head>");
out.println("<title>Servlet userCheck</title>");
out.println("</head>");
out.println("<body>");
out.println("<h1>Servlet userCheck at " + request.getContextPath () + "</h1>");
out.println("</body>");
out.println("</html>");
//out.close();
/* public synchronized void checkUser(HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
if(username==""&&password=="")
showError("<b><font color=\"red\">Please fill in the required blanks.</font></b>",request,response);
else
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select username,password from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
user=rs.getString(1);
pass=rs.getString(2);
//check user type,wether super admin,user or the other subadmins or a regular user.
checkType(request,response);
else
//redirect to admin error page,then close the connection.
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
con.close();
catch(Exception e)
private synchronized void checkType(HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select user_type,user_id,access_level from user_table where username=? and password=?");
ps.setString(1,user);
ps.setString(2,pass);
rs=ps.executeQuery();
if(rs.next())
user_type=rs.getString(1);
user_id=""+rs.getInt(2);
access_level=rs.getString(3);
if(user_type.equals("super")&&(access_level.equals("all")))
//create admin user session,add to the username and the user_id.
//redirect to super admin page,with access rights to create
//health admin,insurance admin and HMO admin.
//pretty cool stuff!
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher dispatcher=request.getRequestDispatcher("admin_user_page.jsp");
dispatcher.forward(request,response);
//session.setAttribute(user_id);
//remember to create a hidden field if you need to pass this information
//to another page and retrieve the super admin id to track his activities.
else if(user_type.equals("health administrator")&&(access_level.equals("Health")))
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher des=request.getRequestDispatcher("health_admin_user_page.jsp");
des.forward(request,response);
//check for other user types,health admin,hmo admin and insurance admin.
else if(user_type.equals("hmo administrator")&&(access_level.equals("HMO")))
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher d=request.getRequestDispatcher("hmo_admin_user_page.jsp");
d.forward(request,response);
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else if(user_type.equals("insurance administrator")&&(access_level.equals("insurance")))
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher de=request.getRequestDispatcher("insurance_admin_user_page.jsp");
de.forward(request,response);
else if(user_type.equals("user")&&(access_level.equals("health")))
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql:http://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select staff_id from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
String staff_id=""+rs.getInt(1);
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select * from health_staff_table where staff_id=?");
ps.setString(1,staff_id);
rs=ps.executeQuery();
if(rs.next())
//retrieve the values from health staff and store them in variables.
//store important variables in user sessions e.g.staff_id,username,place of work for display in the web page.
//redirect to required page.
String first_name=rs.getString("first_name");
String last_name=rs.getString("last_name");
String work_place=rs.getString("place_of_work");
HttpSession session=request.getSession(true);
session.setAttribute("first_name",first_name);
session.setAttribute("last_name",last_name);
session.setAttribute("work_place",work_place);
session.setAttribute("staff_id",staff_id);
//redirect to user page.
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
//catch exception and redirect to page.
else if(user_type.equals("user")&&(access_level.equals("HMO")))
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql:http://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select staff_id from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
String staff_id=""+rs.getInt(1);
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select * from hmo_staff_table where staff_id=?");
ps.setString(1,staff_id);
rs=ps.executeQuery();
if(rs.next())
//retrieve the values from HMO staff and store them in variables.
//store important variables in user sessions e.g.staff_id,username,place of work for display in the web page.
//redirect to required page.
String first_name=rs.getString("first_name");
String last_name=rs.getString("last_name");
String work_place=rs.getString("place_of_work");
HttpSession session=request.getSession(true);
session.setAttribute("first_name",first_name);
session.setAttribute("last_name",last_name);
session.setAttribute("work_place",work_place);
session.setAttribute("staff_id",staff_id);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
//catch exception and redirect to page.
else if(user_type.equals("user")&&(access_level.equals("insurance")))
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql:http://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select staff_id from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
String staff_id=""+rs.getInt(1);
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select * from insurance_staff_table where staff_id=?");
ps.setString(1,staff_id);
rs=ps.executeQuery();
if(rs.next())
//retrieve the values from insurance staff and store them in variables.
//store important variables in user sessions e.g.staff_id,username,place of work for display in the web page.
//redirect to required page.
String first_name=rs.getString("first_name");
String last_name=rs.getString("last_name");
String work_place=rs.getString("place_of_work");
HttpSession session=request.getSession(true);
session.setAttribute("first_name",first_name);
session.setAttribute("last_name",last_name);
session.setAttribute("work_place",work_place);
session.setAttribute("staff_id",staff_id);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
//catch exception and redirect to page.
else
//invalid login details.After all else fails.
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
private void showError(String errorMsg,HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
request.setAttribute("error_msg",errorMsg);
RequestDispatcher dispatcher=request.getRequestDispatcher("admin_error.jsp");
dispatcher.forward(request,response);
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/** Handles the HTTP <code>GET</code> method.
* @param request servlet request
* @param response servlet response
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Handles the HTTP <code>POST</code> method.
* @param request servlet request
* @param response servlet response
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Returns a short description of the servlet.
public String getServletInfo() {
return "Short description";
// </editor-fold>
view
<%@ page contentType="text/html; charset=utf-8" language="java" import="java.sql.*" errorPage="" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Login</title>
<style type="text/css">

