Authentication in a web application

[John Paterson]

Hi, posted this in another forum and am posting it here now. I am trying out form based authentication and data source realm. The application starts off with a page(logintest.jsp, outside the admin folder) that asks the user to click on a link to view the admin applications, the login page(login.jsp, located inside the admin folder.) appears after the link is clicked. The problem I have is that after typing in the correct username and password,I am expecting the index.jsp page from the "Admin" folder to be displayed, but instead I am seeing a directory listing for the admin foler. I am not sure what is wrong. The following are the contents from my context.xml and web.xml and also the app directory.

web.xml
-------

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0">
<!-- Define two security roles -->  
    <security-role>
        <description>regular user</description>
        <role-name>user</role-name>
    </security-role>
    
    <security-role>
        <description>system administrators</description>
        <role-name>admin</role-name>
    </security-role>
      
     <!-- Restrict access to all files in the /admin folder -->        
    <security-constraint>
    	<web-resource-collection>
            <web-resource-name>Protected Area</web-resource-name>
            <url-pattern>/admin/*</url-pattern>                        
        </web-resource-collection>     
          
        <!-- Authorize the admin and user roles -->          
        <auth-constraint>
            <role-name>admin</role-name>
            <role-name>user</role-name>
        </auth-constraint>
    </security-constraint>
    
    <!-- FORM based authentication -->     
      <login-config>
  		<auth-method>FORM</auth-method>
  			<form-login-config>
  				<form-login-page>/admin/login.jsp</form-login-page>  			
  				<form-error-page>/admin/login_error.jsp</form-error-page>
  		</form-login-config>  	
  	</login-config>      
      
  <welcome-file-list>        
    <welcome-file>logintest.jsp</welcome-file>    
  </welcome-file-list>   
</web-app>

conetxt.xml
-----------

<?xml version="1.0" encoding="UTF-8"?>
<Context path="/myapplication/">
  <Resource name="jdbc/minedb" auth="Container"
	maxActive="100" maxIdle="30" maxWait="10000"
	username="root" password="someroot"
	driverClassName="com.mysql.jdbc.Driver"
	url="jdbc:mysql://localhost:3306/minedb?autoReconnect=true"
	logAbandoned="true" removeAbandoned="true"
	removeAbandonedTimeOut="60" type="javax.sql.DataSource" />
	
	
	<Realm className = "org.apache.catalina.realm.DataSourceRealm" debug="99"
		 dataSourceName="jdbc/minedb" localDataSource="true"
		 userTable="UserPass" userNameCol="Username" userCredCol="Password"
		 userRoleTable="UserRole" roleNameCol="rolename"/>	
</Context>

WebApp directory
----------------
<pre>
WebContent
- admin(folder)
index.jsp
login_error.jsp
login.jsp
- WEB-INF
web.xml
lgintest.jsp
</pre>

Hope someone can advise, thanks.

[Tim Cooke]

What does the code for the link look like?

[John Paterson]

Tim Cooke wrote:What does the code for the link look like?

Hi Tim Cooke,

This is the code for the form, I was expecting to be brought to the index.jsp page after filling and submitting this form, but instead I am getting to see the directory listing.

<p>Please enter your username and password to continue.</p>
<table >
   <form action="j_security_check" method="post">
     <tr>
         <td >Username</td>
         <td><input type="text" name="j_username"></td>
     </tr>
     <tr>
         <td >Password</td>
         <td><input type="password" name="j_password"></td>
     </tr>
     <tr>
       <td><input type="submit" value="Login"></td>
     </tr>
   </form>
 </table>

[Tim Moores]

In that case, index.jsp should be configured as welcome file, not logintest.jsp (assuming that the link goes to the "/" URL - does it?).

Also make sure to configure the server not to show directory listings.