title: Unable to setup basic authentication with jdbc realm and Glassfish
body: <p>I'm fighting with a Glassfish v3 and a very simple JAX-RS service (taken at<a href="http://www.vogella.de/articles/REST/article.html" rel="nofollow noreferrer">http://www.vogella.de/articles/REST/article.html</a></p>
  
  <p>What I want to achieve is setup basic http authentication for all the resources. If wish when a user request <a href="http://localhost:8080/de.vogella.jersey.first/rest/hello" rel="nofollow noreferrer">http://localhost:8080/de.vogella.jersey.first/rest/hello</a>, the browser popups an alert prompting for username+password.</p>
  
  <p>I've decided to go for a JDBCRealm authentication. I use PostgreSQL 8.4 and the correct JDBC driver.</p>
  
  <p>My problem is that the authentication doesn't seem to be active (the HTTP headers are very simple ones :</p>
  
  <pre><code>Request URL:http://localhost:8080/de.vogella.jersey.first/rest/hello
  
  Request Method:GET
  Status Code:200 OK
  Request Headers
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
  Cache-Control:max-age=0
  Connection:keep-alive
  Cookie:JSESSIONID=ec48541dc7654806fcf022d79e66; treeForm:tree-hi=treeForm:tree:configuration:loggerSetting
  Host:localhost:8080
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1
  
  Response Headers
  Content-Type:text/html
  Date:Fri, 07 Oct 2011 14:26:26 GMT
  Server:GlassFish Server Open Source Edition 3.0.1
  Transfer-Encoding:chunked
  X-Powered-By:Servlet/3.0
  </code></pre>
  
  <p>The authentication is setup but seems inactive. At that point, I need your skills for analyzing what I've done wrong.</p>
  
  <p>What I've done so far :</p>
  
  <p>1/ Deployed the JAX-RS service (this works ok, see previous URL)
   2/ Created a database, created two tables :</p>
  
  <pre><code>CREATE TABLE groups
  (
    username character varying(16) NOT NULL,
    id character varying(20) NOT NULL,
    CONSTRAINT groups_pkey PRIMARY KEY (username, id),
    CONSTRAINT fk_username FOREIGN KEY (username)
        REFERENCES users (username) MATCH SIMPLE
        ON UPDATE NO ACTION ON DELETE NO ACTION
  );
  
  CREATE TABLE users
  (
    username character varying(16) NOT NULL,
    "password" character varying(32) NOT NULL,
    CONSTRAINT users_pkey PRIMARY KEY (username)
  );
  </code></pre>
  
  <p>and populated them as follow :</p>
  
  <p>table "groups" -> "webuser";"employees"</p>
  
  <p>table "users" -> "webuser";"webuser"</p>
  
  <p>3/ In the Glassfish admin GUI,I added a Connect Pool called "postgres" as follow :
  <img src="https://i.stack.imgur.com/Pm44D.png" alt="http://puu.sh/6DZV">
  The additional properties are shown here :
  <img src="https://i.stack.imgur.com/C5FxJ.png" alt="http://puu.sh/6E05"></p>
  
  <p>4/ I then created a JDVC Resource called "postgres" as shown below :
  <img src="https://i.stack.imgur.com/JaWlu.png" alt="http://puu.sh/6E0H"></p>
  
  <p>5/ In the Glassfish admin GUI, I added a Security Realm, called "postgres", as shown below :
  <img src="https://i.stack.imgur.com/JUodS.png" alt="http://puu.sh/6E1b"></p>
  
  <p>6/ I also set to "FINEST" the log level for javax.enterprise.system.core.security in the "Logger Settings".
  After requesting the webservice from a browser, I get the following in the server.log file :</p>
  
  <pre><code>[#|2011-10-07T16:26:26.410+0200|FINE|glassfish3.0.1|javax.enterprise.system.core.security|_ThreadID=67;_ThreadName=Thread-1;ClassName=com.sun.enterprise.security.web.integration.WebSecurityManager;MethodName=setPolicyContext;|[Web-Security] Policy Context ID was: de.vogella.jersey.first/de_vogella_jersey_first|#]
  
  [#|2011-10-07T16:26:26.412+0200|FINE|glassfish3.0.1|javax.enterprise.system.core.security.com.sun.enterprise.security|_ThreadID=67;_ThreadName=Thread-1;ClassName=com.sun.enterprise.security.SecurityContext;MethodName=setCurrentSecurityContext;|SecurityContext: setCurrentSecurityContext method called|#]
  </code></pre>
  
  <p>7/ Regarding the code, I didn't add any annotation, but I updated my web.xml as follow :</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"&gt;
    &lt;display-name&gt;de.vogella.jersey.first&lt;/display-name&gt;
    &lt;servlet&gt;
      &lt;description&gt;JAX-RS Tools Generated - Do not modify&lt;/description&gt;
      &lt;servlet-name&gt;JAX-RS Servlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.sun.jersey.spi.container.servlet.ServletContainer&lt;/servlet-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;com.sun.jersey.config.property.packages&lt;/param-name&gt;
        &lt;param-value&gt;de.vogella.jersey.first&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;JAX-RS Servlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
    &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;customer creation&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
         &lt;http-method&gt;GET&lt;/http-method&gt;
         &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;webusers&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
  
    &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;postgres&lt;/realm-name&gt;
    &lt;/login-config&gt;
  
    &lt;security-role&gt;
      &lt;role-name&gt;webusers&lt;/role-name&gt;
    &lt;/security-role&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>And the sun-web.xml as follow :</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd"&gt;
  &lt;sun-web-app error-url=""&gt;
    &lt;context-root&gt;/de.vogella.jersey.first&lt;/context-root&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;webusers&lt;/role-name&gt;
      &lt;group-name&gt;webusers&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    &lt;class-loader delegate="true"/&gt;
    &lt;jsp-config&gt;
      &lt;property name="keepgenerated" value="true"&gt;
        &lt;description&gt;Keep a copy of the generated servlet class java code.&lt;/description&gt;
      &lt;/property&gt;
    &lt;/jsp-config&gt;
  &lt;/sun-web-app&gt;
  </code></pre>
  
  <p>What is wrong with this ? Did I forgot anything ?</p>
  
  <p>Thank you for your time !</p>