HELP!! form based authentication Qs

Dev Shed Forums Sponsor:

July 28th, 2003, 05:47 AM

baggiolee

Junior Member

Join Date: Jul 2003

Posts: 3

Time spent in forums: < 1 sec
Reputation Power: 0

HELP!! form based authentication Qs

I'am trying to access my webpages with the form based authentication (HTTPs) but i have always the same message: Invalid direct reference to form login page

The request sent by the client was syntactically incorrect (Invalid direct reference to form login page).

Inside my web.xml, I put my login.jsp as main page for the project folder (project/login.jsp)....
Initially i put index.jsp but the login.jsp file will appear as the main page which i do not want. I only want to protect the /project/admin/* .

**************WEB.XML***************************************

<context-param>
<param-name>project</param-name>
<param-value>/project/login.jsp</param-value>
</context-param>


<context-param>
<param-name>addProj</param-name>
<param-value>/project/admin/addProj.jsp</param-value>
</context-param>
<context-param>
<param-name>addProj1</param-name>
<param-value>/project/admin/addProj1.jsp</param-value>
</context-param>
<context-param>
<param-name>addProj2</param-name>
<param-value>/project/admin/addProj2.jsp</param-value>
</context-param>
.......................
........................

<security-constraint>

<web-resource-collection>
<web-resource-name>Admin only</web-resource-name>
<url-pattern>/project/admin/*</url-pattern>
</web-resource-collection>

<auth-constraint>

<role-name>tomcat</role-name>
<role-name>superuser</role-name>
<role-name>role2</role-name>
</auth-constraint>




</security-constraint>


<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>project/login.jsp</form-login-page>
<form-error-page>project/loginError.jsp</form-error-page>
</form-login-config>
</login-config>


<security-role>
<description>
Superuser can access any page
</description>
<role-name>superuser</role-name>
</security-role>

<security-role>
<description>
role1 can access only pages in folder /employee
</description>
<role-name>role1</role-name>
</security-role>

<security-role>
<description>
role2 can access only pages in folder /project
</description>
<role-name>role2</role-name>
</security-role>

********************project/login.jsp*****************
<%--
login.jsp
--%>

<%@ page errorPage="/error.jsp" %>

<HTML>
<HEAD>
<TITLE>Login page</TITLE>
</HEAD>

<BODY>

<%@ include file="headerLogin.html"%>


<TABLE WIDTH="100%">
<TR HEIGHT="400">

<TD WIDTH="20%" BGCOLOR="#003366" VALIGN="TOP">

<%@ include file="/menu00.html"%>
</TD>
<TD VALIGN="TOP">


<%@ include file="login.jsf"%>


</TD>
</TR>
</TABLE>


<%@ include file="/footer.html"%>

</BODY>
</HTML>

************************project/login.jsf*****************
<%--
login.jsf

Adapted from Tomcat
%CATALINA_HOME%\webapps\examples\jsp\security\protected\login.jsp

--%>

<html>
<head>
<title>Login Page</title>
<body bgcolor="white">

<form method="POST" action="j_security_check" >

<table border="0" cellspacing="5">

<tr>
<th align="right">Username:</th>
<td align="left"><input type="text" name="j_username"></td>
</tr>
<tr>
<th align="right">Password:</th>
<td align="left"><input type="password" name="j_password"></td>
</tr>
<tr>
<td align="right"><input type="submit" value="Log In"></td>
<td align="left"><input type="reset"></td>
</tr>
</table>
</form>
</body>
</html>

*********************project/index.jsp******************
<%--
index.jsp
--%>

<%@ page errorPage="error.jsp" %>

<HTML>
<HEAD>
<TITLE>Main project page</TITLE>
</HEAD>

<BODY>

<%@ include file="/header.html"%>


<TABLE WIDTH="100%">
<TR HEIGHT="400">

<TD WIDTH="20%" BGCOLOR="#003366" VALIGN="TOP">

<%@ include file="admin/menu02.html"%>
</TD>
<TD VALIGN="TOP">


<%@ include file="index.jsf"%>


</TD>
</TR>
</TABLE>


<%@ include file="/footer.html"%>

</BODY>
</HTML>

*********************project/index.jsf******************
<%--
index.jsf

Adapted from Tomcat
%CATALINA_HOME%\webapps\examples\jsp\security\protected\index.jsp

URL
--%>

<%
if (request.getParameter("logoff") != null) {
session.invalidate();
response.sendRedirect("index.jsp");
return;
}
%>
<html>
<head>
<title>Protected Page</title>
</head>
<body bgcolor="white">


<H3>Login details</H3>
You are logged in as remote user <b><%= request.getRemoteUser() %>
</b>in session <b><%= session.getId() %></b>
<BR>
<%
if (request.getUserPrincipal() != null) {
%>
Your user principal name is
<b><%= request.getUserPrincipal().getName() %></b>
<%
} else {
%>
No user principal could be identified.
<%
}
%>
<BR>
<BR>


<H3>Role info</H3>
<%
String role = request.getParameter("role");
if (role == null)
role = "";
if (role.length() > 0) {
if (request.isUserInRole(role)) {
%>
You have been granted role <b><%= role %></b>
<BR>
<%
} else {
%>
You have <i>not</i> been granted role <b><%= role %></b>
<BR>
<%
}
}
%>
To check whether your username has been granted a particular role,
enter your username and press enter:

<form method="GET" action="index.jsp">

<input type="text" name="role" value="<%= role %>">
</form>
<BR>
<BR>


<H3>Logout</H3>
If you have configured this application for form-based authentication,
you can log off by clicking

<a href="index.jsp?logoff=true">here</a>.
<BR>
This will redirect you to the login page.
</body>
</html>

****************************************************************

It only can work if i change security constraint to protect the whole application. And the 1st main page will be the login.jsp (I do not want this)
And i only want the protect my project/admin/* but not /* .


<security-constraint>

<web-resource-collection>
<web-resource-name>whole application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>

........................

<context-param>
<param-name>project</param-name>
<param-value>/project/admin/index.jsp</param-value>
</context-param>
....................
...................

Why this happen? Why can't it access the project/index.jsp if i do no protect the whole application?

How can i login to my page directly from login page (and not the 1st page) and protect only my project/admin/* ?

July 28th, 2003, 06:12 AM

Mirax

Senior Member

Dev Shed Intermediate (1500 - 1999 posts)

Join Date: Jun 2000

Location: Enschede, The Netherlands

Posts: 1,527

Time spent in forums: 2 h 49 m 2 sec
Reputation Power: 10

Hi baggiolee. welcome to the forums!

Please don't spam different boards with the same question:
Post in Security
Post in Java Servlets & JSP

Regards

__________________
There are 10 types of people in this world - those who understand binary and those who don't...

PHP | MySQL | DevShed Forum Search | Google Search

October 4th, 2003, 03:50 AM

pwillart

Junior Member

Join Date: Oct 2003

Posts: 1

Time spent in forums: < 1 sec
Reputation Power: 0

It's because you access your login page directly. If you type in a protected url the login form will return.

This behaviour is too bad because it prevents me from having a login form on non protected pages (e.g. homepage)

Thread Tools	Search this Thread
Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: