JDBC realm of FORM authentication in Web AS 640

Question

Hi, All,
We try to port a web application from Apache Tomcat to WebAS 6.40. In the application we use FORM authentication based on Tomcat JDBC Realm. The configuration in Tomcat server.xml is like:
<Context...>
  <Resource name="jdbc/mydb" auth="Container" type="javax.sql.DataSource" username="..." password="..." driverClassName="..." url="..."/>
  <Realm className="org.apache.catalina.realm.DataSourceRealm" dataSourceName="jdbc/mydb" digest="MD5" userTable="users"  userNameCol="userName" userCredCol="passwd" userRoleTable="roles" roleNameCol="roleType"/>
</Context>
In database there are 2 tables for authentication purpose: users and roles. There are column userName, passwd in table users and userName, roleType in table roles (correlated with column userName). Then in web.xml we define FORM authentication:
<login-config>
  <auth-method>FORM</auth-method>
  <realm-name>...</realm-name>
  <form-login-config>
    <form-login-page>...</form-login-page>
    <form-error-page>...</form-error-page>
  </form-login-config>
</login-config>
Has anyone tried to port Tomcat JDBC realm mechanism of FORM authentication to WebAS 640? How do we need to configure J2EE server in Visual Administrator or deploy an application with DeployTool to implement the same features? And does WebAS support declarative MD5 digest algorithm in FORM Authentication?
Any help is highly appreciated.
Thanks in advance
John

Answer 1

evnafets wrote:
The way it works is that you declare which pages in your application have got security around them in your web.xml. Whenever a user tries to navigate to one of those pages, they are presented with the login screen. If they login successfully, then they are taken to the page they originally requested.
You should never actually have a link to your login page - the container will serve it when required.Ok, but how do i stop them entering the URL of the login page?
i get this error after logging in correctly if i directly access the login page:
"HTTP Status 400 - Invalid direct reference to form login page"
i tried adding this constraint but it still happens:
<security-constraint>
     <web-resource-collection>
          <web-resource-name>login</web-resource-name>
          <url-pattern>/staffLogin/login.jsp</url-pattern>
     </web-resource-collection>
     <auth-constraint/>
</security-constraint>
>
One possible way around this would be to create a database view which is a union of the two tables, thus giving you one "table" to query for the username/password/role combinations. That should satisfy the realm requirement.
Cheers,
evnafetsThats a good idea, il give that a shot. Thanks.