title: Does JAAS Works with AJAX Partial Request?
body: <p>I have a sample project configured with JAAS, JSF-2 and Primefaces. Here is my web.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0"&gt;
      &lt;display-name&gt;JAASProject&lt;/display-name&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;primefaces.THEME&lt;/param-name&gt;
          &lt;param-value&gt;start&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;primefaces.SUBMIT&lt;/param-name&gt;
          &lt;param-value&gt;partial&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.xhtml&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;javax.faces.STATE_SAVING_METHOD&lt;/param-name&gt;
          &lt;param-value&gt;client&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;javax.servlet.jsp.jstl.fmt.localizationContext&lt;/param-name&gt;
          &lt;param-value&gt;resources.application&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;com.sun.faces.config.ConfigureListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/app/*&lt;/url-pattern&gt;
              &lt;http-method&gt;GET&lt;/http-method&gt;
              &lt;http-method&gt;POST&lt;/http-method&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;*&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;login-config&gt;
          &lt;auth-method&gt;FORM&lt;/auth-method&gt;
          &lt;realm-name&gt;adbADRealm&lt;/realm-name&gt;
          &lt;form-login-config&gt;
              &lt;form-login-page&gt;/login.xhtml&lt;/form-login-page&gt;
              &lt;form-error-page&gt;/login.xhtml&lt;/form-error-page&gt;
          &lt;/form-login-config&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;role-name&gt;*&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;1&lt;/session-timeout&gt;
      &lt;/session-config&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>I have set <code>&lt;session-timeout&gt;</code> for testing purpose. The welcome file index.jsp is:</p>
  
  <pre><code>&lt;%
      response.sendRedirect("app/home.xhtml");
  %&gt;
  </code></pre>
  
  <p>So that when I am browsing localhost:8080/JAASProject I am navigating to the login page, but the URL remains localhost:8080/JAASProject/app/home.xhtml. I guess it is desired. In login.xhtml I have:</p>
  
  <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="http://java.sun.com/jsf/html" xmlns:p="http://primefaces.org/ui"
      xmlns:f="http://java.sun.com/jsf/core"&gt;
  
  &lt;h:head&gt;
      &lt;title&gt;Login&lt;/title&gt;
  &lt;/h:head&gt;
  &lt;h:body&gt;
      &lt;h:form&gt;
          &lt;h:panelGrid columns="2" cellpadding="5"&gt;
              &lt;p:outputLabel value="Username" /&gt;
              &lt;p:inputText value="#{authenticationController.username}" required="true"/&gt;
              &lt;p:outputLabel value="Password" /&gt;
              &lt;p:password value="#{authenticationController.password}" required="true"/&gt;
              &lt;f:facet name="footer"&gt;
                  &lt;p:commandButton id="loginButton" actionListener="#{authenticationController.login}" value="Login"/&gt;
              &lt;/f:facet&gt;
          &lt;/h:panelGrid&gt;
      &lt;/h:form&gt;
  &lt;/h:body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And the <code>AuthenticationController</code> is:</p>
  
  <pre><code>package com.myself.jassproject.controller;
  
  import java.io.Serializable;
  
  import javax.annotation.PostConstruct;
  import javax.faces.bean.ManagedBean;
  import javax.faces.bean.ViewScoped;
  import javax.faces.context.ExternalContext;
  import javax.faces.context.FacesContext;
  import javax.faces.event.ActionEvent;
  import javax.servlet.RequestDispatcher;
  import javax.servlet.http.HttpServletRequest;
  
  @ManagedBean(name = "authenticationController")
  @ViewScoped
  public class AuthenticationController implements Serializable{
  
      private static final long serialVersionUID = 7083052321396088714L;
  
      private String originalURL;
  
      private String username;
      private String password;
  
      public AuthenticationController() {
  
      }
  
      @PostConstruct
      public void initialize() {
          ExternalContext externalContext = getExternalContext();
          originalURL = (String) externalContext.getRequestMap().get(RequestDispatcher.FORWARD_REQUEST_URI);
  
          if (originalURL == null) {
              originalURL = externalContext.getRequestContextPath() + "/app/home.xhtml";
          }
  
          System.out.println(originalURL);
      }
  
      public void login(ActionEvent event){
          System.out.println("==");
          try {
              getServletRequest().login(username, password);
              getExternalContext().redirect(originalURL);
          } catch (Exception ex) {
              ex.printStackTrace();
          }       
      }
  
      public String getUsername() {
          return username;
      }
  
      public void setUsername(String username) {
          this.username = username;
      }
  
      public String getPassword() {
          return password;
      }
  
      public void setPassword(String password) {
          this.password = password;
      }
  
      private ExternalContext getExternalContext() {
          return getFacesContext().getExternalContext();
      }
  
      private FacesContext getFacesContext() {
          return FacesContext.getCurrentInstance();
      }
  
      private HttpServletRequest getServletRequest() {
          return (HttpServletRequest) getExternalContext().getRequest();
      }
  }
  </code></pre>
  
  <p>The authentication is working and I am getting navigated to the home. In home I have three buttons: one Primesfaces', one JSF's (non-ajax) and one JSF's (ajax-enabled). </p>
  
  <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml"
        xmlns:h="http://java.sun.com/jsf/html"
        xmlns:f="http://java.sun.com/jsf/core"
        xmlns:ui="http://java.sun.com/jsf/facelets"
        xmlns:p="http://primefaces.org/ui"&gt;
  
      &lt;h:head&gt;
          &lt;title&gt;Home&lt;/title&gt;
      &lt;/h:head&gt;
      &lt;h:body&gt;
          &lt;h:form&gt;
              &lt;p:commandButton value="Click me (Primefaces)" actionListener="#{homeController.doSomething}"/&gt;
              &lt;h:commandButton value="Click me (JSF)" actionListener="#{homeController.doSomething}" /&gt;
              &lt;h:commandButton value="Click me (JSF - AJAX)" actionListener="#{homeController.doSomething}"&gt;
                  &lt;f:ajax execute="@form"/&gt;
              &lt;/h:commandButton&gt;
          &lt;/h:form&gt;
      &lt;/h:body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>So far everything goes well untill now. When the session timeout occur and if I click on the Primefaces's button or the ajax enabled JSF's button it does nothing, neither any exception nor the <code>actionListener</code> get called; that is okay; but I am excepting that I would get navigated to the login page. </p>
  
  <p>I can see a POST get fired if I click on the ajax enabled buttons by Firebugging but that is it. If I click on the JSF's button (non-ajax) I am navigating to the login page but not if I click on the other two.</p>
  
  <p>Does JAAS works with AJAX POST? Is it an issue of my code? Am I missing something?</p>
  
  <p>My configuration is:</p>
  
  <ul>
  <li>Server - JBoss AS 7.1 </li>
  <li>Mojara - 2.1.7</li>
  <li>Primefaces - 3.4.2</li>
  </ul>