Here's an access log from a successful login using Firefox.=A0 Note the pos=
t toj_security_check returns a 302 and the id of the authenticated user sho=
ws in the returned request for a page located in the secured portion of the=
site.=0A213.20.160.134 - - [05/Apr/2011:22:44:31 -0700] "GET /catalog/deal=
erwelcome.jsp HTTP/1.1" 200 1870=0A213.20.160.134 - - [05/Apr/2011:22:44:40=
-0700] "POST /catalog/authControl.jsp HTTP/1.1" 302 -=0A213.20.160.134 - -=
[05/Apr/2011:22:44:40 -0700] "GET /catalog/dealer/dealerwelcome.jsp HTTP/1=
.1" 200 1910=0A213.20.160.134 - - [05/Apr/2011:22:44:44 -0700] "POST /catal=
og/dealer/j_security_check HTTP/1.1" 302 -=0A213.20.160.134 - dickeastlake@=
progressivecommerce.com [05/Apr/2011:22:44:44 -0700] "GET /catalog/dealer/d=
ealerwelcome.jsp HTTP/1.1" 200 2391=0A=0AHere's a failed attempt (phony id/=
password) using IENote the post to j_security_check returns a 200 and there=
is no returned request.=0A74.77.201.185 - - [05/Apr/2011:22:52:46 -0700] "=
GET /catalog/dealerwelcome.jsp HTTP/1.1" 200 1870=0A74.77.201.185 - - [05/A=
pr/2011:22:53:05 -0700] "POST /catalog/authControl.jsp HTTP/1.1" 302 -=0A74=
.77.201.185 - - [05/Apr/2011:22:53:05 -0700] "GET /catalog/dealer/dealerwel=
come.jsp HTTP/1.1" 200 1897=0A74.77.201.185 - - [05/Apr/2011:22:53:12 -0700=
] "POST /catalog/dealer/j_security_check HTTP/1.1" 200 676=0A=0AThe above e=
xamples show correct results using IE and Firefox.=0AHere's an access log f=
rom an unsuccessful login using Chrome.=A0 Note the post to j_security_chec=
k returns a 200 even though the id/password entered was a valid one.=A0=0A7=
4.77.201.185 - - [05/Apr/2011:23:35:58 -0700] "GET /catalog/dealerwelcome.j=
sp HTTP/1.1" 200 1870=0A74.77.201.185 - - [05/Apr/2011:23:36:06 -0700] "POS=
T /catalog/authControl.jsp HTTP/1.1" 302 -=0A74.77.201.185 - - [05/Apr/2011=
:23:36:06 -0700] "GET /catalog/dealer/dealerwelcome.jsp HTTP/1.1" 200 1893=
=0A74.77.201.185 - - [05/Apr/2011:23:36:09 -0700] "POST /catalog/dealer/j_s=
ecurity_check HTTP/1.1" 200 676=0A=0A=A0Again, IE & Firefox work fine, Mac,=
Google and Safari don't.=0A=A0=0A=A0Thanks for your help,=0A=A0Dick=0A=0A_=
_______________________________=0AFrom: Andr=E9 Warnier <aw@ice-sa.com>=0AT=
o: Tomcat Users List <users@tomcat.apache.org>=0ASent: Tuesday, April 5, 20=
11 6:43 PM=0ASubject: Re: IE & Firefox work fine, Mac, Google and Safari do=
n't authenticate=0A=0AHi.=0A=0ASince I doubt that many people here really f=
eel like going through a bunch of lines of badly-formatted configuration, c=
ode and logs to figure out exactly what is wrong, I suggest that you search=
Google for=0A"tomcat form based authentication example" and use one of the=
numerous ones there as a reference.=0A=0AThere is something bizarre in you=
r explanation and data however :=0A=0AYou say that the first part of the lo=
g is with Firefox, which works fine.=0AHowever, that part contains this lin=
e :=0A=0A> 69.207.4.57 - sor@sor.com [27/Mar/2011:15:34:30 -0700] "GET /Dyn=
