title: j_security_check to SSO in different module under Oracle App Server?
body: <p>I have an existing j2ee application running on Oracle App Server.  It is targeted towards paying customers so the content is secured and a SSO module properly intercepts all requests for secured content.</p>
  
  <p>Now the company is adding a unbranded public-facing module with a number of unsecured pages.  At one point the user is expected to register for a free account and log in to proceed further.  Think doctors adding a public-facing site with information for potential patients, or lawyers adding a public-facing site with information for potential clients.  There's some information on the session and the usual approach would be to authenticate the user, persist the session information using the now-known user id, invalidate the existing session (to prevent certain types of attacks), the reload the session information before returning to the user.  I can't just persist it under the session id since that's about to change.</p>
  
  <p>The glitch is that the existing application already has an SSO module and I get a 404 error every time I try to direct to j_security_check.  I've tried that, /sso/j_security_check, even <a href="http://localhost/sso/j_security_check" rel="nofollow noreferrer">http://localhost/sso/j_security_check</a>, all without success.</p>
  
  <p>I noticed that an earlier question said that tomcat requires access to a secured page before j_security_check is even visible.  I don't know if that's the case with Oracle AS.</p>
  
  <p>Ideas?  Or is the best approach to continue arguing that we have a different user base so it would be better to handle authentication in our own module anyway?  </p>