title: Getting HTTP Status 403 - Forbidden after login on Glassfish 4.1.1
body: <p>I'm recently started to learn about Java EE web programming and I arrived to form authentication topic using some JSP pages with Netbeans 8.2 and Glashfish 4.1.1, this video is the tutorial that I was following:</p>
  
  <pre><code>https://www.youtube.com/watch?v=GXnwtR1lT3w
  </code></pre>
  
  <p>I was follow step by step but when I login with my user and password server only send me a HTTP Status 403 - Forbidden error, I was configure the user in the file realm security section of server-config with 'AppAdmin' as group list.</p>
  
  <p><strong>This is my login.jsp:</strong></p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;%@page contentType="text/html" pageEncoding="UTF-8"%&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
          &lt;title&gt;Login&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;h1&gt;Login Page&lt;/h1&gt;
          &lt;p&gt;Please enter your username and password to login.&lt;/p&gt;
          &lt;form action="j_security_check" method="POST"&gt;
          &lt;table border="0"&gt;
              &lt;tbody&gt;
                  &lt;tr&gt;
                      &lt;td&gt;Username:&lt;/td&gt;
                      &lt;td&gt;&lt;input type="text" name="j_username" value="" /&gt;&lt;/td&gt;
                  &lt;/tr&gt;
                  &lt;tr&gt;
                      &lt;td&gt;Password:&lt;/td&gt;
                      &lt;td&gt;&lt;input type="password" name="j_password" value="" /&gt;&lt;/td&gt;
                  &lt;/tr&gt;
                  &lt;tr&gt;
                      &lt;td&gt;&lt;/td&gt;
                      &lt;td&gt;&lt;input type="submit" value="Login Now" /&gt;&lt;/td&gt;
                  &lt;/tr&gt;
              &lt;/tbody&gt;
          &lt;/table&gt;
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p><strong>This is my web.xml:</strong></p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;Admin Pages&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Administrative Pages&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;admin&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;login-config&gt;
          &lt;auth-method&gt;FORM&lt;/auth-method&gt;
          &lt;realm-name&gt;file&lt;/realm-name&gt;
          &lt;form-login-config&gt;
              &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
              &lt;form-error-page&gt;/login_error.jsp&lt;/form-error-page&gt;
          &lt;/form-login-config&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;description&gt;Administrators&lt;/description&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description&gt;Common Users&lt;/description&gt;
          &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>This is my glassfish-web.xml</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd"&gt;
  &lt;glassfish-web-app error-url=""&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;principal-name&gt;admin&lt;/principal-name&gt;
      &lt;group-name&gt;AppAdmin&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;principal-name&gt;user&lt;/principal-name&gt;
      &lt;group-name&gt;AppUser&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    &lt;jsp-config&gt;
      &lt;property name="keepgenerated" value="true"&gt;
        &lt;description&gt;Keep a copy of the generated servlet class' java code.&lt;/description&gt;
      &lt;/property&gt;
    &lt;/jsp-config&gt;
  &lt;/glassfish-web-app&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>I'm stucked on this part I tried some things that I read on some forums with no luck.</p>
  
  <p>Thank you for your help and time.</p>