title: How to implement redirect to login-page with Java EE 6/Glassfish
body: <p>I'm trying to implement a redirect after login, which means I can't use glassfish built-in form authentication settings anymore that handles such things automatically. So first thing's first, I need to take control over redirecting to a login page when requesting a protected page. As I understand, this is done with a filter. Can this method be combined with security-constraints in web-xml? As it is, my filter is not called at all since glassfish just takes over and throws a basic loginbox at the user and ignores all filters even when no login configuration is set. Basicly, I have not managed to get a filter called before a user has logged in when security constraints are configured in glassfish.</p>
  
  <p>Do I really need to take over security completly manually in a filter for this to work? If that's the case, the implementation seems horrible.</p>
  
  <p>Using glassfish 3.1 with JSF 2 and a custom loginpage logging in manually with request.login.</p>
  
  <p>web.xml.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;javax.faces.PROJECT_STAGE&lt;/param-name&gt;
          &lt;param-value&gt;&lt;!--Production--&gt;Development&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;com.sun.faces.expressionFactory&lt;/param-name&gt;
          &lt;param-value&gt;de.odysseus.el.ExpressionFactoryImpl&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;LoginFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.jsf&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;LoginFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;com.xdin.competence.jsf.util.LoginFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;60&lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.jsf&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
      &lt;!--&lt;error-page&gt;
          &lt;exception-type&gt;javax.faces.application.ViewExpiredException&lt;/exception-type&gt;
          &lt;location&gt;/viewExpired.jsf&lt;/location&gt;
      &lt;/error-page&gt;--&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;ManagerArea&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;ManagerArea&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/manager/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;Manager-role&lt;/role-name&gt;
              &lt;role-name&gt;Admin-role&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;EmployeeArea&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;EmployeeConstraint&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/user/Overview.jsf&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/user/PrepareReport.jsf&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/user/Search.jsf&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;Employee-role&lt;/role-name&gt;
              &lt;role-name&gt;Admin-role&lt;/role-name&gt;
              &lt;role-name&gt;Manager-role&lt;/role-name&gt;
              &lt;role-name&gt;OKIF-role&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;AdminArea&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;AdminCompetence&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;Admin-role&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;UserArea&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;UserConstraint&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/index.jsf&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/template.jsf&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/user/UserDetail.jsf&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/user/UserInformation.jsf&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/print/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;Employee-role&lt;/role-name&gt;
              &lt;role-name&gt;Admin-role&lt;/role-name&gt;
              &lt;role-name&gt;Manager-role&lt;/role-name&gt;
              &lt;role-name&gt;OKIF-role&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;!--&lt;login-config&gt;
          &lt;auth-method&gt;FORM&lt;/auth-method&gt;
          &lt;form-login-config&gt;
              &lt;form-login-page&gt;/login.jsf&lt;/form-login-page&gt;
              &lt;form-error-page&gt;/login.jsf&lt;/form-error-page&gt;
          &lt;/form-login-config&gt;
      &lt;/login-config&gt;--&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;Employee-role&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;Admin-role&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;Manager-role&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;OKIF-role&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>And my filter:</p>
  
  <pre><code>public class LoginFilter implements Filter {
  
      private FilterConfig filterConfig = null;
  
      public LoginFilter() {
      } 
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response,
                           FilterChain chain)
          throws IOException, ServletException {
          HttpServletRequest req = (HttpServletRequest)request;
          HttpServletResponse res = (HttpServletResponse)response;
          if (req.getUserPrincipal() == null) {
              req.getSession().setAttribute("from", req.getRequestURI());
              res.sendRedirect("/login.jsf");
          } else {
              chain.doFilter(request, response);
          }
  
      }
  
      @Override
      public void destroy() { 
      }
  
      @Override
      public void init(FilterConfig filterConfig) { 
          this.filterConfig = filterConfig;
      }
  
  }
  </code></pre>