</style>
</head>
<body>
<table width="564" border="0" align="center">
<tr>
<td width="558" bgcolor="#CCCCCC" class="style1"><div align="center">
<p> </p>
<h1 class="style7">Welcome to HealthPort</h1>
<p>HealthPort Login</p>
<p><span class="style8">Today's date is:<%= new java.util.Date() %></span></p>
<form id="form1" name="form1" method="post" action="userCheck">
<p align="right" class="style3">Username
<label></label>
<input type="text" name="username" id="username" />
</p>
<p align="right" class="style3">Password
<input type="password" name="password" id="password" />
</p>
<p align="right" class="style3">
<span class="style6">
<label></label>
<label></label>
</span>
<span class="style5">
<label></label>
</span>
<label>
<input type="submit" name="button" id="button" value="Login" />
</label>
</p>
<div align="right">
</div></form>
<div align="right"><div align="left"><p align="right"> </p>
</div></div></div></td>
</tr>
<tr>
<td bgcolor="#CCCCCC" class="style1"> </td>
</tr>
</table>
</body>
</html>
so,that's about it.I'd appreciate it.I know this is a lot.I'm grateful
Ayo.

Hi.Im still having issues trying to perform form based authenticatin with entities.I tried this method but im getting errors on the marked lines.
controller servlet
* userCheck.java
* Created on 15 March 2008, 22:41
package servlets;
import Entities.UserTable;
import Entities.userValidationBean;
import javax.annotation.*;
import Entities.userValidationRemote;
import java.io.*;
import java.net.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
import javax.ejb.*;
import javax.naming.*;
import javax.persistence.*;
* @author Ayo
* @version
public class userCheck extends HttpServlet {
//@EJB userValidationRemote userRemote;
boolean checkUser;
String username,password;
/** Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
* @param request servlet request
* @param response servlet response
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
/*con=null;
ps=null;
rs=null;
s=null;
*/response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
username=request.getParameter("username");
password=request.getParameter("password");
if(username==""||password=="")
showError("<b><font color=\"red\">Please fill in the required blanks.</font></b>",request,response);
else
try
Context ctx=new InitialContext();
userValidationRemote userRemote=(userValidationRemote)ctx.lookup("Entities.userValidationRemote");
(error on this line-saying ')' expected and no matter if i add ) there is still erro)userRemote.authenticate(String p_user,String p_password);
catch(Exception e)
out.println("Error:"+e);
if(checkUser==true)
RequestDispatcher d=request.getRequestDispatcher("blah.jsp");
d.forward(request,response);
else if(checkUser==false)
showError("<b><font color=\"red\">Invalid Login details!</font></b>",request,response);
private void showError(String errorMsg,HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
request.setAttribute("error_msg",errorMsg);
RequestDispatcher dispatcher=request.getRequestDispatcher("admin_error.jsp");
dispatcher.forward(request,response);
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/** Handles the HTTP <code>GET</code> method.
* @param request servlet request
* @param response servlet response
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Handles the HTTP <code>POST</code> method.
* @param request servlet request
* @param response servlet response
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Returns a short description of the servlet.
public String getServletInfo() {
return "Short description";
// </editor-fold>
view
<%@ page contentType="text/html; charset=utf-8" language="java" import="java.sql.*" errorPage="" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Login</title>
<style type="text/css">

