title: Wildfly Security Constraint Ignored
body: <p>I am trying to secure a demo web application on wildfly.
  I have defined this security domain in the standalone.xml</p>
  <pre class="lang-xml prettyprint-override"><code>    &lt;security-domains&gt;
          &lt;security-domain name=&quot;projects&quot; cache-type=&quot;default&quot;&gt;
              &lt;authentication&gt;
                  &lt;login-module code=&quot;Database&quot; flag=&quot;required&quot;&gt;
                      &lt;module-option name=&quot;dsJndiName&quot; value=&quot;java:jboss/datasources/TestDS&quot;/&gt;
                      &lt;module-option name=&quot;rolesQuery&quot; value=&quot;SELECT role, 'Roles' FROM users WHERE username=?&quot;/&gt;
                      &lt;module-option name=&quot;hashAlgorithm&quot; value=&quot;MD5&quot;/&gt;
                      &lt;module-option name=&quot;hashEncoding&quot; value=&quot;hex&quot;/&gt;
                      &lt;module-option name=&quot;principalsQuery&quot; value=&quot;SELECT password from users WHERE username=?&quot;/&gt;
                  &lt;/login-module&gt;
              &lt;/authentication&gt;
              &lt;authorization&gt;
                  &lt;policy-module code=&quot;Database&quot; flag=&quot;required&quot;&gt;
                      &lt;module-option name=&quot;dsJndiName&quot; value=&quot;java:jboss/datasources/school&quot;/&gt;
                      &lt;module-option name=&quot;rolesQuery&quot; value=&quot;SELECT role, 'Roles' FROM users WHERE username=?&quot;/&gt;
                      &lt;module-option name=&quot;hashAlgorithm&quot; value=&quot;MD5&quot;/&gt;
                      &lt;module-option name=&quot;hashEncoding&quot; value=&quot;hex&quot;/&gt;
                      &lt;module-option name=&quot;principalsQuery&quot; value=&quot;SELECT password from users WHERE username=?&quot;/&gt;
                  &lt;/policy-module&gt;
              &lt;/authorization&gt;
          &lt;/security-domain&gt;
      &lt;/security-domains&gt;
  </code></pre>
  <p>then under the web-inf I have defined this security costraints in the web.xml</p>
  <pre class="lang-xml prettyprint-override"><code>    &lt;web-app xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xmlns=&quot;http://xmlns.jcp.org/xml/ns/javaee&quot; xsi:schemaLocation=&quot;http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd&quot; id=&quot;WebApp_ID&quot; version=&quot;3.1&quot;&gt;
        
        &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
            &lt;web-resource-name&gt;projects&lt;/web-resource-name&gt;
            &lt;url-pattern&gt;/twp/projects/*&lt;/url-pattern&gt;
            &lt;http-method&gt;POST&lt;/http-method&gt;
            &lt;http-method&gt;GET&lt;/http-method&gt;
            &lt;http-method&gt;PUT&lt;/http-method&gt;
            &lt;http-method&gt;DELETE&lt;/http-method&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
            &lt;role-name&gt;ADMINISTRATOR&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
        &lt;/security-constraint&gt;
        
        &lt;login-config&gt;
          &lt;auth-method&gt;FORM&lt;/auth-method&gt;
          &lt;realm-name&gt;projects&lt;/realm-name&gt;
          &lt;form-login-config&gt;
            &lt;form-login-page&gt;/login.xhtml&lt;/form-login-page&gt;
            &lt;form-error-page&gt;/error.xhtml&lt;/form-error-page&gt;
          &lt;/form-login-config&gt;
        &lt;/login-config&gt;
        &lt;security-role&gt;
          &lt;role-name&gt;ADMINISTRATOR&lt;/role-name&gt;
        &lt;/security-role&gt;
        &lt;security-role&gt;
          &lt;role-name&gt;USER&lt;/role-name&gt;
        &lt;/security-role&gt;
      &lt;/web-app&gt;
  </code></pre>
  <p>and this content in the jboss-web.xml</p>
  <pre class="lang-xml prettyprint-override"><code>    &lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
      &lt;jboss-web&gt;
        &lt;security-domain&gt;java:/jaas/projects&lt;/security-domain&gt;
      &lt;/jboss-web&gt;
  </code></pre>
  <p>the problem is that if i go to the /projects  URL I m not redirect to the login page as if the constraint was ignored.</p>