title: Java EE container authentication on Jboss using Spring Security
body: <p>I'm trying to implement client authentication on Jboss EAP 6.2 with Spring Security in order to protect my REST api (with no login page), but I've stucked. </p>
  
  <p>Trying to send authentication request with ajax:</p>
  
  <pre><code>$.ajax({
      type : "POST",
      url : '/client-web/j_security_check',
      data : {
          j_username : user,
          j_password : pass
      }
  }).done(function(data) {
      $('div#result').append($('div').text('Login ' + user + ' OK'));
  }).fail(function(data) {
      console.log(data) 
      $('div#result').append($('div').text('Login ' + user + ' FAIL'));
  });
  </code></pre>
  
  <p>I received '404 Not Found' as response. I've also tried to access j_spring_security_check but result was the same. 
  Sending request to one of my <em>/rest/</em> methods always returned '403 Forbidden', even if I sent username and password fields in ajax request or provided <code>"Authorization" : "Basic *XXXX*"</code> header.</p>
  
  <p>So now I cannot realize what should I do to authenticate my user against my application and how to check the authentication on subsequent requests.</p>
  
  <p>I'm new to Spring Security and security at all as well as Java EE technologies and  a spent two whole days trying make it work but with no luck. So that's why I'm here asking you guys for help. I would appreciate any useful advice or the link to appropriate resources. </p>
  
  <p>Here are the contents of my configuration files which I messed with:</p>
  
  <p><strong>root-context.xml</strong>:</p>
  
  <pre><code>    &lt;http entry-point-ref="preAuthEntryPoint"
          authentication-manager-ref="authenticationManager" auto-config="false"
          realm="ApplicationRealm"&gt;
          &lt;intercept-url pattern="/rest/**" access="ROLE_CUSTOMER" /&gt;
  
          &lt;!-- &lt;form-login /&gt; --&gt;
          &lt;http-basic /&gt;
          &lt;logout /&gt;
          &lt;jee mappable-roles="customer" /&gt;
      &lt;/http&gt;
  
      &lt;beans:bean name="preAuthEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"&gt;
      &lt;/beans:bean&gt;
  
      &lt;authentication-manager alias="authenticationManager"
          id="authenticationManager"&gt;
          &lt;sec:authentication-provider
              ref="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider" /&gt;
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean
          class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"
          id="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
          &lt;beans:property name="preAuthenticatedUserDetailsService"&gt;
              &lt;beans:bean
                  class="org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService"&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
  </code></pre>
  
  <p><strong>web.xml</strong>:</p>
  
  <pre><code>    &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring/root-context.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;clientServlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/spring/clientServlet/servlet-context.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;clientServlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;/resources/home.html&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;All Content&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;ROLE_CUSTOMER&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;security-role&gt;
          &lt;role-name&gt;ROLE_CUSTOMER&lt;/role-name&gt;
      &lt;/security-role&gt;
  </code></pre>
  
  <p><strong>jboss-web.xml</strong> has only one node: <code>&lt;security-domain&gt;mySecurity&lt;/security-domain&gt;</code></p>
  
  <p>And in the jboss <strong>standalone.xml</strong> config file there is a <code>&lt;security-domain&gt;</code>:</p>
  
  <pre><code>&lt;security-domain name="mySecurity" cache-type="default"&gt;
      &lt;authentication&gt;
          &lt;login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"&gt;
              &lt;module-option name="dsJndiName" value="java:jboss/datasources/myDs"/&gt;
              &lt;module-option name="principalsQuery" value="select u.password from users u where u.username=?"/&gt;
              &lt;module-option name="rolesQuery" value="select r.name as rolename, 'Roles' as rolegroup from users u inner join users_roles ur on (ur.users_id = u.id) inner join roles r on (ur.roles_id = r.id) where u.username=?"/&gt;
          &lt;/login-module&gt;
      &lt;/authentication&gt;
  &lt;/security-domain&gt;
  </code></pre>