</style>
</head>
<body>
<table width="564" border="0" align="center">
<tr>
<td width="558" bgcolor="#9DACBF" class="style1"><div align="center">
<p> </p>
<h1 class="style7">Welcome to HealthPort</h1>
<p>HealthPort Login</p>
<p><span class="style8">Today's date is:<%= new java.util.Date() %></span></p>
<form id="form1" name="form1" method="post" action="userCheck">
<p align="right" class="style3">Username
<label></label>
<input type="text" name="username" id="username" />
</p>
<p align="right" class="style3">Password
<input type="password" name="password" id="password" />
</p>
<p align="right" class="style3">
<span class="style6">
<label></label>
<label></label>
</span>
<span class="style5">
<label></label>
</span>
<label>
<input type="submit" name="button" id="button" value="Login" />
</label>
</p>
<div align="right">
</div></form>
<div align="right"><div align="left"><p align="right"> </p>
</div></div></div></td>
</tr>
<tr>
<td bgcolor="#CCCCCC" class="style1"> </td>
</tr>
</table>
</body>
</html>
SLSB (implements userValidationRemote)
* userValidationBean.java
* Created on 26 March 2008, 18:25
* To change this template, choose Tools | Template Manager
* and open the template in the editor.
package Entities;
import javax.ejb.Stateless;
import javax.ejb.Remote;
import javax.persistence.PersistenceContext;
import javax.persistence.EntityManager;
import javax.persistence.Query;
import Entities.UserTable;
import javax.annotation.*;
//import javax.transaction.UserTransaction;
* @author Ayo
@Stateless(mappedName="ejb/facade/userValidationBean")
@Remote(userValidationRemote.class)
(error on this line saying can't find class TransactionManagement)@TransactionManagement(value=TransactionManagementType.CONTAINER)
public class userValidationBean implements Entities.userValidationRemote {
@PersistenceContext(unitName="HealthInsuranceApp-ejbPU") private EntityManager manager;
/** Creates a new instance of userValidationBean */
public userValidationBean() {
//"SELECT u.username,u.password FROM UserTable u WHERE u.username =?1 and u.password=?2"
public boolean authenticate(String p_user,String p_password)
UserTable m_user=manager.find(UserTable.class,p_user);
if(m_user!=null)
return m_user.getPassword().equals(p_password);
return false;
Entity
* UserTable.java
* Created on 29 March 2008, 13:24
* To change this template, choose Tools | Template Manager
* and open the template in the editor.
package Entities;
import java.io.Serializable;
import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.Id;
import javax.persistence.Table;
* Entity class UserTable
* @author Ayo
@Entity(name="qs_UserPwd")
@Table(name = "user_table")
public class UserTable implements Serializable {
@Id
@Column(name = "user_id", nullable = false)
private Integer userId;
@Column(name = "username")
private String username;
@Column(name = "password")
private String password;
@Column(name = "user_type")
private String userType;
@Column(name = "access_level")
private String accessLevel;
@Column(name = "staff_id")
private Integer staffId;
@Column(name = "staff_type", nullable = false)
private String staffType;
@Column(name = "time_created")
private String timeCreated;
@Column(name = "time_modified")
private String timeModified;
@Column(name = "time_logged_in")
private String timeLoggedIn;
@Column(name = "time_logged_out")
private String timeLoggedOut;
@Column(name = "created_by")
private String createdBy;
/** Creates a new instance of UserTable */
public UserTable() {
* Creates a new instance of UserTable with the specified values.
* @param userId the userId of the UserTable
public UserTable(Integer userId) {
this.userId = userId;
* Creates a new instance of UserTable with the specified values.
* @param userId the userId of the UserTable
* @param staffType the staffType of the UserTable
public UserTable(Integer userId, String staffType) {
this.userId = userId;
this.staffType = staffType;
public UserTable(String p_user,String p_password)
setUsername(p_user);
setPassword(p_password);
* Gets the userId of this UserTable.
* @return the userId
public Integer getUserId() {
return this.userId;
* Sets the userId of this UserTable to the specified value.
* @param userId the new userId
public void setUserId(Integer userId) {
this.userId = userId;
* Gets the username of this UserTable.
* @return the username
public String getUsername() {
return this.username;
* Sets the username of this UserTable to the specified value.
* @param username the new username
public void setUsername(String p_user) {
p_user = username;
* Gets the password of this UserTable.
* @return the password
public String getPassword() {
return this.password;
* Sets the password of this UserTable to the specified value.
* @param password the new password
public void setPassword(String p_password) {
p_password=password;
* Gets the userType of this UserTable.
* @return the userType
public String getUserType() {
return this.userType;
* Sets the userType of this UserTable to the specified value.
* @param userType the new userType
public void setUserType(String userType) {
this.userType = userType;
* Gets the accessLevel of this UserTable.
* @return the accessLevel
public String getAccessLevel() {
return this.accessLevel;
* Sets the accessLevel of this UserTable to the specified value.
* @param accessLevel the new accessLevel
public void setAccessLevel(String accessLevel) {
this.accessLevel = accessLevel;
* Gets the staffId of this UserTable.
* @return the staffId
public Integer getStaffId() {
return this.staffId;
* Sets the staffId of this UserTable to the specified value.
* @param staffId the new staffId
public void setStaffId(Integer staffId) {
this.staffId = staffId;
* Gets the staffType of this UserTable.
* @return the staffType
public String getStaffType() {
return this.staffType;
* Sets the staffType of this UserTable to the specified value.
* @param staffType the new staffType
public void setStaffType(String staffType) {
this.staffType = staffType;
* Gets the timeCreated of this UserTable.
* @return the timeCreated
public String getTimeCreated() {
return this.timeCreated;
* Sets the timeCreated of this UserTable to the specified value.
* @param timeCreated the new timeCreated
public void setTimeCreated(String timeCreated) {
this.timeCreated = timeCreated;
* Gets the timeModified of this UserTable.
* @return the timeModified
public String getTimeModified() {
return this.timeModified;
* Sets the timeModified of this UserTable to the specified value.
* @param timeModified the new timeModified
public void setTimeModified(String timeModified) {
this.timeModified = timeModified;
* Gets the timeLoggedIn of this UserTable.
* @return the timeLoggedIn
public String getTimeLoggedIn() {
return this.timeLoggedIn;
* Sets the timeLoggedIn of this UserTable to the specified value.
* @param timeLoggedIn the new timeLoggedIn
public void setTimeLoggedIn(String timeLoggedIn) {
this.timeLoggedIn = timeLoggedIn;
* Gets the timeLoggedOut of this UserTable.
* @return the timeLoggedOut
public String getTimeLoggedOut() {
return this.timeLoggedOut;
* Sets the timeLoggedOut of this UserTable to the specified value.
* @param timeLoggedOut the new timeLoggedOut
public void setTimeLoggedOut(String timeLoggedOut) {
this.timeLoggedOut = timeLoggedOut;
* Gets the createdBy of this UserTable.
* @return the createdBy
public String getCreatedBy() {
return this.createdBy;
* Sets the createdBy of this UserTable to the specified value.
* @param createdBy the new createdBy
public void setCreatedBy(String createdBy) {
this.createdBy = createdBy;
* Returns a hash code value for the object. This implementation computes
* a hash code value based on the id fields in this object.
* @return a hash code value for this object.
@Override
public int hashCode() {
int hash = 0;
hash += (this.userId != null ? this.userId.hashCode() : 0);
return hash;
* Determines whether another object is equal to this UserTable. The result is
* <code>true</code> if and only if the argument is not null and is a UserTable object that
* has the same id field values as this object.
* @param object the reference object with which to compare
* @return <code>true</code> if this object is the same as the argument;
* <code>false</code> otherwise.
@Override
public boolean equals(Object object) {
// TODO: Warning - this method won't work in the case the id fields are not set
if (!(object instanceof UserTable)) {
return false;
UserTable other = (UserTable)object;
if (this.userId != other.userId && (this.userId == null || !this.userId.equals(other.userId))) return false;
return true;
* Returns a string representation of the object. This implementation constructs
* that representation based on the id fields.
* @return a string representation of the object.
@Override
public String toString() {
return "Entities.UserTable[userId=" + userId + "]";
please what do I do? or is there a better way? seems like my appserver(sun java system app server 9.1)doesnt support dependency injection as
there's always an exception in the server log when i try it.i use the default transaction provider toplink because use of any of the others raises an exception and my application index page never shows. please i need help? I want to be able to succesfully perform this authentication as its the only way i can move to the next level
Ayo.

