Latest Tutorials

Posted on 01 Sep 2011 by greenkode_admin and has 21 Comments




User Authentication and Authorization Using JAAS and Servlet 3.0 Login.




Date: 01 Sep 2011
Posted by: greenkode_admin
// sometimes I believe compiler ignores all my comments

-funniest code comments

In our previous Tutorial, we created a simple User Registration form using JSF 2.0 and we persisted the data in to a database using EJB 3.0 as the back end and JPA for Java persistence. If you haven’t seen that tutorial, I recommend you do. however, if you are confident in Configuring a database connection, with Eclipse and Glassfish, and Creating a connection Pool and JTA datasource, you can download the database Structure Here. That is all you will need to continue with this tutorial. If you want you can also download the previous project, and import it into eclipse.

If you are continuing from our previous tutorial, you have to run the following sql script to create a view in your database called v_user_role.

DROP VIEW IF EXISTS `v_user_role`;
CREATE VIEW `v_user_role` AS select `user`.`username` AS `username`,`user`.`password` AS `password`,`groups`.`groupname` AS `groupname` from ((`user_has_groups` join `user` on((`user_has_groups`.`User_userid` = `user`.`userid`))) join `groups` on((`groups`.`groupid` = `user_has_groups`.`Groups_groupid`)));

You will have to add 3 users to the database, an Administrator, Guest and a Manager. Alternatively, you can just download the database script and re-run it, it will re-create all the tables, the view, and add the users for you.

Now Lets Dive In.

Step 1: Create the Login Form.
If you are a new User, create a Dynamic Web Project. Ensure that you add the JSF 2.0 Facet. Please look at the first part of my Tutorial on how to create a JSF Web Project(you don’t have to create the facelet pages).

Enter the following Code into your Login page.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:f="http://java.sun.com/jsf/core">

<head>
<link rel="stylesheet" type="text/css" href="../style/main.css" />
</head>
<h:body styleClass="body">
	<h:form>
		<center>
			<h:messages errorClass="errorMessage" infoClass="infoMessage"
				warnClass="warnMessage"></h:messages>
			<h:panelGrid columns="2">
				<h:outputText value="Username : "></h:outputText>
				<h:inputText id="username" value="#{loginBean.username}"></h:inputText>

				<h:outputText value="Password : "></h:outputText>
				<h:inputSecret id="password" value="#{loginBean.password}"></h:inputSecret>

				<h:commandButton value="Submit" action="#{loginBean.login}"
					type="submit"></h:commandButton>
				<h:commandButton value="Clear" type="reset"></h:commandButton>

				<h:commandLink value="Register" action="Registration.xhtml"></h:commandLink>
				<h:commandLink value="Forgot Your Password?"></h:commandLink>
			</h:panelGrid>
		</center>
	</h:form>

</h:body>
</html>

Next Step, create a facelet and call it Dashboard.xhtml.
put the following code in your Dashboard facelet.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:f="http://java.sun.com/jsf/core">

<head>
<link rel="stylesheet" type="text/css" href="../style/main.css" />
</head>
<h:body styleClass="body">
	<h:messages></h:messages>
	<h:form>
		<h:commandLink value="Logout" action="#{loginBean.logout}"></h:commandLink>
	</h:form>
</h:body>
</html>

Next we’ll create our ManagedBean to manage our page.
Create a New Class Called LoginBean in the com.greenkode.registration.managedbeans package.
Add the following code into your LoginBean Class.

@ManagedBean(name="loginBean")
public class LoginBean {
	
	private String username;
	private String password;
	
	public LoginBean(){
	}
	
	public String getUsername() {
		return username;
	}
	public void setUsername(String username) {
		this.username = username;
	}
	public String getPassword() {
		return password;
	}
	public void setPassword(String password) {
		this.password = password;
	}
	
	public String login(){
		return null;
	}

	public void logout(){
		
	}	
}

Now Your managedBean is Ready.

