Check the following..

That the JNDI name DefaultDS matches the one in your DS file.
e.g. mySql_ds.xml in your deploy directory

Dont go to...

When I goto http://localhost:8080/myREALM/loginForm.jsp

Go to...

When I goto http://localhost:8080/myREALM/

Your web.xml contains the name of the page login.jsp
once its authenticates you, you will be automatically redirected to the page in you welcome setting. e.g. index.html

Also check that you have some user/password information in your tables.

See my post for a list of all the steps you need to take.

http://www.jboss.com/index.html?module=bb&op=viewtopic&t=71151

Hi.

The first step is therefore to create a login page, containing a form like this:

" <..form action="j_security_check" method="post">
Username: < input type="text" name="j_username" size="22"/>
Password: < input type="password" name="j_password" size="22"/>
< input type="submit" value="Login" />
--- form >"

The username and password will be intercepted by the JBoss SecurityInterceptor and passed to the JAASSecurityManager class as Principal and Credential objects. It is worth noting here that if a user bookmarks a login page, or uses the browser back button to reach the page, they will see an error. This is a feature of the Tomcat implementation of the j_security_check mechanism. The next step is to set up the web.xml file as follows:
...................
..............
<security-constraint>
<web-resource-collection>
<web-resource-name>Sample Application</web-resource-name>
Require users to authenticate
<url-pattern>*.jsp</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
Only allow Authenticated_users role
<role-name>Authenticated_users</role-name>
</auth-constraint>
<user-data-constraint>
Encryption is not required for the application in general.

<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login_error.html</form-error-page>
</form-login-config>
</login-config>
..............
.............

Next, the login-config.xml file must be set up to specify that this security domain requires a certain set of LoginModules:

<application-policy name="sample_web_client_security">
<login-module code="org.jboss.security.ClientLoginModule"
flag="required"/>
<login-module code="com.sample.security.GenericJbossLoginModule"
flag="required"/>

</application-policy>
U can specify your module name hear.

........... now u can get the login user role in jsp like this..




<%if(request.isUserInRole("Member_admin")){%>
<%-- admin users have access to protected methods --%>
List Users
Secure method

<%} else{%>
<%-- non-admins are only allowed to list users - if a user
attempts to submit to ...SampleServlet?method=secure, the EJB
method will not be accessible --%>
List Users
<%}%>


.....................
j_security_check is use your loginmoudle and authenticate the user.

for more information :- http://www.developer.com/security/article.php/3077421

thx
itcube.ians