title: How can I get the request.login method working with a jdbcRealm?
body: <p>I am trying to use the Servlet 3.0 request.login(username, password) method to work with a jdbcRealm, but something seems to be wrong.  There are many articles out there on how to get the jdbcRealm working with FORM authentication, and lots on how to use the new request.login method, but I haven't seen any that show both working together.</p>
  
  <p>Application Server - GlassFish 3.1.2<br>
  IDE - Netbeans 7.3<br>
  RDBMS - SQL Server 2008 R2<br>
  JDBC - Microsoft JDBC 4.0 driver  </p>
  
  <p>I'd appreciate some assistance from the community on how to get this working.  Thanks in advance!</p>
  
  <p>First, I'm sending a jquery ajax call into my SignInService servlet.  I'm encoding the password using the jsSHA library in SHA-512 before sending:</p>
  
  <pre><code>var encodedPassword = new jsSHA($("#omSignInPassword").val(), "TEXT");
  
  $.ajax({
        url: "SignInService",
        data: {
          username : $("#SignInUserName").val(),
          password : encodedPassword.getHash("SHA-512", "HEX")
        }
  ...
  });
  </code></pre>
  
  <p>This is what Chrome shows is being sent:</p>
  
  <pre><code>username:admin
  password:b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86
  </code></pre>
  
  <p>The servlet just takes the request parameters and tries to log in:</p>
  
  <pre><code>  username = request.getParameter(PARAM_USERNAME);
    password = request.getParameter(PARAM_PASSWORD);
  
    request.login(username, password);
  </code></pre>
  
  <p>These are the errors that I see in the GlassFish console:</p>
  
  <p>SEVERE: jdbcrealm.invaliduserreason WARNING: WEB9102: Web Login Failed: com.sun.enterprise.security.auth.login.common.LoginException: Login failed: Security Exception<br>
  SEVERE: Servlet Exception: javax.servlet.ServletException: Exception thrown while attempting to authenticate for user: admin<br>
  WARNING: DPL5032:An authentication method was not defined in the web.xml descriptor.  Using default BASIC for login configuration.<br>
  WARNING: No Principals mapped to Role [User].  </p>
  
  <p>Now, on to the configuration...</p>
  
  <p>Here is my web.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;login-config&gt;
          &lt;realm-name&gt;omRealm&lt;/realm-name&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;User&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>User Table:</p>
  
  <pre><code>CREATE TABLE [OM_SECURITY].[User](
      [UserID] [int] IDENTITY(1,1) NOT NULL,
      [Name] [nvarchar](32) NOT NULL,
      [Password] [char](128) NOT NULL,
      [LastName] [nvarchar](32) NULL,
      [FirstName] [nvarchar](32) NULL,
      [Email] [nvarchar](64) NULL
  ) ON [PRIMARY]
  </code></pre>
  
  <p>One record exists in this table:</p>
  
  <pre><code>1   admin   B109F3BBBC244EB82441917ED06D618B9008DD09B3BEFD1B5E07394C706A8BB980B1D7785E5976EC049B46DF5F1326AF5A2EA6D103FD07C95385FFAB0CACBC86    NULL    NULL    NULL
  </code></pre>
  
  <p>(the password is just "password" for now)</p>
  
  <p>Here is the View used for putting every user into the "User" group.  This is very basic and will change later once I have the core functionality in place.  I do not anticipate using JAAS Roles as my application requirements seem to be far more complex than what they provide.  That's probably another discussion, unless somehow this is impacting the authentication:</p>
  
  <pre><code>CREATE VIEW [OM_SECURITY].[SignInGroup]
  AS
  SELECT     'User' AS GroupName, Name AS UserName
  FROM         OM_SECURITY.[User]
  </code></pre>
  
  <p>The connection pool has been tested and it works just fine. The Realm was set up in the server-config section and not the default-config.</p>
  
  <pre><code>JAAS Context:  jdbcRealm
  JNDI:  jdbc/omSecurity
  User Table:  OM_SECURITY.User
  User Name Column:  Name
  Password Column:  Password
  Group Table:  OM_SECURITY.SignInGroup
  Group Table User Name Column:   UserName
  Group Name Column:  GroupName
  Assign Groups: (blank)
  Database User:  (blank)
  Database Password:  (blank)
  Digest Algorithm: SHA-512
  Password Encryption Algorithm:  AES
  Encoding: Hex
  Charset: (blank)
  </code></pre>
  
  <p>If someone can tell me what file stores the Realm and Connection Pool configuration I'll post those here as XML instead. </p>
  
  <p>This was also posted to the GlassFish forum here:</p>
  
  <p><a href="http://www.java.net/forum/topic/glassfish/glassfish-webtier/using-servlet-requestlogin-jdbcrealm" rel="nofollow">http://www.java.net/forum/topic/glassfish/glassfish-webtier/using-servlet-requestlogin-jdbcrealm</a></p>
  
  <p>Update: I have just put together a quick form based login and it is also failing, so the issue seems to be with my realm.  I adjusted the log level for  in:  </p>
  
  <p>Configurations\<br>
  server-config\<br>
  Logging\<br>
  Log Levels\  </p>
  
  <p>javax.enterprise.system.core.security = FINE</p>
  
  <p>AND   </p>
  
  <p>com.microsoft.sqlserver.jdbc = FINE</p>
  
  <p>The query is running fine according to SQL Server, there are no exceptions thrown from the Connection Pool:</p>
  
  <pre><code>FINE: SQLServerPreparedStatement:3: calling sp_prepexec: PreparedHandle:0, SQL:SELECT Password FROM omUser WHERE Name = @P0 
  </code></pre>