users@glassfish.java.net

Security constraint ignored?

From: <glassfish_at_javadesktop.org>
Date: Mon, 26 Jul 2010 00:31:06 PDT

Dear all,
I have created a simple web application, based on java server faces.

I have a folder called /gotware/ where I put a xhmtl called main.xhtml, and a role called rockinger of category remoteuser in my glassfish.

 <security-constraint>
        <display-name>gotware protected</display-name>
        <web-resource-collection>
            <web-resource-name>gotware protected</web-resource-name>
            <description/>
            <url-pattern>/gotware/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <description>authentication for rockinger</description>
            <role-name>rockinger</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>file</realm-name>
        <form-login-config>
            <form-login-page>/login/login.xhtml</form-login-page>
            <form-error-page>/login/error.xhtml</form-error-page>
        </form-login-config>
    </login-config>
    <security-role>
        <description>Rockinger external access</description>
        <role-name>rockinger</role-name>
    </security-role>

this is the extract from sun-web.xml

  <context-root>/GotwareUI</context-root>
  <security-role-mapping>
    <role-name>rockinger</role-name>
    <group-name>remoteuser</group-name>
  </security-role-mapping>


The point is that, when I try to access through a commandLink or directly by tipying the address in my browser, i am not redirect through the login page :(

Any idea? I am Glassfish 3.1 + Netbeans Ide 6.9 + OpenFaces framework, and I actually meet the problem when I deleted a domain of GlassFish and I created a new one.

Thank you
Edmondo
[Message sent by forum member 'edmondo1984']

http://forums.java.net/jive/thread.jspa?messageID=478540