Now Open your faces-config.xml file and create a Navigation Rule for the Login.xhtml to the Dashboard.xhtml page.
Your Navigation rule should look like this. N.B: Show the Palette View in Eclipse in order to create it visually



Step 3 : Confiugure Glassfish.
Open Up your Glassfish Administrative Console by right-clicking on the server and Select Glassfish > View Admin Console.
In your Common Tasks section, Click Configurations > server-config > Security > Realm and click New.



In the New Realm Window. Add the following information



RealmName : GreenkodeRealm
Class Name : com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm
Jaas Context : jdbcRealm
JNDI : jdbc/greenkode_mydb
User Table : v_user_role
User Name Column : username
Password Column : password
Group Table : v_user_role
Group Name Column : groupname

All other Parameters are optional.

N.B: The Jaas Context HAS to be jdbcRealm, because Glassfish already has a built in Login Module by that name, if you want you can create your own login module and register it with glassfish, but thats beyond the scope of this tutorial.

The JNDI Name is the name of the JNDI data source we created in our previous Tutorial to connect to our mydb database.

N.B: We are pointing Glassfish to the v_user_role View we created, This is because Glassfish expects the user table and the group table to contain a username column. This results in duplicate data, not very good database design practice.

All the other fields are optional. Note the Digest Algorithm, note that the default is SHA-256, hence we don’t need to set it. If you remember from our previous tutorial, we hashed all our passwords using SHA-256, before saving it to the database. So Glassfish will do the same, before comparing the hashed Strings. Note if you save your passwords as plain text, you’ll should specify none in the Digest Algorithm field.

Save Your Changes and Restart Glassfish.

Step 4 : Configure Your Web Application.
Open Up your web.xml File in your WEB-INF Folder.
Add the following Code. Inside the web-app tag

<login-config>
  	<auth-method>FORM</auth-method>
  	<realm-name>GreenkodeRealm</realm-name>
  	<form-login-config>
  		<form-login-page>/faces/Login.xhtml</form-login-page>
  		<form-error-page>/faces/Login.xhtml</form-error-page>
  	</form-login-config>
  </login-config>

FORM Authentication tells our App, that we are going to be using a User defined login form. There are other types like BASIC, Client Certificate, Mutual Authentication etc.
The Most important part of that code is the realm-name tag which points to the Name of the JDBCRealm we created in Glassfish. The last part, tells Glassfish which page to redirect to for login, and where to go to if an error occurs. Not very important here, as Navigation is handled by JSF.

Next We’re going to add the Roles that correspond with our Database groups.
Add the following code inside the web-app tag

<security-role>
  	<role-name>Administrator</role-name>
  </security-role>
  <security-role>
  	<role-name>Manager</role-name>
  </security-role>
  <security-role>
  	<role-name>Guest</role-name>
  </security-role>

Your web.xml file should look something like this now.

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" 
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" 
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>com.greenkode.registration</display-name>
  <servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
  </servlet-mapping>
  <login-config>
  	<auth-method>FORM</auth-method>
  	<realm-name>GreenkodeRealm</realm-name>
  	<form-login-config>
  		<form-login-page>/faces/Login.xhtml</form-login-page>
  		<form-error-page>/faces/Login.xhtml</form-error-page>
  	</form-login-config>
  </login-config>
  <security-role>
  	<role-name>Administrator</role-name>
  </security-role>
  <security-role>
  	<role-name>Manager</role-name>
  </security-role>
  <security-role>
  	<role-name>Guest</role-name>
  </security-role>
</web-app>

Next Step is to Map the Roles we Created to Groups in the Database. Now this is done in the sun-web.xml file. The sun-web.xml file configures the features specific to the Web Server for deployed web applications.
Add the following code inside the sun-web.xml

    <security-role-mapping>
  	<role-name>Administrator</role-name>
  	<group-name>Administrators</group-name>
  </security-role-mapping>
  <security-role-mapping>
  	<role-name>Manager</role-name>
  	<group-name>Managers</group-name>
  </security-role-mapping>
  <security-role-mapping>
  	<role-name>Guest</role-name>
  	<group-name>Guests</group-name>
  </security-role-mapping>

