2 Replies Latest reply: Jun 22, 2012 2:15 AM by ionutvaidianu RSS

JAAS Login issue

ionutvaidianu Newbie



I'm quite new to JBoss AS, so please bare with me and any help is appreciated.


Here is my problem: I have a RichFaces web application and I want to restrict access to most of the pages. As far as I have found so far the best way (opened for suggetions and debate here) to secure content is at container level by defining a security domain and a module that will authorize the users so they can be able to access secured pages.


I have done all the configuration, the pages are protected, but even from a user that authenticates. In other words event after authentication I get redirected to the login page and cannot access any of the protected pages. I get no error / message in the server console (The log level for CONSOLE is on DEBUG).


Is it a known issue, is there a WA for it or am I doing something wrong?




Here is the setup:

JBoss AS 7.1.1 Final, standalone configuration.


The security domain (the associated datasource is functional because at some point I got wrong password in the server console):


                <security-domain name="SecuredRealm">


                        <login-module code="Database" flag="required">

                            <module-option name="dsJndiName" value="java:jboss/datasources/securityDS"/>

                            <module-option name="principalsQuery" value="select passwd from Users where username=?"/>

                            <module-option name="rolesQuery" value="select userRoles,'Roles' from UserRoles where username=?"/>

                            <module-option name="hashAlgorithm" value="MD5"/>

                            <module-option name="hashEncoding" value="base64"/>

                            <module-option name="unauthenticatedIdentity" value="guest"/>

                            <module-option name="maxInvalidLoginAttempts" value="5"/>







<?xml version="1.0" encoding="UTF-8"?>


















<!-- <user-data-constraint> -->

<!-- <transport-guarantee>CONFIDENTIAL</transport-guarantee> -->

<!-- </user-data-constraint> -->






<web-resource-name>Unprotected area</web-resource-name>