Please help me setup the Form Based Authentication in WAS

[Binh Nguyen]

Hi,
I am using custom-user-registry to protect web resource. I have setup everything. when start the Admin Console, it asked me for the user name and password, I entered those parameters and it let passed that point, so I assumed that the custome user registry I implemented works.

But when tried to access the protected resource, it seems like the application entered some sort of infinite loop, the browser keeps browsing and browsing...
and it seems like it would never stop !
The application.xml defines the role, "role-fn-user",
This role is mapped to a group in the database at the time of deployment (I selected option "select users/groups" in the "user role mapping" panel at deployment time. I believe that the Admin Cosole does look up for the group in the DB using the custom Registry because I did test change the value of the group in the group table and it does return the right value if I made the change.
I am sure that I missed something or have done something wrong. Please help me sole this problem, I spent the last three days trying to solve it, but I cannot
Thanks in advance
Xenoux
<application id="Application_ID">
<display-name>Furnnet</display-name>
<module id="EjbModule_1">
<ejb>Furnnet_EJB.jar</ejb>
</module>
<module id="WebModule_1">
<web>
<web-uri>furnnet.war</web-uri>
<context-root>/furnnet</context-root>
</web>
</module>
<security-role id="SecurityRole_1">
<role-name>role-fn-user</role-name>
</security-role>
</application>

[Simon Song]

Don't protect your singin page, exclude it from security-constraint in your web.xml!
Or it is definitely a deadloop...

[Binh Nguyen]

hi,
I did not prect the logon.jsp.
I only protect anything of the main directory, /main/*, and my logon.jsp and error.jsp is at the roor level, same level with main directory.
in fact if tried something like this <root>login.jsp , it will render the logon.jsp page, but after enter the user name and password, I will get a error message that the j_security_check page not found, but infact the user had been authenticated because from that point, I can access the protected resource.

the infinite loop only happens if I tried to access the protected resource at the first place.
Do you have any idea?
Thanks in advance
Xenoux

[ersin eser]

Xenoux
Please read the Javaranch Naming Policy and change your publicly displayed name to comply with our unique rule. Thank you for your cooperation.