Confusion in form based authentication in java

Question

Could anyone please tell me, how can I handle the j_security_check servlet in Form based authentication in java?

Do I have to map the servlet class with j_security_check name in web-xml file like:

<servlet>
<servlet-name>Anyname</servlet-name>
<servlet-class>Anyclass</servlet-name>
</servlet>

<servlet-mapping>
<servlet-name>Anyname</servlet-name>
<url-pattern>/j_security_check</url-pattern>
</servlet-mapping> 

If I enter the user name and pasword, and click on submit, then how will servlet with j_security_check name going to handle those info? How will that servlet going to verify those entered user name, and password, and get the resource, if authentication, and then authorization succeed, otherwise error page. How will j_security_check servlet will do that?

Answer 1

You do not need to map the j_security_check to anything. This is managed by the Application Server.
However you DO NEED to add usernames. roles and realm information.
Each application server has its own way of authenticating this information.

See this -
1) http://www.student.nada.kth.se/~d95-cro/j2eetutorial14/doc/Security5.html#wp303355 and
2) http://docs.sun.com/app/docs/doc/819-3669/bncby?a=view

Answer 2

The idea is that you write a JSP or Servlet that presents a form with the following fields and action:

<form action="j_security_check" method="post">
    <input type="text" name="j_username"/>
    <input type="password" name="j_password"/>
    <input type="submit"/>
</form>

When the form is submitted, the servlet container checks the credentials for you using the mechanism you've defined (e.g. JAAS). In your web.xml, you set the following:

<login-config>
    <form-login-check>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/error.jsp</form-error-page>
    </form-login-check>
</login-config>

This allows the container to locate the JSP or Servlet containing your form, or your error handling code. If you haven't already, I'd recommend having a read of the Servlet Specification.