Form-based authentication problem with weblogic

Hi Everyone,
The following problem related to form-based authentication
was posted one week ago and no reponse. Can someone give it
a shot? One more thing is added here. When I try it on J2EE
server and do the same thing, I didn't encounter this error
message, and I am redirected to the homeage.
Thanks.
-John
I am using weblogic5.1 and RDBMSRealm as the security realm. I am having the following problem with the form-based authentication login mechanism. Does anyone have an idea what the problem is and how to solve it?
When I login my application and logout as normal procedure, it is OK. But if I login and use the browser's BACK button to back the login page and try to login as a new user, I got the following error message,
"Form based authentication failed. Could not find session."
When I check the LOG file, it gives me the following message,
"Form based authentication failed. One of the following reasons could cause it: HTTP sessions are disabled. An old session ID was stored in the browser."
Normally, if you login and want to relogin without logout first, it supposes to direct you to the existing user session. But I don't understand why it gave me this error. I also checked my property file, it appears that the HTTP sessions are enabled as follows,
weblogic.httpd.session.enable=true

Hi...
Hehe... I actually did implement the way you implement it. My login.jsp actually checks if the user is authenticated. If yes, then it will forward it to the home page. On the other hand, I used ServletAuthentication to solve the problem mentioned by Cameron where Form Authentication Failed usually occurs for the first login attempt. I'm also getting this error occasionally. Using ServletAuthentication totally eliminates the occurence of this problem.
I'm not using j_security_check anymore. ServletAuthentication does all the works. It also uses RDBMSRealm to authenticate the user. I think the biggest disadvantage I can see when using ServletAuthentication is that the requested resource will not be returned after authentication cause the page returned after authenticating the user is actually hard coded (for my case, it's the home.jsp)
cheers...
Jerson
"John Wang" <[email protected]> wrote:
>
Hi Jerson,
I tried your code this weekend, it didn't work in my case. But
I solved my specific problem other way. The idea behind my problem is that the user tries to relogin when he already logs in. Therefore, I just redirect the user into another page when he is getting the login page by htting the BACK button, rather than reauthenticate the user as the way you did.
But, I think your idea is very helpful if it could work. Problems such multiple concurrence logins can be solved by pre-processing.
In your new code, you solved the problem with a new approach. I am just wondering, do you still implement it with your login.jsp file? In other word, your action in login.jsp is still "Authenticate"? Where do you put the URL "j_security_check"?
Thanks.
-John
"Jerson Chua" <[email protected]> wrote:
I've solved the problem by using ServletAuthentication. So far I'm not getting the error message. One of the side effects is that it doesn't return the requested URI after authentication, it will always return the home page.
Jerson
package com.cyberj.catalyst.web;
import weblogic.servlet.security.*;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
public class Authenticate extends HttpServlet {
private ServletAuthentication sa = new ServletAuthentication("j_username", "j_password");
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, java.io.IOException {
int authenticated = sa.weak(request, response);
if (authenticated == ServletAuthentication.NEEDS_CREDENTIALS ||
authenticated == ServletAuthentication.FAILED_AUTHENTICATION) {
response.sendRedirect("fail_login.jsp");
} else {
response.sendRedirect("Home.jsp");
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, java.io.IOException {
doPost(request, response);
"Jerson Chua" <[email protected]> wrote:
The problem is still there even if I use page redirection. Grrr... My boss wants me to solve this problem so what are the alternatives I can do? Are there any other ways of authenticating the user? In my web tier... I'm using isUserInRole, getRemoteUser and the web tier actually connects to EJBs. If I implement my custom authentication, I wouldn't be able to use this functionalities.
Has anyone solved this problem? I've tried the example itself and the same problem occurs.
Jerson
"Cameron Purdy" <[email protected]> wrote:
Jerson,
First try it redirected (raw) to see if that indeed is the problem ... then
if it works you can "fix" it the way you want.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"Jerson Chua" <[email protected]> wrote in message
news:[email protected]...
Hi...
Thanks for your suggestion... I've actually thought of that solution. Butusing page redirection will expose the user's password. I'm thinking of
another indirection where I will redirect it to another servlet but the
password is encrypted.
What do you think?
thanks....
Jerson
"Cameron Purdy" <[email protected]> wrote:
Maybe redirect to the current URL after killing the session to let the
request clean itself up. I don't think that a lot of the request (such
as
remote user) will be affected by killing the session until the nextrequest
comes in.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"Jerson Chua" <[email protected]> wrote in message
news:[email protected]...
Hello guys...
I've a solution but it doesn't work yet so I need your help. Because
one
of the reason for getting form base authentication failed is if an
authenticated user tries to login again. For example, the one mentionedby
