title: Oracle ADF Secured App Gives HTTP 401 Error
body: <p>I am new to Oracle ADF Framework. I develop on JDeveloper 11g R2 with Weblogic 10.3.5.0. I developed an project like described in a Firebox training video on <a href="http://www.youtube.com/watch?v=mAWBezngA1s&amp;list=UUDuJRHUKigQbAFMoewPZxzg&amp;index=5&amp;feature=plpp_video" rel="nofollow">Youtube</a>.
  You can download my project from <a href="http://dl.dropbox.com/u/7799447/Proje.rar" rel="nofollow">here</a></p>
  
  <p>The video was about creating a custome login page. You have to create login,error anad the target pages. When you try to open target page login page comes then you enter your credentials. After success yoou should be directed to the target page.
  I used a backing bean to process credentials but instead of redirected to target page the response page gives:</p>
  
  <p>Error 401--Unauthorized
  From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
  10.4.2 401 Unauthorized</p>
  
  <p>And the weblogic console this error:</p>
  
  <pre><code>    Target URL -- http://127.0.0.1:7101/Deneme-ViewController-context-root/faces/protectedPage.jspx
  &lt;ViewHandlerImpl&gt; &lt;_checkTimestamp&gt; Apache Trinidad is running with time-stamp checking enabled. This should not be used in a production environment. See the org.apache.myfaces.trinidad.CHECK_FILE_MODIFICATION property in WEB-INF/web.xml
  &lt;UIXEditableValue&gt; &lt;_isBeanValidationAvailable&gt; A Bean Validation provider is not present, therefore bean validation is disabled
  &lt;LifecycleImpl&gt; &lt;_handleException&gt; ADF_FACES-60098:Faces lifecycle receives unhandled exceptions in phase RENDER_RESPONSE 6
  java.lang.IllegalStateException: Cannot forward a response that is already committed
      at weblogic.servlet.internal.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:122)
      at com.sun.faces.context.ExternalContextImpl.dispatch(ExternalContextImpl.java:546)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at oracle.adfinternal.view.faces.config.rich.RecordRequestAttributesDuringDispatch.dispatch(RecordRequestAttributesDuringDispatch.java:44)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at org.apache.myfaces.trinidadinternal.context.FacesContextFactoryImpl$OverrideDispatch.dispatch(FacesContextFactoryImpl.java:167)
      at com.sun.faces.application.view.JspViewHandlingStrategy.executePageToBuildView(JspViewHandlingStrategy.java:363)
      at com.sun.faces.application.view.JspViewHandlingStrategy.buildView(JspViewHandlingStrategy.java:154)
      at org.apache.myfaces.trinidadinternal.application.ViewDeclarationLanguageFactoryImpl$ChangeApplyingVDLWrapper.buildView(ViewDeclarationLanguageFactoryImpl.java:341)
      at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._renderResponse(LifecycleImpl.java:982)
      at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:334)
      at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:232)
      at javax.faces.webapp.FacesServlet.service(FacesServlet.java:313)
      at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
      at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
      at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:300)
      at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:173)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:122)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
      at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:293)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:199)
      at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:111)
      at java.security.AccessController.doPrivileged(Native Method)
      at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:313)
      at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:413)
      at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:94)
      at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:161)
      at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:136)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3715)
      at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3681)
      at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
      at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
      at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2277)
      at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2183)
      at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1454)
      at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
      at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
  &lt;Apr 18, 2012 3:21:24 PM EEST&gt; &lt;Error&gt; &lt;HTTP&gt; &lt;BEA-101020&gt; &lt;[ServletContext@28001210[app:Deneme module:Deneme-ViewController-context-root path:/Deneme-ViewController-context-root spec-version:2.5]] Servlet failed with Exception
  java.lang.IllegalStateException: Cannot forward a response that is already committed
      at weblogic.servlet.internal.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:122)
      at com.sun.faces.context.ExternalContextImpl.dispatch(ExternalContextImpl.java:546)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at oracle.adfinternal.view.faces.config.rich.RecordRequestAttributesDuringDispatch.dispatch(RecordRequestAttributesDuringDispatch.java:44)
      Truncated. see log file for complete stacktrace
  &gt; 
  &lt;Apr 18, 2012 3:21:24 PM EEST&gt; &lt;Notice&gt; &lt;Diagnostics&gt; &lt;BEA-320068&gt; &lt;Watch 'UncheckedException' with severity 'Notice' on server 'DefaultServer' has triggered at Apr 18, 2012 3:21:24 PM EEST. Notification details: 
  WatchRuleType: Log 
  WatchRule: (SEVERITY = 'Error') AND ((MSGID = 'WL-101020') OR (MSGID = 'WL-101017') OR (MSGID = 'WL-000802') OR (MSGID = 'BEA-101020') OR (MSGID = 'BEA-101017') OR (MSGID = 'BEA-000802')) 
  WatchData: DATE = Apr 18, 2012 3:21:24 PM EEST SERVER = DefaultServer MESSAGE = [ServletContext@28001210[app:Deneme module:Deneme-ViewController-context-root path:/Deneme-ViewController-context-root spec-version:2.5]] Servlet failed with Exception
  java.lang.IllegalStateException: Cannot forward a response that is already committed
      at weblogic.servlet.internal.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:122)
      at com.sun.faces.context.ExternalContextImpl.dispatch(ExternalContextImpl.java:546)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at oracle.adfinternal.view.faces.config.rich.RecordRequestAttributesDuringDispatch.dispatch(RecordRequestAttributesDuringDispatch.java:44)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at javax.faces.context.ExternalContextWrapper.dispatch(ExternalContextWrapper.java:93)
      at org.apache.myfaces.trinidadinternal.context.FacesContextFactoryImpl$OverrideDispatch.dispatch(FacesContextFactoryImpl.java:167)
      at com.sun.faces.application.view.JspViewHandlingStrategy.executePageToBuildView(JspViewHandlingStrategy.java:363)
      at com.sun.faces.application.view.JspViewHandlingStrategy.buildView(JspViewHandlingStrategy.java:154)
      at org.apache.myfaces.trinidadinternal.application.ViewDeclarationLanguageFactoryImpl$ChangeApplyingVDLWrapper.buildView(ViewDeclarationLanguageFactoryImpl.java:341)
      at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._renderResponse(LifecycleImpl.java:982)
      at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:334)
      at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:232)
      at javax.faces.webapp.FacesServlet.service(FacesServlet.java:313)
      at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
      at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
      at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:300)
      at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:173)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:122)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
      at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:293)
      at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:199)
      at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:111)
      at java.security.AccessController.doPrivileged(Native Method)
      at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:313)
      at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:413)
      at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:94)
      at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:161)
      at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:136)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
      at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
      at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3715)
      at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3681)
      at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
      at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
      at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2277)
      at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2183)
      at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1454)
      at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
      at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
   SUBSYSTEM = HTTP USERID = &lt;WLS Kernel&gt; SEVERITY = Error THREAD = [ACTIVE] ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)' MSGID = BEA-101020 MACHINE = Metasis-PC TXID =  CONTEXTID = 922cea34c05f1394:4758d71c:136c5648195:-8000-0000000000000074 TIMESTAMP = 1334751684128  
  WatchAlarmType: AutomaticReset 
  WatchAlarmResetPeriod: 30000 
  &gt; 
  &lt;Apr 18, 2012 3:21:26 PM EEST&gt; &lt;Alert&gt; &lt;Diagnostics&gt; &lt;BEA-320016&gt; &lt;Creating diagnostic image in c:\users\metasis\appdata\roaming\jdeveloper\system11.1.2.1.38.60.81\defaultdomain\servers\defaultserver\adr\diag\ofm\defaultdomain\defaultserver\incident\incdir_39 with a lockout minute period of 1.&gt; 
  </code></pre>
  