N.B: The sun-web.xml file is very sensitive about the order of tags, not just the location. So you might get some errors if you don’t put them in the right order, you should put the above code snippet right after the context-root tag.
Your sun-web.xml file should look something like this.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd">
<sun-web-app error-url="">
  <context-root>/com.greenkode.registration</context-root>
    <security-role-mapping>
  	<role-name>Administrator</role-name>
  	<group-name>Administrators</group-name>
  </security-role-mapping>
  <security-role-mapping>
  	<role-name>Manager</role-name>
  	<group-name>Managers</group-name>
  </security-role-mapping>
  <security-role-mapping>
  	<role-name>Guest</role-name>
  	<group-name>Guests</group-name>
  </security-role-mapping>
  <class-loader delegate="true"/>
  <jsp-config>
    <property name="keepgenerated" value="true">
      <description>Keep a copy of the generated servlet class java code.</description>
    </property>
  </jsp-config>
</sun-web-app>

Next thing we’re going to do is add the code for logging in to the system. add the following code to your LoginBean login() method.

String message = "";
		HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
		try {
			
			//Login via the Servlet Context
			request.login(username, password);
			
			//Retrieve the Principal
			Principal principal = request.getUserPrincipal();
			
			//Display a message based on the User role
			if(request.isUserInRole("Administrator")){
				message = "Username : " + principal.getName() + " You are an Administrator, you can really f**k things up now";
			}else if(request.isUserInRole("Manager")){
				message = "Username : " + principal.getName() + " You are only a Manager, Don't you have a Spreadsheet to be working on??";
			}else if(request.isUserInRole("Guest")){
				message = "Username : " + principal.getName() + " You're wasting my resources...";
			}
			
			//Add the welcome message to the faces context
			FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(FacesMessage.SEVERITY_INFO, message, null));
			return "success";
		} catch (ServletException e) {
			FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR, "An Error Occured: Login failed", null));
			e.printStackTrace();
		}
		return "failure";

Next We’re going to add a little code for the LoginBean logout() method. Add the following code into your method.

HttpSession session = (HttpSession) FacesContext.getCurrentInstance().getExternalContext().getSession(false);
		if(session != null){
			session.invalidate();
		}
		FacesContext.getCurrentInstance().getApplication().getNavigationHandler().handleNavigation(FacesContext.getCurrentInstance(), null, "/Login.xhtml");

N.B: This method basically invalidates our current session. Notice how we Navigated back to our Login.xhtml page using the FacesContext. Thats the way for JSF Navigation from within you Java code, however I always recommend creating the Navigation Rule in your faces-config.xml file whenever possible.

Finally, in your LoginBean constructor, add the following logout code.

	public LoginBean(){
		HttpSession session = (HttpSession) FacesContext.getCurrentInstance().getExternalContext().getSession(false);
		if(session != null){
			session.invalidate();
		}
	}

This ensures that whenever you’re prompted with a login screen, it kills any previous sessions. This is because if you try to login while there is an existing session, you get an exception and login fails.

Now Run your login.xhtml page and you should be able to login to they system, and see your message.
If you used my creation script for your database, the password is the same as username.
ie. greenkode – greenkode, guest – guest, boss – boss.

Click the Logout hyperlink and you should be redirected back to your login page.


Section 2 : Authorization.

Now if you notice, The login aspect works fine, however you can run the dashboard page directly without having to login. This invalidates the existence of your login page, so lets fix that. This section talks about Authorization. Authorization controls access to the different resources, basically determines who can see what, go where or do what.

Step 1: Create Authorized Areas
Create 3 new Folders by Right Clicking on your WebContent Folder and Selecting New > Folder
Name the folders admin, guest and manager respectively.
Inside the admin folder, create a facelet page and call it AdminDashboard.xhtml
Likewise create GuestDashboard.xhtml and ManagerDashboard.xhtml facelets respectively in the guest and manager folders.
Your folder structure should look something like this.



