title: BASIC Authentication and SSL configuration failed in Tomcat 6.0
body: <p>The application is a simple JSP/Servlet application.I want to perform a user authentication (using BASIC Authentication) and if the user is authenticated, then I will redirect them to the home screen using SSL (i.e. https). <strong>The BASIC Authentication has to be performed on clicking a button.</strong></p>
  
  <p>For achieveing this; initially I configured the BASIC Authentication in my web.xml like this:</p>
  
  <pre><code>&lt;security-role&gt;
    &lt;role-name&gt;Admin&lt;/role-name&gt;      
  &lt;/security-role&gt;
  &lt;security-role&gt;
    &lt;role-name&gt;Guest&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;security-constraint&gt;      
    &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;BasicDemo&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
        &lt;http-method&gt;POST&lt;/http-method&gt;
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
        &lt;role-name&gt;Admin&lt;/role-name&gt;
    &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
    &lt;auth-method&gt;BASIC&lt;/auth-method&gt;      
  &lt;/login-config&gt;
  </code></pre>
  
  <p>The user BASIC Authentcation part of the code works perfectly (the popup dialog appears asking for the username and password and it works fine)</p>
  
  <p>Then I configured SSL by following the following steps:</p>
  
  <p>1) Generated a Keystore using keytool</p>
  
  <p>2) Added the below entry in the server.xml:</p>
  
  <pre><code>&lt;Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
             maxThreads="150" scheme="https" secure="true"
             clientAuth="false" sslProtocol="TLS" 
         keystoreFile="${user.home}/.keystore"
         keystorePass="password" /&gt;
  </code></pre>
  
  <p>3) Added this in web.xml inside the </p>
  
  <pre><code>&lt;user-data-constraint&gt;
        &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
    &lt;/user-data-constraint&gt; 
  </code></pre>
  
  <p>On running the application, below are the issues I have with it:</p>
  
  <p>1) On clicking the button (for which the BASIC authentication has to be performed),  the dialog for authentication did not appeared (which appears for BASIC Authentication asking for username and password) </p>
  
  <p>2) I was redirected to a link with https (yes the https appeared in the url) with GET and the doGet() method of the servlet gets executed which is incorrect since the submit button form is like this, henc the doPost method should be executed rather than the doGet:</p>
  
  <pre><code>&lt;form action="CentralController" method="post"&gt;
  </code></pre>
  
  <p>One mistake from my side may be using the POST rather than GET for authentication but still I feel this should work, I might be missing something and hence it does not work. Please let me know where are the issues and how to resolve it achieve what I am expecting.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Servlet definition in <strong>web.xml</strong></p>
  
  <pre><code> &lt;servlet&gt;
    &lt;servlet-name&gt;CentralController&lt;/servlet-name&gt;
    &lt;servlet-class&gt;com.controller.CentralController&lt;/servlet-class&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
    &lt;servlet-name&gt;CentralController&lt;/servlet-name&gt;
    &lt;url-pattern&gt;/CentralController&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>This is the form:</p>
  
  <pre><code>&lt;form action="CentralController" method="post"&gt;
      &lt;input type="submit" value="Submit" name="submit"&gt;
  &lt;/form&gt;
  </code></pre>