John using the back button to go to the login page and when the user logsin
again, this error occurs.
So here's my solution
Instead of submitting the page to j_security_check, submit it to a
servlet
which will check if the user is logged in or not. If yes, invalidates its
session and forward it to j_security_check. But there's a problem in this
solution, eventhough the session.invalidate() (which actually logs theuser
out) is executed before forwarded to j_security_check, the user doesn't
immediately logged out. How did I know this, because after calling
session.invalidate, i tried calling request.RemoteUser() and it doesn't
return null. So I'm still getting the error. What I want to ask you guyis
how do I force logout before the j_security_check is called.
here's the code I did which the login.jsp actually submits to
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
public class Authenticate extends HttpServlet {
public void doPost(HttpServletRequest request, HttpServletResponseresponse)
throws ServletException, java.io.IOException {
if (request.getRemoteUser() != null) {
HttpSession session = request.getSession(false);
System.out.println(session.isNew());
session.invalidate();
Cookie[] cookies = request.getCookies();
for (int i = 0; i < cookies.length; i++) {
cookies.setMaxAge(0);
getServletContext().getRequestDispatcher("/j_security_check").forward(reques
t, response);
public void doGet(HttpServletRequest request, HttpServletResponseresponse)
throws ServletException, java.io.IOException {
doPost(request, response);
let's help each other to solve this problem. thanks.
Jerson
"Jerson Chua" <[email protected]> wrote:
I thought that this problem will be solved on sp6 but to my
disappointment, the problem is still there. I'm also using RDBMSRealm,same
as John.
Jerson
"Cameron Purdy" <[email protected]> wrote:
John,
1. You are using a single WL instance (i.e. not clustered) on that
NT
box
and doing so without a proxy (e.g. specifying http://localhost:7001),
correct?
2. BEA will pay more attention to the problem if you upgrade to SP6.If
you don't have a reason NOT to (e.g. a particular regression), then
you
should upgrade. That will save you one go-around with support: "Hi,I
am
on SP5 and I have a problem.", "Upgrade to SP6 to see if that fixes
it.
Call back if that doesn't work."
3. Make sure that you are not doing anything special before or after
J_SECURITY_CHECK ... make sure that you have everything configuredand
done
by the book.
4. Email BEA a bug report at [email protected] ... see what they say.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"John Wang" <[email protected]> wrote in message
news:[email protected]...
Cameron,
It seems to me that the problem I encountered is different a little
from
what you have, evrn though the error message is the same eventually.
Everytime I go through, I always get that error.
I am using weblogic5.1 and sp5 on NT4.0. Do you have any solutions
to
work
around this problem? If it was a BUG as you
pointed out, is there a way we can report it to the Weblogic
technical support and let them take a look?
Thnaks.
-John
"Cameron Purdy" <[email protected]> wrote:
John,
I will verify that I have seen this error now (after having read
about it
here for a few months) and it had the following characteristics:
1) It was intermittent, and appeared to be self-curing
2) It was not predictable, only seemed to occur at the first
login
attempt,
and may have been timing related
3) This was on Sun Solaris on a cluster of 2 Sparc 2xx's; the
proxy
was
Apache (Stronghold)
4) After researching the newsgroups, it appears that this "bug"
may
have gone away temporarily (?) in SP5 (although Jerson Chua
<[email protected]> mentioned that he still got it in SP5)
I was able to reproduce it most often by deleting the tmpwar and
tmp_deployments directories while the cluster was not running,
then
restarting the cluster. The first login attempt would fail(roughly
90%
of
the time?) and that server instance would then be ignored by the
proxy
for a
while (60 seconds?) -- meaning that the proxy would send all
traffic,
regardless of the number of "clients", to the other server in thecluster.
As far as I can tell, it is a bug in WebLogic, and probably has
been
there
for quite a while.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"John Wang" <[email protected]> wrote in message
news:[email protected]...
Hi Everyone,
The following problem related to form-based authentication
was posted one week ago and no reponse. Can someone give it
a shot? One more thing is added here. When I try it on J2EE
server and do the same thing, I didn't encounter this error
message, and I am redirected to the homeage.
Thanks.
-John
I am using weblogic5.1 and RDBMSRealm as the security realm. I
am
having
the following problem with the form-based authentication login
mechanism.
Does anyone have an idea what the problem is and how to solve it?
When I login my application and logout as normal procedure, it
is
OK.
But
if I login and use the browser's BACK button to back the login
page
and
try
to login as a new user, I got the following error message,
"Form based authentication failed. Could not find session."
When I check the LOG file, it gives me the following message,
"Form based authentication failed. One of the following reasons
could
cause it: HTTP sessions are disabled. An old session ID was stored
in
the
browser."
Normally, if you login and want to relogin without logout first,
it
supposes to direct you to the existing user session. But I don'tunderstand
why it gave me this error. I also checked my property file, it
appears
that
the HTTP sessions are enabled as follows,
weblogic.httpd.session.enable=true