Now add the following code into your AdminDashboard.xhtml file.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:f="http://java.sun.com/jsf/core">

<head>
<link rel="stylesheet" type="text/css" href="../style/main.css" />
</head>
<h:body styleClass="body">
	<h:outputText value="Administrators Dashboard!!!" styleClass="header"></h:outputText>
	<h:messages></h:messages>
	<h:form>
		<h:commandLink value="Logout" action="#{loginBean.logout}"></h:commandLink>
	</h:form>
</h:body>
</html>

Likewise for your GuestDashboard.xhtml

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:f="http://java.sun.com/jsf/core">

<head>
<link rel="stylesheet" type="text/css" href="../style/main.css" />
</head>
<h:body styleClass="body">
	<h:outputText value="Guest Dashboard!!!" styleClass="header"></h:outputText>
	<h:messages></h:messages>
	<h:form>
		<h:commandLink value="Logout" action="#{loginBean.logout}"></h:commandLink>
	</h:form>
</h:body>
</html>

And finally for your ManagerDashboard.xhtml

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:f="http://java.sun.com/jsf/core">

<head>
<link rel="stylesheet" type="text/css" href="../style/main.css" />
</head>
<h:body styleClass="body">
	<h:outputText value="Manager Dashboard!!!" styleClass="header"></h:outputText>
	<h:messages></h:messages>
	<h:form>
		<h:commandLink value="Logout" action="#{loginBean.logout}"></h:commandLink>
	</h:form>
</h:body>
</html>

Next Open up your web.xml file and add the following code inside the web-app tag.

<security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Admin Area</web-resource-name>
  		<url-pattern>/faces/admin/*</url-pattern>
  	</web-resource-collection>
  	<auth-constraint>
		<role-name>Administrator</role-name>
	</auth-constraint>
  </security-constraint>

N.B: The above code is a security constraint for a web resource collection. ie admin folder. As you can see the url-pattern points to everything in the admin folder. The auth-constraints describes the roles that have access to that folder. In this case, only the Administrator role has access.
We will now repeat the code for the other roles.

  <security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Manager Area</web-resource-name>
  		<url-pattern>/faces/manager/*</url-pattern>
  	</web-resource-collection>
  	<auth-constraint>
		<role-name>Manager</role-name>
		<role-name>Administrator</role-name>
	</auth-constraint>
  </security-constraint>
  <security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Guest Area</web-resource-name>
  		<url-pattern>/faces/guest/*</url-pattern>
  	</web-resource-collection>
  	<auth-constraint>
		<role-name>Guest</role-name>
		<role-name>Manager</role-name>
		<role-name>Administrator</role-name>
	</auth-constraint>
  </security-constraint>

N.B: As you can see above we’ve added security constraints for the manager and guest folders. however notice the difference in the authorized roles.
In the auth-constraint for the manager role, we have Manager and Administrator. which means that Administrators also have access to the manager folder. Likewise All 3 roles are allowed in the guest folder.
So The Administrator has access to all folders, however only the Administrator has access to the admin folder. Likewise the Managers have access to the manager and guest folders, however he doesn’t have access to the admin folder.
Finally, the guest user only has access to the guest folder.

Next Step: Configure Redirection from Login page.
Open Your faces-config.xml file. add the 3 new facelets you created and create links to all of them from the 3 login pages.
Your Navigation rule should look like this.



This basically shows where the page should navigate to depending on the outcome of the login() method in your LoginBean.
Now Modify the Code in the login() method of your LoginBean to return the outcome that corresponds with your user role.

	public String login(){
		String message = "";
		String navto = "";
		HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
		try {
			
			//Login via the Servlet Context
			request.login(username, password);
			
			//Retrieve the Principal
			Principal principal = request.getUserPrincipal();
			
			//Display a message based on the User role
			if(request.isUserInRole("Administrator")){
				message = "Username : " + principal.getName() + " You are an Administrator, you can really f**k things up now";
				navto = "admin";
			}else if(request.isUserInRole("Manager")){
				message = "Username : " + principal.getName() + " You are only a Manager, Don't you have a Spreadsheet to be working on??";
				navto = "manager";
			}else if(request.isUserInRole("Guest")){
				message = "Username : " + principal.getName() + " You're wasting my resources...";
				navto = "guest";
			}
			
