Login configuration in Vaadin/Spring application in JBoss AS 7 - authentication

Question

I am trying to configure authentication in my Vaadin/Spring application deployed in JBoss AS 7, but I cannot find any documentation on this. I've managed to configure the application so that only authenticated user can use it. Here is a part of my web.xml:
<security-constraint>
<display-name>SecureApplicationConstraint</display-name>
<web-resource-collection>
<web-resource-name>Vaadin application</web-resource-name>
<description>The entire Vaadin application is protected</description>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>Only valid users are allowed</description>
<role-name>ROLE_ADMIN</role-name>
<role-name>ROLE_DOCTOR</role-name>
<role-name>ROLE_PATIENT</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>file</realm-name>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/loginError.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description/>
<role-name>ROLE_ADMIN</role-name>
</security-role>
<security-role>
<description/>
<role-name>ROLE_DOCTOR</role-name>
</security-role>
<security-role>
<description/>
<role-name>ROLE_PATIENT</role-name>
</security-role>
Now the application won't be displayed until the user is authenticated. What I expected was, that the user would be automatically redirected to the login form. I still have to configure the JBoss app server, but cannot find how. I used to work with JBoss 5, where this configuration was done in a login-config.xml file. Does anybody know hoe to configure the authentication REALM in JBoss 7 and make the Vaadin application redirect the user to the login form if he is not authenticated yet? Thanks for your help,
Bye,
Filip

Answer 1

First, a couple of questions -
(1)what is happening when you try to access a resource,
and (2)the security constraint covers/protects anything in the domain.
But your login page is there too.
Would you try limiting the url-pattern to something that wouldn't include the login page, like /myprotectedfolder/* instead?

Answer 2

I've found that FORM-based login is tricky in Vaadin, as Vaadin servlet is by default mapped to /*, which means that your login.jsp will also be handled by it. I implemented my login programmatically with the LoginForm, which seems like a nicer integration. However, it's not really what your question is about...
In JBoss AS 7 the configs moved to {jboss}/standalone/configuration/standalone.xml or {jboss}/standalone/configuration/domain.xml, depending on your setup. In most common cases it's standalone.xml. Here's the sample of my database-driven security domain:
<subsystem xmlns="urn:jboss:domain:security:1.0">
<security-domains>
<security-domain name="MySecurityDomain">
<authentication>
<login-module code="Database" flag="required">
<module-option name="dsJndiName" value="java:jboss/datasources/MyDS"/>
<module-option name="principalsQuery" value="SELECT PASSWORD FROM PRINCIPAL WHERE USERNAME=?"/>
<module-option name="rolesQuery" value="SELECT r.name, 'Roles' FROM role r, principal_role pr, principal p WHERE p.username=? AND p.user_id=pr.user_id AND pr.role_id=r.role_id"/>
<module-option name="hashAlgorithm" value="MD5"/>
<module-option name="hashEncoding" value="hex"/>
</login-module>
</authentication>
</security-domain>
</security-domains>
</subsystem>
I hope this helps.