FORM based Authentication issue on Sun ONE AS7

I am trying to use FORM based authentication for a web module I created, and can not get it to work. I have registered the roles through the admin console of the server, and adjusted the web.xml. When I try to use BASIC authentication, I get a 'Authentication refused for []' message before I even log in, and another one after I do. When I use FORM authentication, the URL points to my login.jsp page (no matter what I put in the path, which is what is supposed to happen), however my default servlet (hello.java) is actually run, and the login.jsp page never comes up. I created my jsps and servlet in the mounted [ejb]_WebModule. Please let me know if something seems incorrect here, or if you can think of something I should check...I can't find anything out there to help me.
Here is my web.xml:
<web-app>
<display-name>DiningGuideManager_TestApp</display-name>
<servlet>
<servlet-name>front</servlet-name>
<servlet-class>data.DiningGuideManager_WebModule.hello</servlet-class>
</servlet>
<servlet>
<servlet-name>myPage</servlet-name>
<jsp-file>/myPage.jsp</jsp-file>
</servlet>
<servlet-mapping>
<servlet-name>front</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>30</session-timeout>
</session-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>Security</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Me</role-name>
<role-name>EveryoneElse</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>default</realm-name>
</login-config>
<security-role>
<role-name>Me</role-name>
</security-role>
<security-role>
<role-name>EveryoneElse</role-name>
</security-role>
<ejb-ref>
<ejb-ref-name>ejb/TestedEJB</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<home>data.DiningGuideManagerHome</home>
<remote>data.DiningGuideManager</remote>
<ejb-link>DiningGuideManager</ejb-link>
</ejb-ref>
</web-app>
for FORM authentication I have this:
<login-config>
<auth-method>FORM</auth-method>
<realm-name>default</realm-name>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
Thanks,
Michelle

Yes there's a default generated index.jsp page that I'm having trouble overriding with one of my own. Have you used Form Based Authentication before? To do so you have edit the WEB-INF/web.xml file by adding:
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure Area</web-resource-name>
<url-pattern>/test/secure/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/test/secure/loginpage.jsp</form-login-page>
<form-error-page>/test/secure/errorpage.jsp</form-error-page>
</form-login-config>
</login-config>
When you attempt to first go to any page in my /test/secure/ directory you get redirected to the /test/secure/loginpage.jsp where you have to login as a tomcat user, when succesfully logged on you get redirected to an index.jsp page which is NOT the one I created in test/secure/index.jsp. Even when I type in the url to go to my own test/secure/index.jsp I still don't get my own one that exists there, but instead get the default one that's generated that displays:
"Authentication Mechanism FORM".
Hope that makes more sense.
I've tried restarting tomcat but it makes no difference.

Error in form based authentication

Hi all,
i want 2 implement form based authentication to a dummy resource in iis.
first i created authentication as
Challenge Method Form
Challenge Parameter passthrough: no
creds: usernamevar passwordvar
action: /access/oblix/apps/webgate/bin/webgate.dll
form: /public/login.html
SSL Required No
Challenge Redirect
Enabled Yes
and configured a policy domain for a dummy resource test.html with form authentication schema. i kept that in a folder 'access' which was placed in iis. i mentioned the action attribute to '/access/test.html' in login.html through which i want to do authentication.
but when i am accessing http://*...*/test.html
i am getting http 404 error.
can anyone help me.
Thank you

Hi,
thanks for ur response. i make some changes to my configuration which was given in previous post. now i configured as follows:
i kept my test.html and login.html in the iis root folder. and i defined my policy as follows:
Name : form (policy name)
Enabled : Yes
Resource Resource Type :http
URL Prefix : /test.html
Description
Authorization Rules Name ---- Form authorization
Description ---
Enabled --- Yes
Allow takes precedence ----Yes
Allow Access Role---- Any one
Default Rules
Authentication Rule
name of the authentication: policy form authentication
Authentication Scheme : Form authentication -----------------which was created in Access system console
Authorization Expression
Expression : Form authorization
Duplicate Actions: No policy defined for this Authorization Expression. The Access System level default policy for dealing with duplicate action headers will be employed.
Audit Rule
There is no Audit Rule defined.
Policy Name : form policy
Description :
Resource Type: http
Resource Operation(s) : POST
GET
Resource : all
Authentication Rule
policy auth. rule
Authentication Scheme Form authentication
Authorization Expression
There is no Authorization Expression defined.
Audit Rule
There is no Audit Rule defined.
Delegated Access Admins Delegate Rights
People Administrator
Grant Rights
There are no Delegated Access Admins with this right.
Basic Rights
There are no Delegated Access Admins with this right.
and i also created login.html with a method 'post' and pointed out the action to '/access/oblix/apps/webgate/bin/webgate.dll' . i placed it in IIS root folder.
now my auth. schema is as follows.
form: /login.html action:/access/oblix/apps/webgate/bin/webgate.dll passthrough: no creds: usernamevar passwordvar (which are names of fields in login.html)
and the plugin mapping is as follows:
credential_mapping:obMappingBase="cn=users,dc=orademo,dc=com", obMappingFilter="(&(&(objectclass=User)(sAMAccountName=%usernamevar%) )(|(!(obuseraccountcontrol=*))(obuseraccountcontrol=ACTIVATED)) )"
validate_password: obCredentialPassword="passwordvar"
so when i am accessing http://<hostname>/test.html
it is giving popup window like basic auth. schema. i am not getting my login page. and in that even i am logging as admin . it is saying unauthorized user.
please help me how to configure it.
Edited by: new2idm on Feb 17, 2010 9:19 PM
Edited by: new2idm on Feb 17, 2010 9:19 PM