			//Add the welcome message to the faces context
			FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(FacesMessage.SEVERITY_INFO, message, null));
			return navto;
		} catch (ServletException e) {
			FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR, "An Error Occured: Login failed", null));
			e.printStackTrace();
		}
		return "failure";
	}

Now if your user is an Administrator, the method returns admin and your FacesContext knows from the Navigation rule to navigate to the Admin dashboard. this is a simple way to control the user access to resources on your site.
Now You can run your Login page. and notice that when you log in as an Administrator, it takes you to your Administrator Dashboard, likewise for the Guest and Manager.

Next Step: Test Authorization.
Log in as Administrator, now without logging out, run the GuestDashboard.xhtml file. Confirm that you can view the contents of the Dashboard. Likewise run the ManagerDashboard.xhtml file and confirm that you can also see the dashboard.
Now repeat the process for the Guest user and the Manager User.
Now if the Manager user tries to access the AdminDashboard.xhtml file. he gets a nice glassfish Access denied page. Same happens if the guest tries to access the AdminDashboard.xhtml or ManagerDashboard.xhtml files.
Here is a screenshot of the Access denied page.



As you can see, its not very nice, not something that you want users of your site to see. We’ll fix that in a moment.

Next Step : Create our custom 403 error page.
Create a new facelet page in your WebContent folder, call it AccessDenied.xhtml.
Place the following code in your AccessDenied.xhtml file

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:f="http://java.sun.com/jsf/core">

<head>
<link rel="stylesheet" type="text/css" href="../style/main.css" />
</head>
<h:body styleClass="body">
	<h:outputText value="Access Denied!!!" styleClass="header"></h:outputText>
	<h:outputText
		value="You don't have sufficient rights to view the page you're requesting, 
			contact your administrator if you need access!!"></h:outputText>
	<h:messages></h:messages>
	<h:form>
		<h:commandLink value="Back to Login Page." action="/Login.xhtml"></h:commandLink>
	</h:form>
</h:body>
</html>

Finally, configure it in your web.xml file.
Open your web.xml file and enter the following code somewhere inside the root web-app tag. preferably after all the security-role tags

  <error-page>
  	<error-code>403</error-code>
  	<location>/faces/AccessDenied.xhtml</location>
  </error-page>

Just for reference, your web.xml file should look something like this. ( xml headers might not be exactly the same)

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" 
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" 
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>com.greenkode.registration</display-name>
  <servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
  </servlet-mapping>
  <security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Admin Area</web-resource-name>
  		<url-pattern>/faces/admin/*</url-pattern>
  	</web-resource-collection>
  	<auth-constraint>
		<role-name>Administrator</role-name>
	</auth-constraint>
  </security-constraint>
  <security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Manager Area</web-resource-name>
  		<url-pattern>/faces/manager/*</url-pattern>
  	</web-resource-collection>
  	<auth-constraint>
		<role-name>Manager</role-name>
		<role-name>Administrator</role-name>
	</auth-constraint>
  </security-constraint>
  <security-constraint>
  	<web-resource-collection>
  		<web-resource-name>Guest Area</web-resource-name>
  		<url-pattern>/faces/guest/*</url-pattern>
  	</web-resource-collection>
  	<auth-constraint>
		<role-name>Guest</role-name>
		<role-name>Manager</role-name>
		<role-name>Administrator</role-name>
	</auth-constraint>
  </security-constraint>
  <login-config>
  	<auth-method>FORM</auth-method>
  	<realm-name>GreenkodeRealm</realm-name>
  	<form-login-config>
  		<form-login-page>/faces/Login.xhtml</form-login-page>
  		<form-error-page>/faces/Login.xhtml</form-error-page>
  	</form-login-config>
  </login-config>
  <security-role>
  	<role-name>Administrator</role-name>
  </security-role>
  <security-role>
  	<role-name>Manager</role-name>
  </security-role>
  <security-role>
  	<role-name>Guest</role-name>
  </security-role>
  <error-page>
  	<error-code>403</error-code>
  	<location>/faces/AccessDenied.xhtml</location>
  </error-page>
</web-app>

N.B: You can use the same method to trap other error codes. even servlet exceptions that usually show up on screen.
Now If you login as guest and try to access the AdminDashboard.xhtml, you should view our fancy new Access Denied Screen.



