posted 11 years ago
You have designed and configured a container-managed login.
Container-managed security, as its name implies is handled by the container (web server), not by the web application itself. All the web application does is indicate to the server when authentication is required, what transport channel (BASIC or FORM) will be used to demand credentials, and in the case of FORM-based login, the templates for the login and loginfail forms.
This means:
1. You cannot direct a user directly to the login page via a URL. In other words, "http://www.myserver.com/myapp/login.jsp" will not work properly. It will present the login page, but that page will not be connected to the container's login process, and therefore won't work. To get a login page, the user has to request one of the protected URLs that you defined in the WEB-INF/web.xml file. This will cause the server to check to see if the user is logged in, run the user through the login process, if needed, then present whatever page would normally come from requesting that protected URL.
2. You cannot write special login logic, provide additional login parameters, or expect special post-login or login-fail actions. The login process is handled by a special plugin (Realm) to the server, using a common interface method (authenticate), which accepts 2 parameters (user ID and password) from the container (obtained from the login/loginfail form) and returns a OK/failed status. To repeat, then, no application logic is involved in the container login process.
I think you understood this, based on your examples, but I like to repeat it often, because a lot of people do not.
You do have one problem, however. You have defined a rule that requires authentication on ALL URLs, including the CSS and image URLs on your login/loginfail pages. In other words, to retrieve and display the logo on the login page, you have to already be logged in. In theory, this should have caused some sort of recursion problem, but in reality what I've seen is basically what you reported.
I prefer to keep a public "hello" page myself, so that users can tell what site they've landed on and general news can be displayed. From there I can direct them to the secured part of the site.
And, of course, I exempt the CSS and image URLs from being secured.
Experience keeps a dear School, but Fools will learn in no other.
---
Benjamin Franklin - Postal official and Weather observer
1