Form based authentication HTTP 403 access forbidden in WL 8.1

Hi there..
I found following message posted in April-2004 by Sandeep very useful.
I also ended up getting the following HTTP 403 Forbidden access error while using Pageflow controller and Form based authentication.
I noticed 2 things. If you have a normal webapp A, which is a plain old webapp (which does not use pageflow..workshop etc..) then the following error does not occur.
It only happens with those webapps which utilizes WL 8.1's pageflow features. Note that I am not using nested page flows. I just used 1 pageflow controller and wanted to have the form based login feature for the same.
BEA's samples on form authentication talks about nested page flows and javax.security.auth.login.FailedLoginException and etc.. are they only applicable to nested pageflows?
can't I use the same to capture failed login exception within a single controller?
I tried out putting FailedLoginException exception-handler in Global.app file but it didn't catch it. Only the following work around worked. is this a bug in WL 8.1 workshop? or I am missing something.
I would appreciate if someone can clear this doubt.
I am using WL 8.1 with sp3.
Rajesh
Hey guys,
I could find the solution for my problem. Here it is
We need to add following lines of code in the erro.jsp page.
<form action"j_security_check>
....write the error mesage....
</form>
You will get rid of "403 Forbidden page" error.
Thanks,
Sandip
[email protected] (Sandip Atkole) wrote in message news:<[email protected]>...
I am trying to set up Form-Based Authentication on WebLogic 8.1
The Problem:
If the user provides correct userid/password, he gets access to the
protected resource as required, but if he provides incorrect
userid/password, he gets a 403 Forbidden page, instead of getting the
login failure page.
The Descriptors:
WEB.XML
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/Login.jsp</form-login-page>
<form-error-page>/LoginError.jsp</form-error-page>
</form-login-config>
</login-config>
Why doesn't it redirect to "/LoginError.jsp" instead of showing the
403 Forbidden page?
Thanks in advance
Sandip

It seems like a bug. However when I explicitly reset the error using set status it worked for me. I added following code in my error jsp .
<%
     response.setHeader("conent-type","text/html");
     response.setStatus(200);
%>

FORM based authentication

Hi,
I'm using Oracle JDeveloper 9.0.3 with the embedded oc4j. I have configured for simple FORM based authentication by storing username/password in the principals.xml file.
I am presented with the login form correctly when I try to access a protected resource, but my username/password is always rejected (I'm redirected to the error page after trying to log-in). Can someone pls help??
The relevant portions of the contents of the deployment descriptor files that I'm using:
principals.xml
<principals>
<groups>
<group name="securegroup">
<description>secureusers</description>
</group>
</groups>
<users>
<user username="testuser" password="test">
<description>test user </description>
<group-membership group="securegroup" />
</user>
</users>
</principals>
web.xml
<web-app>
<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>

<url-pattern>*</url-pattern>

</web-resource-collection>
<auth-constraint>

<role-name>role1</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>FORM</auth-method>
<realm-name>Example Form-Based Authentication Area</realm-name>
<form-login-config>
<form-login-page>login.jsp</form-login-page>
<form-error-page>error.jsp</form-error-page>
</form-login-config>
</login-config>

<security-role>
<role-name>role1</role-name>
</security-role>
</web-app>
orion-application.xml
<orion-application>
<security-role-mapping name="role1">
<group name="securegroup" />
</security-role-mapping>
</orion-application>
application.xml (stored in my D:\JDeveloper\jdev\MyProj\MyProject\WEB-INF\src\META-INF folder)
<?xml version = '1.0' encoding = 'windows-1252'?>
<!DOCTYPE application PUBLIC "-//Sun Microsystems, Inc.//DTD J2EE Application 1.2//EN" "http://java.sun.com/j2ee/dtds/application_1_2.dtd">
<application>
<security-role-mapping name="role1">
<group name="securegroup" />
</security-role-mapping>
</application>

REPOST
<br><br>
Keywords: form-login, principals.xml, embedded OC4J, authentication
<p>
Please see http://forums.oracle.com/forums/message.jsp?id=1266989
<p>
The provided link does not work.<br><br>
In the application.xml of the OC4j config folder I have comemnted out the: <br> <jazn provider="XML" location="./jazn-data.xml"/>
and added my roles mappings from web.xml :<br>
     <security-role-mapping name="OES_admin">
          <group name="administrators"/>
     </security-role-mapping>
<p>
plus in proncipals.xml have created an entry for my test user:<p>
          <user username="testusr" password="test">
               <description>Just me</description>
               <group-membership group="users" />
               <group-membership group="guests" />
               <group-membership group="administrators" />
          </user>
<p>
And still cannot run Form-authentication from inside jdeveloper .... authentication runs fine when the app is deployed to Tomcat5
<p>
Help Please, I'm using jdev 10.1.2.0
Message was edited by:
omar71