Thats it for Now.
I’ve taken you through the basics of User authentication via Servlet login method call to JAAS, configuring a JDBC Realm(login module) in Glassfish, and also restricting access to web application resources based on user role. If you need to research further, you’ll find lots of good books and resources on the Internet. You can download the completed project here.

Thats it guys, If this tutorial was helpful, please share it with your fellow enthusiasts, and don’t forget to click that +1 button at the top of the post. Also if you have any interesting questions on java programming topics, please send me your requests on the contact page, and I will create tutorials for them.
You can also subscribe to my RSS Feeds and get New tutorials as they are released.

Thanks Greenkode











21 Comments for User Authentication and Authorization Using JAAS and Servlet 3.0 Login.


Gabriel

Hi, great info man, thx a lot..

can i do all this without creating a view in the database right? just adding the tables to the security realm rigth?

(reply)

    greenkode_admin

    Glassfish expects the User info and the group info to be in the same table. but that’s not very good Database design. To Ensure Normalization of our database, it would be better to create a view as the representation of the two tables.

    (reply)

      gabriel

      also, im working this out on NetBeans 6.9.1 with glassfish 3.0.1, and i did everything to the letter… except the database and the jndi part because i’ve already created them, and i can’t log in, i have the passwords hashed with MD5 and also tried on plain text and still, no anwer… how can i trace the request to the Realm on the server or something like that, cause i’ve tried with both Basic and Form authentication, and no answer… dont know if the tables have to be exactly as u did and all other stuff the same

      (reply)

        gabriel

        nevermind, already fixed it, it appears the database architechture was worong, i had to use the same that u use in this example, with the view and everyting, but now i have another question, in the constraints that u set on the example, i’ve notice they’re through url patterns, thtat’s cool, but i’ve noticed in a jsf application the url that appears on the browser is 1 page behind all the time, so i believe this isn’t gonna work that well, how do i fix that so the app will pick up the pattern i set? thx A LOT for this tutorial, magnificent information

        (reply)

          greenkode_admin

          Okay, Glad you fixed it.
          Again, the problem you’re having with the browser url might have to do with a difference between Netbeans and eclipse.
          If you open up your navigation rule in the faces-config.xml file. Ensure that the redirect tag is included under your navigation rules, when moving from one page to another. that should fix it.
          Your Navigation rule should look something like

          	<navigation-rule>
		<display-name>Login</display-name>
		<from-view-id>/Login.xhtml</from-view-id>
		<navigation-case>
			<from-outcome>recover</from-outcome>
			<to-view-id>/RecoverPassword.xhtml</to-view-id>
			<redirect />
		</navigation-case>
	</navigation-rule>

          I hope this solves the problem.
          Thanks

Gabriel

hello, i’m getting this error sometimes “java.lang.IndexOutOfBoundsException: Index: 0, Size: 0″ do you happen to know what’s that about? sorry, im such a noob on JSF actually

(reply)

    greenkode_admin

    dude, thats a very general exception. it occurs when you reference an array value that is beyond the length of the array.
    if you have an array of length 10, you’ll have that exception if you try to reference array[11].
    ie In order for me to diagnose it, i’ll have to see some code and the exception stack trace. just

    (reply)

gesc

HI again, sorry to bother u so much, but i have a little doubt about something, whan i authenticate the user, where are stored the values of username and roles etc, im trying to use the username to make a query on the database and the result is then displayed on the screen, i mean, information only related to that specific user. thanks again for all your help, is been a relief to find an expert with good tutorials about JSF

(reply)

    greenkode_admin

    If you are in the servlet context you can use. ServletContext.isUserInRole() or getServletContext().getUserPrincipal(). So for instance, if you’re inside a ManagedBean the code is something like
    FacesContext.getCurrentInstance().getExternalContext().getUserPrincipal(); to return the Principal Object
    FacesContext.getCurrentInstance().getExternalContext().isUserInRole(“Administrator”); to check if the user is in a defined role.