  <p>My backing bean java code:</p>
  
  <pre><code>public String doLogin() {
      String un = _username;
      byte[] pw = _password.getBytes();
      FacesContext ctx = FacesContext.getCurrentInstance();
      HttpServletRequest request = (HttpServletRequest)ctx.getExternalContext().getRequest();
      Subject mySubject;
      try {
          mySubject = Authentication.login(new URLCallbackHandler(un, pw));
          ServletAuthentication.runAs(mySubject, request);
          ServletAuthentication.generateNewSessionID(request);
          String loginUrl = "/adfAuthentication?success_url=/faces/protectedPage.jspx";
          HttpServletResponse response = (HttpServletResponse)ctx.getExternalContext().getResponse();
                      RequestDispatcher dispatcher = request.getRequestDispatcher(loginUrl);
                      dispatcher.forward(request, response);
          //response.sendRedirect(loginUrl);
      } catch (FailedLoginException e) {
          FacesMessage msg = new FacesMessage(FacesMessage.SEVERITY_ERROR, "Invalid Username or Password", "Invalid Username or Password");
          ctx.addMessage(null, msg);
      } catch (Exception e) {
          e.printStackTrace();
      }
      return null;
  }
  </code></pre>
  
  <p>And before the application start there is an interesting error code:</p>
  
  <pre><code>[03:20:38 PM] Redeploying Application...
  &lt;CodebasePolicyHandler&gt; &lt;migrateDeploymentPolicies&gt; Migration of codebase policy failed. Reason: oracle.security.jps.JpsException: java.lang.reflect.InvocationTargetException.
  &lt;AppPolicyHandler&gt; &lt;migrateAppPolicies&gt; Migration of application policy failed. Reason: oracle.security.jps.JpsException: java.lang.reflect.InvocationTargetException.
  [03:20:55 PM] Application Redeployed Successfully.
  </code></pre>
  
  <p>Thanx for the help!</p>