Form-based Security

[Matthew Shalorne]

Hi,

I am using jboss-4.0.0RC2. I am trying to use form-based declarative security as described in Head First. My web.xml is:

<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">
 
  <display-name>Certification</display-name>
  <description>no description</description>
 
       <servlet>
      <servlet-name>showlogs</servlet-name>
      <display-name>Show Logs</display-name>
      <description>no description</description>
      <servlet-class>com.onestraw.servlets.ShowLogs</servlet-class>
    </servlet>
    <servlet-mapping>
       <servlet-name>showlogs</servlet-name>
       <url-pattern>/sec/showlogs</url-pattern>
     </servlet-mapping>
 
    <security-role>
        <role-name>admin</role-name>
    </security-role>
    <security-role>
        <role-name>users</role-name>
    </security-role>
    <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>certification</realm-name>
        <form-login-config>
            <form-login-page>/login.html</form-login-page>
            <form-error-page>/loginError.html</form-error-page>
        </form-login-config>
    </login-config>
    <security-constraint>
        <web-resources-collection>
            <web-resource-name>Show Log Records</web-resource-name>
            <url-pattern>/sec/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resources-collection>
        <auth-constraint>
            <role-name>admin</role-name>
        </auth-constraint>
    </security-constraint>
</web-app>

My jboss-web.xml is:

<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users.-->
      <security-domain>java:/jaas/certification</security-domain>
   
</jboss-web>

I have added this to my login-config:

 
    <application-policy name = "certification">
       <authentication>
          <login-module code = "org.jboss.security.auth.spi.UsersRolesLoginModule"
             flag = "required" />
       </authentication>
    </application-policy>

My user.properties has:

 
matthew=frodo
kaylene=bilbo

and my roles.properties has:

 
matthew=admin,users
kaylene=users

both files being in my classes dir in my war.
I am expecting the server to present me with my login form page when I try to access /sec/showlogs but instead it lets me access that servlet without any authentication. Does anyone know what I am doing wrong?

Thx,

[Serghei Jelauc]

I am not sure - never worked with JBoss, but try to check you html fom tag.
It must be like this:

<form method="POST" action="j_security_check">
   <input type="text" name="j_username">
   <input type="password" name="j_password">
   <input type="submit">
</form>

The name of attributes action, name and other name MUST be "j_security_check", "j_username", "j_password" respectively.

Regards.

[Matthew Shalorne]

Thx Serghei - My form tags are right but it never gets to the form page - it doesn't try to. It just lets you go straight to the restricted servlet.

[Matthew Shalorne]

Found a tag that I mis-spelt but I still have no joy because jboss doesn't seem to pick up my password file. The symptoms are that it now takes me to the login page (or login dialog when I use BASIC) but, although I have set up my users.properties etc as per the guide it always thinks my password is wrong! Two and a half days of zero productivity - grrrrr!

[Matthew Shalorne]

Scott Stark, the Chief Technology Officer for JBoss, gave me a solution. If you use the default properties file names as demonstrated in the howto then you run the risk that someone else used the same names in their module to specify their users and they may be earlier in the path in which case the app will find that file and never read yours.
JBoss lets you specify and use a different users.properties file names in the login-config file. If you use unique names and put your properties files in the classes dir of your war it works fine.