    If you’re in the EJB context
    You can use SessionContext.getCallerPrincipal() and SessionContext.isCallerInRole() do some google searches, you should find more detailed answers

    (reply)

Sisay

It is a very nice post i used jdbc realm for one project everything works fine except for one little detail. a lot of posts on the internet shows how to navigate user according to their Role after they log in. but i need the users who redirected from other websites to restricted resources to be automatically to login page and redirected back to the original requested resource/page. how can tackle that without putting a servlet and do the redirection myself. Thank u for putting this article together it helps much.

(reply)

    greenkode_admin

    You’re going to have to write your own custom code using either servlets or Filters. I”ve seen some stuff like that done before. I”m quite swamped at the moment, but If I can find time soon, I’ll put some sample code online.

    (reply)

Meer

Hello, Thanks for the article, it is indeed well understood, However, I can’t log in and I don’t know what might be wrong. it always take me to the error page as I have a different error page. I have checked everything seems to be fine and working. but I get the following error

javax.servlet.ServletException: Exception thrown while attempting to authenticate for user

(reply)

    greenkode_admin

    If I had to guess, I would say your error is in the Glassfish admin console. go back and verify the connection details to your database. Also reading the stack trace should indicate whether the exception is thrown by glassfish or the underlying jsf context.

    (reply)

Meer

Thank you very much
it is indeed great and clear article,

(reply)

JSF: Authentication & Authorization, best way forward | PHP Developer Resource

[...] first thing I plan on doing is to follow this User Authentication and Authorization using JAAS and Servlet 3.0 Login example. This I believe will fulfil my first 3 [...]

(reply)

Oumayma

Hi,
I’m doing an authentification page with jsf and JPa in NetBeans. if the authentification succeded, the user is moved to another page. if not, an error msg appears. in the first case, I didn’t know how to do it. I’m beginner in this stuffs. I wish you could help..

(reply)

Clarisse

Hello! First of all I’d like to thank you for the very explanative tutorial. I was looking for days and your is the best I have seen. Sencondy, I’d like some help. I’m getting trouble with the authorization session. My logout() funcition works well when there is no authorization rules. After I modifying the web.xml and sun-web.xml, constructing the pages like /admin/AdminDashBoard.xhtml and modifying the login() function, I got trouble. I can login perfectly but when I try to logout the link lead to a page that is similar my Login.xhtml, but it’s like it could not finish the “loading” of the page. When I try to access the links like /admin/AdminDashBoard.xhtml directly in my browser, there is no restriction but the page that appears is that strange page of the “almost Login.xhtml”. I get no exceptions and no erros on console, so that I can’t find why this is happening. Do you know something that can help me?

(reply)

    Clarisse

    Forgot to say that I’m using PrimeFaces. Without it my logout works well. I can’t understand why the authorization does not work with it.

    (reply)

Related Site

I was studying some of your content on this internet site and I believe this website is very informative ! Continue putting up.

(reply)

richa

Hi,
Nice article. I am looking for some applications (web application or desktop application based on java/jsp) based on JAAS to do some experiments in my research work. Could you please tell me where can I find such applications ? I found myna JAAS examples but am looking for some real world like application.

Thanks.

(reply)

Gary Carranza

Hello I have this problema with my page…

HTTP Status 500 –

——————————————————————————–

type Exception report

message

descriptionThe server encountered an internal error () that prevented it from fulfilling this request.

exception
javax.servlet.ServletException: Session has expired

root cause
org.icefaces.application.SessionExpiredException: Session has expired

note The full stack traces of the exception and its root causes are available in the GlassFish Server Open Source Edition 3.1.2.2 logs.

The LoginBean ever invalid the session … NullPointerException also shows..Please Helpme…:(

(reply)




Leave a Reply