title: JAAS Forbidden Error (403) when accessing a protected URL
body: <p>I have just started working on a pet project using JSF, JPA, and EJB on a GlassFish server and I'm currently setting up the authentication module using JAAS. It's about complete now except for a bug for which I can't figure out a solution.</p>
  
  <p><strong>My Premise</strong></p>
  
  <p>I have a single table <em>users</em> in the database in which I store all <em>email</em>, <em>password</em>, and <em>role</em> (not normalized for now). I don't have any provisions for groups. Users are simply assigned a single role.</p>
  
  <p>The data I've is something like:</p>
  
  <pre><code>username        |   role   |      password
  mannyee            Member        (sha-256 value)  
  </code></pre>
  
  <p>I've set up a JDBC realm (findRoomieRealm) in the GlassFish server. The attributes setup there are:</p>
  
  <pre><code>JAAS Context    :   jdbcRealm
  JNDI        :   jdbc/sample
  User Table  :   users
  User Name Column:   email 
  Password Column :   password
  Group Table :   users
  Group Name Column:  role
  Password Encryption Algorithm:  SHA-256
  Group Table User Name Column: (empty)
  </code></pre>
  
  <p>And then I setup the following in my web.xml</p>
  
  <pre><code>&lt;welcome-file-list&gt;
      &lt;welcome-file&gt;pages/user/dashboard.xhtml&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  
  &lt;!-- Protected area definition --&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Restricted Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/pages/user/*&lt;/url-pattern&gt; 
      &lt;/web-resource-collection&gt;
  
      &lt;auth-constraint&gt;
          &lt;role-name&gt;MEMBER&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  
  &lt;!-- Login page --&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;findRoomieRealm&lt;/realm-name&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/faces/login.xhtml&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/faces/error.xhtml&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  
  &lt;!-- System roles --&gt;
  &lt;security-role&gt;
   &lt;role-name&gt;ADMIN&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;security-role&gt;
   &lt;role-name&gt;MEMBER&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p><strong>My Issue:</strong></p>
  
  <p>When I try to access a protected page, Login page does intercept the request where I can successfully login to the system. I can verify this by the log generated by the server:</p>
  
  <pre><code>Fine:   [Web-Security] Setting Policy Context ID: old = null ctxID = findRoomie/findRoomie
  Fine:   [Web-Security] hasUserDataPermission perm: ("javax.security.jacc.WebUserDataPermission" "/j_security_check" "POST")
  Fine:   [Web-Security] hasUserDataPermission isGranted: true
  Finest:   Processing login with credentials of type: class com.sun.enterprise.security.auth.login.common.PasswordCredential 
  Fine:   Logging in user [mannyee] into realm: findRoomieRealm using JAAS module: jdbcRealm
  Fine:   Login module initialized: class com.sun.enterprise.security.ee.auth.login.JDBCLoginModule
  Finest:   JDBC login succeeded for: mannyee groups:[Member]
  Fine:   JAAS login complete.
  Fine:   JAAS authentication committed.
  Fine:   Password login succeeded for : mannyee
  Fine:   Set security context as user: mannyee
  </code></pre>
  
  <p>But I get a Forbidden status on the requested page (immediately after login) and on the log file I get:</p>
  
  <pre><code>Fine:   [Web-Security] Setting Policy Context ID: old = null ctxID = findRoomie/findRoomie
  Fine:   [Web-Security] hasUserDataPermission perm: ("javax.security.jacc.WebUserDataPermission" "" "GET")
  Fine:   [Web-Security] hasUserDataPermission isGranted: true
  Fine:   [Web-Security] Policy Context ID was: findRoomie/findRoomie
  Fine:   [Web-Security] Codesource with Web URL: file:/findRoomie/findRoomie
  Fine:   [Web-Security] Checking Web Permission with Principals : null
  Fine:   [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/pages/user/dashboard.xhtml" "GET")
  Finest:   JACC Policy Provider: PolicyWrapper.implies, context (findRoomie/findRoomie)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/pages/user/dashboard.xhtml" "GET"))
  Fine:   [Web-Security] hasResource isGranted: false
  Fine:   [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/pages/user/dashboard.xhtml" "GET")
  Fine:   [Web-Security] Policy Context ID was: findRoomie/findRoomie
  Fine:   [Web-Security] Generating a protection domain for Permission check.
  Fine:   [Web-Security] Checking with Principal : mannyee
  Fine:   [Web-Security] Checking with Principal : Member
  Fine:   [Web-Security] Codesource with Web URL: file:/findRoomie/findRoomie
  Fine:   [Web-Security] Checking Web Permission with Principals : mannyee, Member
  Fine:   [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/pages/user/dashboard.xhtml" "GET")
  Finest:   JACC Policy Provider: PolicyWrapper.implies, context (findRoomie/findRoomie)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/pages/user/dashboard.xhtml" "GET"))
  Fine:   [Web-Security] hasResource isGranted: false
  </code></pre>
  
  <p>Although the user with Member role should have gained access on it, server forbids the request from user mannyee. So I set up the following on glassfish-web.xml (sun-web.xml)</p>
  
  <pre><code>&lt;security-role-mapping&gt;
      &lt;role-name&gt;Member&lt;/role-name&gt;
      &lt;principal-name&gt;mannyee&lt;/principal-name&gt;
      &lt;!--        &lt;group-name&gt;Member&lt;/group-name&gt;--&gt;
    &lt;/security-role-mapping&gt;
  </code></pre>
  
  <p>But still I can't get this user to access the page. I think the issue lies somewhere in role assignment. Sever log shows that GlassFish attempts to authorize by taking both 'mannyee' and 'Member' as principals but fails for both. There is also a line that says </p>
  
  <pre><code>    Fine:   [Web-Security] Checking Web Permission with Principals : null
  </code></pre>
  
  <p>I am not quite sure what that means.</p>
  
  <p>Can anyone please point out what I am missing here?</p>
  
  <p>Thanks!!</p>