title: JSF 2.0 + Programmatic authentication = 403 :)
body: <p>I am transitioning to GlassFish 3.1.2, and can't seem to resolve a problem with authentication.</p>
  
  <p>The agenda is simple: I want a login bean to do programmatic authentication for a user. The authentication seems to work (the code goes past the login() method), but the server ends up shown 403 for the protected resources... Please help :)</p>
  
  <p>Here are more details. There is a pure JSF login page with name/pass pair:</p>
  
  <pre><code>&lt;ui:composition xmlns="http://www.w3.org/1999/xhtml"
      xmlns:h="http://java.sun.com/jsf/html"
      xmlns:f="http://java.sun.com/jsf/core"
      xmlns:ui="http://java.sun.com/jsf/facelets"
      xmlns:p="http://primefaces.org/ui" template="/templates/main.xhtml"&gt;
  
      &lt;ui:define name="body"&gt;
          &lt;h:form id="form"&gt;
              &lt;p:messages /&gt;
  
              &lt;p:panel&gt;
                  &lt;h:panelGrid&gt;
                      &lt;h:outputText value="User Name" /&gt;
                      &lt;p:inputText value="#{loginBean.userName}" id="userName"
                          required="true" /&gt;
                      &lt;p:message for="userName" /&gt;
  
                      &lt;h:outputText value="Password" /&gt;
                      &lt;p:password value="#{loginBean.password}" id="password"
                          required="true" /&gt;
                      &lt;p:message for="password" /&gt;
  
                  &lt;/h:panelGrid&gt;
  
                  &lt;h:panelGrid columns="2"&gt;
                      &lt;p:commandButton value="Clear"
                          actionListener="#{loginBean.clear()}" ajax="false" /&gt;
  
                      &lt;p:commandButton value="Login" action="#{loginBean.login()}"
                          ajax="false" /&gt;
                  &lt;/h:panelGrid&gt;
              &lt;/p:panel&gt;
          &lt;/h:form&gt;
      &lt;/ui:define&gt;
  &lt;/ui:composition&gt;
  </code></pre>
  
  <p>and a bean that carries out the login</p>
  
  <pre><code>@Named("loginBean")
  @SessionScoped
  public class LoginBean implements Serializable {
  
      private static final long serialVersionUID = 1L;
  
      @Inject
      @Named("dao")
      private Dao dao;
  
      private String userName;
  
      private String password;
  
      @Inject
      private UserBean userBean;
  
      ...
  
      public String login() {
          HttpServletRequest request = (HttpServletRequest) FacesContext
                  .getCurrentInstance().getExternalContext().getRequest();
  
          try {
              request.login(getUserName(), getPassword());
  
              Principal principal = request.getUserPrincipal();
  
              logger.info("Logged in successfully: " + principal);
          } catch (ServletException e) {
              Messages.addError("Invalid user name or password.");
              return null;
          }
  
          User user = dao.findSingle("SELECT u FROM User AS u WHERE u.name = ?1",
                  getUserName());
  
          if (user == null) {
              logger.severe("Unable to find user record after successful authentication");
  
              Messages.addError("Unable to load user record");
              try {
                  request.logout();
              } catch (ServletException e) {
                  logger.log(Level.SEVERE, "Unable to logout after failed login attempt", e);
              }
              return null;
          }
  
          getUserBean().setUser(user);
  
          return "/list/list.xhtml?faces-redirect=true";
      }
  
      ... 
  
      accessors
  
      ...
  }
  </code></pre>
  
  <p>Here is my web.xml</p>
  
  <pre><code>&lt;?xml version='1.0' encoding='UTF-8'?&gt;
  
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
  
      &lt;display-name&gt;GM&lt;/display-name&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;javax.faces.PROJECT_STAGE&lt;/param-name&gt;
          &lt;param-value&gt;Development&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- Faces Servlet --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.xhtml&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;login-config&gt;
          &lt;realm-name&gt;gmRealm&lt;/realm-name&gt;
      &lt;/login-config&gt;
  
      &lt;security-role&gt;
          &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;/security-role&gt;
  
      &lt;security-role&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/security-role&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/list/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;user&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Admin Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;admin&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;login.xhtml&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Here is the folder structure for the project:</p>
  
  <p><img src="https://i.stack.imgur.com/PL7B0.png" alt="Folder structure"></p>
  
  <p>I was also able to set up the realm as discussed here: <a href="http://blog.gamatam.com/2009/11/jdbc-realm-setup-with-glassfish-v3.html" rel="nofollow noreferrer">http://blog.gamatam.com/2009/11/jdbc-realm-setup-with-glassfish-v3.html</a></p>
  
  <p>Nothing fancy, AFAICT.</p>
  
  <p>However, whenever I get to the protected resource after a successful login, I get:</p>
  
  <pre><code>HTTP Status 403 - Access to the requested resource has been denied
  </code></pre>
  
  <p>Despite the fact that the server log contains the message:</p>
  
  <pre><code>INFO: Logged in successfully: nick
  </code></pre>
  
  <p>Also note that when I remove "?faces-redirect=true", from the login() method's return value, the initial protected resource is rendered just fine right after the login, but all the subsequent requests to it fail with 403.</p>
  
  <p>Here is what it shows in the debugger:</p>
  
  <p><img src="https://i.stack.imgur.com/MxFVT.png" alt="Debugging view"></p>
  
  <p>I also think that I've done my homework:</p>
  
  <p><a href="https://stackoverflow.com/questions/2206911/best-way-for-user-authentication-on-javaee-6-using-jsf-2-0">Performing user authentication in Java EE / JSF using j_security_check</a></p>
  
  <p><a href="https://stackoverflow.com/questions/6189536/programmatically-control-login-with-servlet-3-0">Programmatically control login with Servlet 3.0</a></p>
  
  <p><a href="https://stackoverflow.com/questions/3752104/jsf-2-0-simple-login-page">JSF 2.0 Simple login page</a></p>
  
  <p><a href="https://stackoverflow.com/questions/7944963/glassfish-3-security-form-based-authentication-using-a-jdbc-realm">Glassfish 3 security - Form based authentication using a JDBC Realm</a></p>
  
  <p>Please help...</p>