JDBCRealm and Form Login

[Lars Zinkoff]

I've been trying to get form-based login with jdbcRealm working, but I'm having a few problems.

Spent countless hours searching for an answer, but I can't find a solution.

First, I'll go through my configuration.

In the Glassfish Admin Console, I added a new realm under Configuration->Security->Realms:

Name:              ADPRealm
Class Name:        com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm
JAAS context:      jdbcRealm
JNDI:              jdbc/AjD
User Table:        User
User Name Column:  username
Password Column:   password
Group Table:       Group
Group Name Column: groupname
Assign Group:
Database User:     dbuser
Database Password: dbpass
Digest Algorithm:  MD5
Encoding:          HEX
Charset:

The database connection is working, as I've been using it with the application before adding any login configuration.

I have the following table defined:

User:
     username  VARCHAR(20) NOT NULL PRIMARY KEY
     password  VARCHAR(32) NOT NULL
Group:
     username  VARCHAR(20) NOT NULL PRIMARY KEY, FOREIGN KEY TO User.username
     groupname VARCHAR(20) NOT NULL PRIMARY KEY

User contains: 'admin','76a2173be6393254e72ffa4d6df1030a'
Group contains: 'admin','Administrator'

The login page contains the following form:

                
<form action="j_security_check" method="POST">
    Username: <input type="text" name="j_username" value="" size="15" /><br/><br/>
    Password: <input type="password" name="j_password" value="" size="15" /><br/><br/>
    <input type="submit" value="Login" />
</form>

Next, in web.xml:

    <security-constraint>
        <display-name>AdministratorConstraint</display-name>
        <web-resource-collection>
            <web-resource-name>Administrator</web-resource-name>
            <description/>
            <url-pattern>*.jsp</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
            <http-method>HEAD</http-method>
            <http-method>PUT</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>TRACE</http-method>
            <http-method>DELETE</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description/>
            <role-name>Administrator</role-name>
            </auth-constraint>
        <user-data-constraint>
            <description/>
            <transport-guarantee>NONE</transport-guarantee>
        </user-data-constraint>
        </security-constraint>
    <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>ADPRealm</realm-name>
        <form-login-config>
            <form-login-page>/login.jsp</form-login-page>
            <form-error-page>/loginError.jsp</form-error-page>
            </form-login-config>
        </login-config>
    <security-role>
        <description/>
        <role-name>Administrator</role-name>
    </security-role>

And lastly, sun-web.xml:

  <security-role-mapping>
    <role-name>Administrator</role-name>
    <principal-name>admin</principal-name>
    <group-name>Administrator</group-name>
  </security-role-mapping>

Submitting my username/password on the login page results in a login failure, directing me to the login error page.

SEC5046: Audit: Authentication refused for [admin].
Web login failed: Login failed: javax.security.auth.login.LoginException: Failed file login for admin.

I found a blog post that suggested CHECKing " Default Principal To Role Mapping" under the Glassfish Security options:

http://gesker.blogspot.com/2007/03/jspwikiglassfish-install-part-11-of-18.html

In addition, I added the following to domain.xml (in order to get more detailed information):

<jvm-options>-Djava.security.debug=logincontext</jvm-options>

The result was the following:

SEC1112: Cannot validate user [admin] for JDBC realm.
        [LoginContext]: original security exception with detail msg replaced by new exception with empty detail msg
        [LoginContext]: original security exception: com.sun.enterprise.security.LoginException: Failed jdbc login for admin.
        [LoginContext]: login REQUIRED failure
        [LoginContext]: abort ignored
SEC5046: Audit: Authentication refused for [admin].
Web login failed: Login failed: javax.security.auth.login.LoginException: Security Exception

Any help would be appreciated.

[ January 14, 2008: Message edited by: Lars Zinkoff ]
[ January 14, 2008: Message edited by: Lars Zinkoff ]

[feri guretno]

Hi Zinkoff,

I also face exactly the same problem and exactly the same exception. I also have tried the login context , change to FINEST etc etc , but all of them doesn't work. Untill i found this forum and it seems that you have the same problems. btw, I use oracle for the database.

Someone tried to fill UTF-8 for the charset or change digest to "none" to use a clear text password but it doesn't work for me. See if it works in your code.

do you have already get the solution? Please help.



Guret

[feri guretno]

Allright!! I've got the solution.

if you use a cleartext password , set digest to "none". If it still doesn't work, try to change column name "password" in usertable to other name e.g "pwd". Sometimes column password is reserved by the database itself that prevent the jdbc realm to work properly.

Guret

[Singireddy subbareddy]

How to configure Glassfish with jdbc realm?
(i got this Error : SEC5046: Audit: Authentication refused for [admin].)

if you know please give me reply [email protected]