Ask for help with form based authentication & authorization

Hi:
I encountered the following problem when I tried the form based authentication & authorization (see the attached part of the config files, web.xml, weblogic.xml & weblogic.properties)
1. authorization seems not invoked against the rules specfied, it doesn't go the login error page as long as the user/pwd match, even though the user does not have the necessary role
in the example below, user3 should be denied to access the signin page, but seems no login error page returned, actually I never see any page / error message which complain about the authorization / access control error
2. after authenticate correctly, always get redirected to the / (context root) url, instead of the url prior the login page, for e.g., signin page
Any idea ?
Thanks in advance.
HaiMing
attach config files
web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>MySecureBit1</web-resource-name>
<description>no description</description>
<url-pattern>/control/signin</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>default</realm-name>
<form-login-config>
<form-login-page>/control/formbasedlogin</form-login-page>
<form-error-page>/control/formbasedloginerror</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>the customer role</description>
<role-name>customer</role-name>
</security-role>
weblogic.xml
<security-role-assignment>
<role-name>
customer
</role-name>
<principal-name>
customer_group
</security-role-assignment>
weblogic.properties
weblogic.password.user1=user1pass
weblogic.password.user2=user2pass
weblogic.password.user3=user3pass
weblogic.security.group.customer_group=user1,user2

Hi, Paul:
Thanks a lot for your reply.
Firstly let me just correct a little in the attachment I put previously, I think I missed following lines :
<auth-constraint>
<description>no description</description>
<role-name>customer</role-name>
</auth-constraint>
So, user1 & user2 are in the customer group, but user3 not, and /control/singin is protected by this security constraint, as a result, when anyone click the link to /control/singin, he was led to the login page, if he tries to login as user1 & user2, he should pass & led to original page (in this case /control/singin, and my code's logic, once /control/signin is used, means that he already login successfully & redirected to the login success page), but if he tries to login as user3, he should only pass the authentication check, but fail the authorization check, and led to login error page.
What not happen are :
1. user1 & user2 pass, but redirect to /
2. user3 also pass, because I see that debug message shows also get redirected to /, instead of login error page
(login error page will be displayed, only if I try to login as a user with either wrong userid, or wrong password)
3. one more thing I notice after I first time post the message, the container does not remember the principal, after 1. is done, not even for a while
And the similar configuration works under Tomcat 3.2.1, for all 3. mentioned above.
Any idea ?
HaiMing
"Paul Patrick" <[email protected]> wrote:
If I understand what your trying to do, everyone should get access to the
login page since roles are not
associated with principals until after they authenticate. If I follow what
you specified in the XML files,
authenticated users user1 and user2 are members of a group called
customer_group.
The principal customer_group (and therefore its members) is mapped in the
weblogic.xml file to the role
customer.
I can't speak to the reason your being redirected to the document root.
Paul Patrick
"HaiMing" <[email protected]> wrote in message
news:[email protected]...
Hi:
I encountered the following problem when I tried the form basedauthentication & authorization (see the attached part of the config files,
web.xml, weblogic.xml & weblogic.properties)
1. authorization seems not invoked against the rules specfied, itdoesn't go the login error page as long as the user/pwd match, even though
the user does not have the necessary role
in the example below, user3 should be denied to access the signinpage, but seems no login error page returned, actually I never see any page
/ error message which complain about the authorization / access control
error
2. after authenticate correctly, always get redirected to the / (contextroot) url, instead of the url prior the login page, for e.g., signin page
Any idea ?
Thanks in advance.
HaiMing
attach config files
web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>MySecureBit1</web-resource-name>
<description>no description</description>
<url-pattern>/control/signin</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>default</realm-name>
<form-login-config>
<form-login-page>/control/formbasedlogin</form-login-page>
<form-error-page>/control/formbasedloginerror</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>the customer role</description>
<role-name>customer</role-name>
</security-role>
weblogic.xml
<security-role-assignment>
<role-name>
customer
</role-name>
<principal-name>
customer_group
</security-role-assignment>
weblogic.properties
weblogic.password.user1=user1pass
weblogic.password.user2=user2pass
weblogic.password.user3=user3pass
weblogic.security.group.customer_group=user1,user2

Forms Based Authentication in Project Server 2013

Hi,
I have created a PWA web app with SQL Forms Based Authentication. I am able to login and able to see the Project Center page.
But the Project Center Web Part is not getting displayed. Also facing the same issue while
Enterprise Custom Fields and Look up page,
the page is blank
When user tries to edit user in Manage Users page under Security, that page is also blank
Projects ribbon doesn't show up
User not able to create projects
Kindly provide some pointers for the same.
Thanks & regards,
Divyang Agrawal

Hi Kirtesh,
Thanks for the response.
The issue here is not related to hardware, but it is regarding the user not having appropriate rights to do the above mentioned operations.
Are there few more steps that are required for the FBA, where a user needs to be given access rights explicitly.
The users I have used for now have been added to administrator's group and have full rights on the system.
Also, when I try to create a Project in the instance using the CSOM code and passing the user's credentials who is a part of Administrator Group., it gives me a 403 forbidden exception.
Kindly provide some inputs for the same.
Regards,
Divyang Agrawal

In WAS Form Based Authentication : Exception Servlet Not Found: FormLoginSe

Similar Messages

Maybe you are looking for