title: Keep getting HTTP Status 403 after login to webapplication secured with glassfish security realm
body: <p>Setup: </p>
  
  <ul>
  <li>glassfish 3.1.1</li>
  <li>JSF 2.1</li>
  <li>jdbcRealm with postgreSQL</li>
  </ul>
  
  <p>After typing valid user credentials to the login form I get logged in and redirected to the next page. But if I leave that page and go to another one, which is in the allowed url-pattern of course, I get the "HTTP Status 403 - Access to the requested resource has been denied". After that I can not visit any site of the webapp anymore.</p>
  
  <p>The login only works, if I set the Standard-Realm in glassfish's server-config/security to my own realm!</p>
  
  <p>I get one warning in the server log at deploy time:</p>
  
  <pre><code>Warnung: Keine Principals zugeordnet zu Rolle [USER].
  (Warning: No principals mapped to role [USER])
  </code></pre>
  
  <p>If I remove the JSESSIONID with Chrome Debugger, I can login again. Looks like the Session gets destroyed on the server side after visiting one allowed website or something?!</p>
  
  <p>I attached some relevant sources. I think it has nothing to do with the Realm and so on, since the login mechanism works and there are no exceptions...</p>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;jdbcRealm&lt;/realm-name&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/faces/login.xhtml&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/faces/loginError.xhtml&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;User&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/faces/user/*&lt;/url-pattern&gt;
          &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;ADMIN&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p><strong>glassfish-web-app.xml (Added manually)</strong></p>
  
  <pre><code>&lt;glassfish-web-app&gt;
  &lt;security-role-mapping&gt;
      &lt;role-name&gt;USER&lt;/role-name&gt;
      &lt;group-name&gt;USER&lt;/group-name&gt;
  &lt;/security-role-mapping&gt;
  &lt;/glassfish-web-app&gt;
  </code></pre>
  
  <p><strong>login.xhtml</strong></p>
  
  <pre><code>&lt;h:form&gt;
  &lt;h:outputLabel for="usernameInput"&gt;
      Username:
  &lt;/h:outputLabel&gt;
  &lt;h:inputText id="usernameInput" value="#{authBackingBean.username}" 
               required="true" /&gt;
  &lt;br /&gt;
  &lt;h:outputLabel for="passwordInput"&gt;
      Password:
  &lt;/h:outputLabel&gt;
  &lt;h:inputSecret id="passwordInput" value="#{authBackingBean.password}" 
                 required="true" /&gt;
  &lt;br /&gt;
  &lt;h:commandButton value="Login" 
                   action="#{authBackingBean.login}" /&gt;
  </code></pre>
  
  <p></p>
  
  <p><strong>AuthBackingBean</strong></p>
  
  <pre><code>@Stateless
  @Named
  public class AuthBackingBean {
  
      private String username;
      private String password;
  
      public String getUsername() {
          return this.username;
      }
  
      public void setUsername(String username) {
          this.username = username;
      }
  
      public String getPassword() {
          return this.password;
      }
  
      public void setPassword(String password) {
          this.password = password;
      }
  
      public String login() {
          FacesContext context = FacesContext.getCurrentInstance();
          HttpServletRequest request = (HttpServletRequest) context.getExternalContext().getRequest();
          try {
              request.login(this.username, this.password);
          } catch (ServletException e) {
              context.addMessage(null, new FacesMessage("Login failed."));
              return "loginError";
          }
          return "user/index";
      }
  
      public void logout() {
          FacesContext context = FacesContext.getCurrentInstance();
          HttpServletRequest request = (HttpServletRequest) context.getExternalContext().getRequest();
          try {
              request.logout();
          } catch (ServletException e) {
              context.addMessage(null, new FacesMessage("Logout failed."));
          }
      }
  }
  </code></pre>
  
  <p>P.S: 
  I'm really disappointed about oracle's  f***ed up documentation since it contains many logical errors, typos and copy/paste errors. It's unstructured, hard to read and overloaded. (sorry but that had to be said)</p>