title: How to configure JBoss DatabaseServerLoginModule for Digest Authentication in a Web Application
body: <p>In a sentence, I want to configure JBoss 4.2.2 to use DatabaseServerLoginModule as the login-module for a Web application that is secured via Digest Authentication.  The problem I am having is that the passwords fail to validate.  I suspect the issue is either in how I've defined the application policy or in how the passwords are stored in the database.</p>
  
  <p>Below are all the relevant files.  I have a MySQL database with users and roles defined using the following schema:</p>
  
  <pre><code>CREATE TABLE SR_USER (
    ID BIGINT(19) NOT NULL AUTO_INCREMENT,
    USERNAME VARCHAR(20) NOT NULL,
    PASSWORD VARCHAR(255) NOT NULL,
    PRIMARY KEY (ID)
  )
  CHARACTER SET utf8;
  
  CREATE TABLE SR_ROLE (
    ID BIGINT(19) NOT NULL AUTO_INCREMENT,
    ROLE_NAME VARCHAR(20) NOT NULL,
    PRIMARY KEY (ID)
  )
  CHARACTER SET utf8;
  
  CREATE TABLE SR_USER_ROLE (
    FK_USER_ID BIGINT(19) NOT NULL,
    FK_ROLE_ID BIGINT(19) NOT NULL,
    FOREIGN KEY (FK_USER_ID) REFERENCES SR_USER (ID),
    FOREIGN KEY (FK_ROLE_ID) REFERENCES SR_ROLE (ID)
  )
  CHARACTER SET utf8;
  </code></pre>
  
  <p>for the application policy in the login-config.xml file I have the following defined:</p>
  
  <pre><code>&lt;application-policy name="secrest"&gt;
      &lt;authentication&gt;
          &lt;login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
              flag="required"&gt;
              &lt;module-option name="dsJndiName"&gt;java:/SecRestDS&lt;/module-option&gt;
              &lt;module-option name="principalsQuery"&gt;
                  SELECT PASSWORD FROM SR_USER WHERE USERNAME=?
                  &lt;/module-option&gt;
              &lt;module-option name="rolesQuery"&gt;
                  SELECT r.ROLE_NAME FROM SR_ROLE r, SR_USER_ROLE ur, SR_USER u WHERE
                  u.USERNAME=? AND u.ID=ur.FK_USER_ID AND ur.FK_ROLE_ID=r.ID 
                  &lt;/module-option&gt;
              &lt;module-option name="hashAlgorithm"&gt;MD5&lt;/module-option&gt;
              &lt;module-option name="hashEncoding"&gt;hex&lt;/module-option&gt;
          &lt;/login-module&gt;
      &lt;/authentication&gt;
  &lt;/application-policy&gt;
  </code></pre>
  
  <p>here is the web.xml file for my web application:</p>
  
  <pre><code>&lt;web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      version="2.5"&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;JerseyServlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;com.sun.jersey.spi.container.servlet.ServletContainer&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;javax.ws.rs.Application&lt;/param-name&gt;
              &lt;param-value&gt;com.acme.samples.SecureRESTApplication&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;JerseyServlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;secrest&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;admin&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;login-config&gt;
          &lt;auth-method&gt;DIGEST&lt;/auth-method&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/security-role&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>and finally, here is the jboss-web.xml:</p>
  
  <pre><code>&lt;jboss-web&gt;
   &lt;security-domain&gt;java:/jaas/secrest&lt;/security-domain&gt;
  &lt;/jboss-web&gt;
  </code></pre>
  
  <p>I should also add that I populate the data base with the following content:</p>
  
  <pre><code>INSERT INTO SR_ROLE (ROLE_NAME) VALUES ('admin');
  INSERT INTO SR_ROLE (ROLE_NAME) VALUES ('apiuser');
  
  INSERT INTO SR_USER (USERNAME, PASSWORD) VALUES ('user1', PASSWORD('p455w0rd'));
  INSERT INTO SR_USER (USERNAME, PASSWORD) VALUES ('user2', 'p455w0rd');
  INSERT INTO SR_USER (USERNAME, PASSWORD) VALUES ('user3', 'a4fd8e6fa9fbf9a6f2c99e7b70aa9ef2');
  
  INSERT INTO SR_USER_ROLE (FK_USER_ID, FK_ROLE_ID) VALUES (1, 1);
  INSERT INTO SR_USER_ROLE (FK_USER_ID, FK_ROLE_ID) VALUES (1, 2);
  
  INSERT INTO SR_USER_ROLE (FK_USER_ID, FK_ROLE_ID) VALUES (2, 1);
  INSERT INTO SR_USER_ROLE (FK_USER_ID, FK_ROLE_ID) VALUES (2, 2);
  
  INSERT INTO SR_USER_ROLE (FK_USER_ID, FK_ROLE_ID) VALUES (3, 1);
  INSERT INTO SR_USER_ROLE (FK_USER_ID, FK_ROLE_ID) VALUES (3, 2);
  </code></pre>
  
  <p>As you can see above, all three users (e.g. user1, user2, user3) all have the same password; but in each case the password is encoded (or not) using MD5 hash.  None of the above, however, work.  This is at the core of the issue I think.</p>