title: How to perform j_security_check user credentials check in Vaadin?
body: <p>I have an old web application which I need to migrate to Vaadin.</p>
  
  <p>In the old app there is a page which asks the user for login and password.</p>
  
  <p>The JSP page looks like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml" xml:lang="ru" lang="ru"&gt;
  
  &lt;%@ page contentType="text/html;charset=UTF-8" language="java" pageEncoding="utf-8"%&gt;
  [...]
  &lt;head&gt;
  &lt;title&gt;Some product&lt;/title&gt;
      &lt;link rel="stylesheet" type="text/css" href="&lt;%=request.getContextPath()+"/css/styles.css"%&gt;" /&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;%@ include file="inc/main-navigation.jsp"%&gt;
      &lt;form action="j_security_check" method="post" style="margin:0px"&gt;
          [...]
          &lt;input type="text" style="width:100%" name="j_username" /&gt;
          &lt;input type="password" name="j_password" /&gt;
      &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><code>web.xml</code> contains following entries:</p>
  
  <pre><code>&lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;Some product&lt;/realm-name&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/login_fail.jsp&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p>This means that in case of unsuccessful authentication the user is directed to page <code>login_fail.jsp</code>.</p>
  
  <p>In the <code>context.xml</code> file I found following entry from which I conclude that there is an internal mechanism in Tomcat which reads correct login and password from the specified database and performs their check without any additional code.</p>
  
  <pre><code>&lt;Context path="/myapp"&gt;
      &lt;Realm className="org.apache.catalina.realm.JDBCRealm" driverName="com.microsoft.sqlserver.jdbc.SQLServerDriver" 
          connectionURL="[...]"
          userTable="[...]" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="[...]" roleNameCol="role_name"/&gt;
  &lt;/Context&gt;
  </code></pre>
  
  <p>In the Vaadin application I have a UI with both text fields and a button.</p>
  
  <pre><code>public class BookkeepingView extends VerticalLayout implements View {
      public BookkeepingView()
      {
          VerticalLayout contentPanel = new VerticalLayout();
  
          contentPanel.setStyleName("body");
          contentPanel.addComponent(getHeaderPanel());
          contentPanel.addComponent(getLoginPanel());
          contentPanel.addComponent(getFooterPanel());
  
          addComponent(contentPanel);
      }
  
      private Component getHeaderPanel() {
          return createCustomLayoutPanel("main-navigation");
      }
  
      private Component getFooterPanel() {
          return createCustomLayoutPanel("copyright");
      }
  
      private CustomLayout getLoginPanel() {
          Panel panel = new Panel();
          panel.setSizeUndefined();
          addComponent(panel);
  
          CustomLayout customLayoutPanel = new CustomLayout("login");
  
          final TextField userName = new TextField();
          customLayoutPanel.addComponent(userName, "j_username");
  
          final PasswordField password = new PasswordField();
          customLayoutPanel.addComponent(password, "j_password");
  
          final Button loginButton = new Button(I18n.l("bookkeeping_login_button"));
          customLayoutPanel.addComponent(loginButton, "login");
  
          loginButton.addClickListener(new Button.ClickListener() {
              @Override
              public void buttonClick(Button.ClickEvent clickEvent) {
                  loginButtonPressed();
              }
          });
  
          return customLayoutPanel;
      }
  
      private void loginButtonPressed() {
          Notification.show("Login button pressed", Notification.Type.TRAY_NOTIFICATION);
      }
  
      private CustomLayout createCustomLayoutPanel(final String aHtmlFileName) {
          Panel panel = new Panel();
          panel.setSizeUndefined();
          addComponent(panel);
  
          CustomLayout customLayoutPanel = new CustomLayout(aHtmlFileName);
          return customLayoutPanel;
      }
  
  
      @Override
      public void enter(ViewChangeListener.ViewChangeEvent event) {
  
      }
  }
  </code></pre>
  
  <p>When the user presses the button (method <code>loginButtonPressed</code> is executed), I want to </p>
  
  <ol>
  <li>check the credentials entered in text fields <code>userName</code> and <code>password</code>,</li>
  <li>display a notification box, if the credentials are wrong and</li>
  <li>opens another UI (view), if they are correct.</li>
  </ol>
  
  <p>How can I make my Vaadin application access that Tomcat mechanism for checking the credentials (i. e. my Vaadin application should perform the credentials check in exactly the same way as the old app)?</p>
  
  <p>What code allows me to check whether user name <code>x</code> and password <code>y</code> are valid according to database specified in <code>context.xml</code>?</p>
  
  <p><strong>Update 1 (05.11.2013):</strong> I found a description of how to use realm-based authentication <a href="https://vaadin.com/wiki/-/wiki/Main/Creating%20Secure%20Vaadin%20Applications%20using%20JEE6" rel="nofollow">here</a>.</p>
  
  <p>But I ran into a problem:</p>
  
  <p>The application servlet in the example extends <code>com.vaadin.terminal.gwt.server.AbstractApplicationServlet</code>, which is not available in my Vaadin 7 project.</p>
  
  <pre><code>@WebServlet(urlPatterns={"/ui/*", "/VAADIN/*"})
  public class DemoAppServlet extends AbstractApplicationServlet {
  </code></pre>
  
  <p><strong>Update 2 (05.11.2013 15:53):</strong> </p>
  
  <p>I tried to implement authentication in the simplest possible way:</p>
  
  <p>1) Use BASIC authentication mechanism.
  2) Configure the web app so that <strong>all</strong> Vaadin pages require the user to be logged in.</p>
  
  <p>In order to achieve this, I added following fragments to <code>web.xml</code>:</p>
  
  <pre><code>&lt;servlet-mapping&gt;
      &lt;servlet-name&gt;VaadinDemoApp&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;security-constraint&gt;
      &lt;display-name&gt;VaadinDemoApplicationConstraint&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Vaadin application&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
          &lt;role-name&gt;viewer&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;Protected page&lt;/realm-name&gt;
  &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;admin&lt;/role-name&gt;
  &lt;/security-role&gt;
  
  &lt;security-role&gt;
      &lt;role-name&gt;viewer&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p>But it doesn't work: The credentials dialog box is displayed upon access to the application, but when I enter correct credentials and press "OK", the same dialog box appears again.</p>