title: Form Based Authentication giving Forbidden 403
body: <p>Hey im making an application where the username and password have to be stored in the glassfish server and then when i run the application the user has to enter already stored user name and password to continue.  But when the credentials are entered correctly i get HTTP Status 403 - Forbidden.  I cant figure it out ive been working on it for two days now.  Can someone help me please...
  Here is my code:</p>
  
  <p>Login Page</p>
  
  <pre><code>&lt;form action="j_security_check" method=post&gt;
      &lt;p&gt;&lt;strong&gt;Please Enter Your User Name: &lt;/strong&gt;
      &lt;input type="text" name="j_username" size="25"&gt;
      &lt;p&gt;&lt;p&gt;&lt;strong&gt;Please Enter Your Password: &lt;/strong&gt;
      &lt;input type="password" size="25" name="j_password"&gt;
      &lt;p&gt;&lt;p&gt;
      &lt;input type="submit" value="Submit"&gt;
      &lt;input type="reset" value="Reset"&gt;
      &lt;/form&gt;
  </code></pre>
  
  <p>Web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;javax.faces.PROJECT_STAGE&lt;/param-name&gt;
          &lt;param-value&gt;Development&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/faces/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;file&lt;/realm-name&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/loginform.html&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/loginerror.html&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;Administrator&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/faces/index.xhtml&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;Administrator&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;faces/index.xhtml&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>sun-web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd"&gt;
  &lt;sun-web-app error-url=""&gt;
    &lt;context-root&gt;/&lt;/context-root&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;Administrator&lt;/role-name&gt;
      &lt;group-name&gt;Administrator&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    &lt;class-loader delegate="true"/&gt;
    &lt;jsp-config&gt;
      &lt;property name="keepgenerated" value="true"&gt;
        &lt;description&gt;Keep a copy of the generated servlet class' java code.&lt;/description&gt;
      &lt;/property&gt;
    &lt;/jsp-config&gt;
  &lt;/sun-web-app&gt;
  </code></pre>
  
  <p>Thanks in advance </p>