Unable to setup basic authentication with jdbc realm and Glassfish - glassfish

Question

I'm fighting with a Glassfish v3 and a very simple JAX-RS service (taken athttp://www.vogella.de/articles/REST/article.html
What I want to achieve is setup basic http authentication for all the resources. If wish when a user request http://localhost:8080/de.vogella.jersey.first/rest/hello, the browser popups an alert prompting for username+password.
I've decided to go for a JDBCRealm authentication. I use PostgreSQL 8.4 and the correct JDBC driver.
My problem is that the authentication doesn't seem to be active (the HTTP headers are very simple ones :
Request URL:http://localhost:8080/de.vogella.jersey.first/rest/hello
Request Method:GET
Status Code:200 OK
Request Headers
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Cache-Control:max-age=0
Connection:keep-alive
Cookie:JSESSIONID=ec48541dc7654806fcf022d79e66; treeForm:tree-hi=treeForm:tree:configuration:loggerSetting
Host:localhost:8080
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1
Response Headers
Content-Type:text/html
Date:Fri, 07 Oct 2011 14:26:26 GMT
Server:GlassFish Server Open Source Edition 3.0.1
Transfer-Encoding:chunked
X-Powered-By:Servlet/3.0
The authentication is setup but seems inactive. At that point, I need your skills for analyzing what I've done wrong.
What I've done so far :
1/ Deployed the JAX-RS service (this works ok, see previous URL)
2/ Created a database, created two tables :
CREATE TABLE groups
(
username character varying(16) NOT NULL,
id character varying(20) NOT NULL,
CONSTRAINT groups_pkey PRIMARY KEY (username, id),
CONSTRAINT fk_username FOREIGN KEY (username)
REFERENCES users (username) MATCH SIMPLE
ON UPDATE NO ACTION ON DELETE NO ACTION
);
CREATE TABLE users
(
username character varying(16) NOT NULL,
"password" character varying(32) NOT NULL,
CONSTRAINT users_pkey PRIMARY KEY (username)
);
and populated them as follow :
table "groups" -> "webuser";"employees"
table "users" -> "webuser";"webuser"
3/ In the Glassfish admin GUI,I added a Connect Pool called "postgres" as follow :
The additional properties are shown here :
4/ I then created a JDVC Resource called "postgres" as shown below :
5/ In the Glassfish admin GUI, I added a Security Realm, called "postgres", as shown below :
6/ I also set to "FINEST" the log level for javax.enterprise.system.core.security in the "Logger Settings".
After requesting the webservice from a browser, I get the following in the server.log file :
[#|2011-10-07T16:26:26.410+0200|FINE|glassfish3.0.1|javax.enterprise.system.core.security|_ThreadID=67;_ThreadName=Thread-1;ClassName=com.sun.enterprise.security.web.integration.WebSecurityManager;MethodName=setPolicyContext;|[Web-Security] Policy Context ID was: de.vogella.jersey.first/de_vogella_jersey_first|#]
[#|2011-10-07T16:26:26.412+0200|FINE|glassfish3.0.1|javax.enterprise.system.core.security.com.sun.enterprise.security|_ThreadID=67;_ThreadName=Thread-1;ClassName=com.sun.enterprise.security.SecurityContext;MethodName=setCurrentSecurityContext;|SecurityContext: setCurrentSecurityContext method called|#]
7/ Regarding the code, I didn't add any annotation, but I updated my web.xml as follow :
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
<display-name>de.vogella.jersey.first</display-name>
<servlet>
<description>JAX-RS Tools Generated - Do not modify</description>
<servlet-name>JAX-RS Servlet</servlet-name>
<servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
<init-param>
<param-name>com.sun.jersey.config.property.packages</param-name>
<param-value>de.vogella.jersey.first</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>JAX-RS Servlet</servlet-name>
<url-pattern>/rest/*</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>customer creation</web-resource-name>
<url-pattern>/rest/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>webusers</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>postgres</realm-name>
</login-config>
<security-role>
<role-name>webusers</role-name>
</security-role>
</web-app>
And the sun-web.xml as follow :
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd">
<sun-web-app error-url="">
<context-root>/de.vogella.jersey.first</context-root>
<security-role-mapping>
<role-name>webusers</role-name>
<group-name>webusers</group-name>
</security-role-mapping>
<class-loader delegate="true"/>
<jsp-config>
<property name="keepgenerated" value="true">
<description>Keep a copy of the generated servlet class java code.</description>
</property>
</jsp-config>
</sun-web-app>
What is wrong with this ? Did I forgot anything ?
Thank you for your time !

Answer 1

I found out that I had to disable the "Keep session between deployments". This option can be found in the server, by double-clicking on the deployment server and unchecking the box.