User Role problems in Sun Java Application Server Platform Edition 8

Question

I am having two problems setting up user roles in Sun Java Application Server Platform Edition 8. At first, I thought that it was a problem with the higher level features that I was using, so I created a very simple example using the simplest authentication I can use, but the problem still occurs. I am using the file realm and configuring the users in the App Server Admin Console. I create 2 users in different roles. One user should have access, the other should not.
1) The first problem is that both users can access the page
2) The second problem is that the isUserInRole() method returns false for both users with the role that it should be authenticating against.
Here is a sample of my code:
Users Configured in Console:
username password roles
user1 ********** admin
user2 ********** noaccess
web.xml
     <security-role>
          <role-name>admin</role-name>
     </security-role>
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>My Protected Area</web-resource-name>
               <url-pattern>/*</url-pattern>
          </web-resource-collection>
          <auth-constraint>
               <role-name>admin</role-name>
          </auth-constraint>
          <user-data-constraint>
               <transport-guarantee>NONE</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
     <login-config>
          <auth-method>BASIC</auth-method>
          <realm-name>file</realm-name>
     </login-config>
     <servlet>
          <servlet-name>
               TestServlet
          </servlet-name>
          <servlet-class>
               mypackage.TestServlet
          </servlet-class>
          <security-role-ref>
               <role-name>admin</role-name>
               <role-link>admin</role-link>
          </security-role-ref>
     </servlet>
     <servlet-mapping>
          <servlet-name>
               TestServlet
          </servlet-name>
          <url-pattern>
               /TestServlet
          </url-pattern>
     </servlet-mapping>
TestServlet.java:
          out.println("admin role: " + request.isUserInRole("admin") + "<BR/>");
Thanks before hand for any responses.
- Brian

Answer 1

Hi Jeanfrancois,
Your suggestion has lead me to find my problem. There were actually three problems.
1) First, you suggestion to reorder my xml file did not cause any errors to occur. I got suspicious that my web.xml file was wrong. I looked at some sample web-xml files and found that I was missing the header as follows:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC '-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN' 'http://java.sun.com/dtd/web-app_2_3.dtd'>
2) When I added this information, the deploy feature failed stating the my web.xml file was out of order. I fixed the ordering. It now deployed, but the security still wasn't working.
3) I then added the sun-web.xml file. This file was missing before hand as I thought it was unnessary. However, this file added the essential mapping from a role to a group. After adding this, it now started to work.
Thanks so much for you time and effort. You really did help me.
- Brian Blank