title: Java forms auth with j_security_check and Glassfish
body: <p>I'm dipping my toe into the murky waters of Java and I'm working through the PackPub JavaEE 6 With Netbeans7 <a href="http://www.packtpub.com/java-ee-6-development-with-netbeans-7/book/" rel="nofollow" title="book">book</a> . One of the early examples is forms authentication which involves setting up deployment descriptor (web.xml) with a security role 'admin' and a constraint. It then walks you through getting the Glassfish descriptor by assigning these roles to new groups and then using the Glassfish console to create new users in these groups.</p>
  
  <p>When I try and access a page inside this protected page I'm presented with the login page as expected, but my login does not work. Even though I know I am putting in valid credentials created in the glassfish console, I still get my login error page (rendered on the j_security_check URL).</p>
  
  <p>The login page is as basic as it comes:</p>
  
  <pre><code>    &lt;%@page contentType="text/html" pageEncoding="UTF-8"%&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
          &lt;title&gt;Log in to view secure content&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;h1&gt;Log in&lt;/h1&gt;
          &lt;form action="j_security_check" method="POST"&gt;
              &lt;table border="0"&gt;
                  &lt;tbody&gt;
                      &lt;tr&gt;
                          &lt;td slign="right"&gt;Username: &amp;nbsp;&lt;/td&gt;
                          &lt;td&gt;&lt;input type="text" name="j_username" value="" /&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;
                          &lt;td slign="right"&gt;Password: &amp;nbsp;&lt;/td&gt;
                          &lt;td&gt;&lt;input type="password" name="j_password" value="" /&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;
                          &lt;td&gt;&lt;/td&gt;
                          &lt;td&gt;&lt;input type="submit" value="Login" /&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                  &lt;/tbody&gt;
              &lt;/table&gt;
  
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>I've not configured something, and its probably something really basic, but the book doesn't help with issues such as this so wondered if I could get some pointers on where to start debugging or diagnosing this problem.</p>
  
  <p>My web.xml is:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;Admin Pages&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Administrative pages&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;Admin&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;login-config&gt;
          &lt;auth-method&gt;FORM&lt;/auth-method&gt;
          &lt;realm-name&gt;file&lt;/realm-name&gt;
          &lt;form-login-config&gt;
              &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
              &lt;form-error-page&gt;/loginerror.jsp&lt;/form-error-page&gt;
          &lt;/form-login-config&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;description&gt;Administrators&lt;/description&gt;
          &lt;role-name&gt;Admin&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description&gt;public user&lt;/description&gt;
          &lt;role-name&gt;User&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>glassfish-web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd"&gt;
  &lt;glassfish-web-app error-url=""&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;Admin&lt;/role-name&gt;
      &lt;group-name&gt;Admin&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    &lt;class-loader delegate="true"/&gt;
    &lt;jsp-config&gt;
      &lt;property name="keepgenerated" value="true"&gt;
        &lt;description&gt;Keep a copy of the generated servlet class' java code.&lt;/description&gt;
      &lt;/property&gt;
    &lt;/jsp-config&gt;
  &lt;/glassfish-web-app&gt;
  </code></pre>
  
  <p>I've double checked that in the Glassfish console, I'm editing</p>
  
  <pre><code>Configuartions|Security|Realms|file
  </code></pre>
  
  <p>and that my new user has a Group list of 'Admin'</p>
  
  <p>Thanks</p>