acorn/catalog/dealer/dealerwelcome.jsp HTTP/1.1" 500 2158=0A=0Awhich shows =
a status code 500 (=3D "server error") returned by the server, while the pa=
rt supposedly not working shows no such error.=0A=0AAnother bizarre part is=
this : the JSP document that you show, appears to be the login page, and i=
t contains a <form> line like this :=0A=0A>=A0 =A0 =A0 =A0 <form method=3D=
"POST" action=3D"<%=3D response.encodeURL("j_security_check") %>">=0A=0AYet=
, looking at the log, it does not seem that there is ever a POST to that UR=
L.=0A=0AIt would look like there is some confusion about the basic way in w=
hich form authentication is supposed to work.=A0 That's also why your best =
bet may be to re-read the on-line documentation, and try first with one of =
the examples you will find in Google.=0A=0A=0ADick Eastlake wrote:=0A> User=
s can authenticate to the secured area of my Website using IE and Firefox; =
no problem.=A0 However,Macs, Google and Safari browsers cannot log in.=0A> =
=0A> Macs, Google and Safari browsers go straight to the form-error-page "n=
ot_auth.html".=0A> =0A> Please help!=0A> =0A> =0A> I'm using a simple form-=
based authentication method.=0A> =0A> =0A> Here's my WEB.XML (from inside t=
he webapp, not the conf):=0A> =0A> <web-app xmlns=3D"http://java.sun.com/xm=
l/ns/j2ee"=0A>=A0 =A0 xmlns:xsi=3D"http://www.w3.org/2001/XMLSchema-instan=
ce"=0A>=A0 =A0 xsi:schemaLocation=3D"http://java.sun.com/xml/ns/j2ee=0A> h=
ttp://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"=0A>=A0 =A0 version=3D"2.4"=
>=0A> <display-name>Progressive Commerce Inc</display-name>=0A> =0A>
<descr=
iption>=0A>=A0 =A0 Progressive Website=0A> </description>=0A> =0A> <securi=
ty-constraint>=0A>=A0 =A0 <display-name>Progressive Security=0A>=A0 Constr=
aint</display-name>=0A>=A0 =A0 <web-resource-collection>=0A>=A0 =A0 =A0
=
=A0 <web-resource-name>Dealer Area</web-resource-name>=0A>=A0 =A0 =A0 =A0
=
<url-pattern>/catalog/dealer/*</url-pattern>=0A>=A0 =A0 </web-resource-co=
llection>=0A>=A0 =A0 <auth-constraint>=0A>=A0 =A0 =A0 =A0 <role-name>deal=
er</role-name>=0A>=A0 =A0 </auth-constraint>=0A> </security-constraint>=0A=
> <security-role>=0A>=A0 =A0 <role-name>dealer</role-name>=0A>
</security-=
role>=0A> =0A> <security-constraint>=0A>=A0 =A0 <display-name>Joe
Parts Se=
curity Constraint</display-name>=0A>=A0 =A0 <web-resource-collection>=0A>=
=A0 =A0 =A0 =A0 <web-resource-name>Joe Parts=0A>=A0 Area</web-resource-nam=
e>=0A>=A0 =A0 =A0 =A0 <url-pattern>/joeparts/admin/*</url-pattern>=0A>=A0
=
=A0 </web-resource-collection>=0A>=A0 =A0 <auth-constraint>=0A>=A0 =A0
=
=A0 =A0 <role-name>joe</role-name>=0A>=A0 =A0 </auth-constraint>=0A>
</se=
curity-constraint>=0A> =0A> <security-role>=0A>=A0 =A0 <role-name>joe</rol=
e-name>=0A> </security-role>=0A>=A0 <login-config>=0A>=A0 =A0 <auth-method=
>FORM</auth-method>=0A>=A0 =A0 <realm-name>Progressive Form-Based Authenti=
cation Area</realm-name>=0A>=A0 =A0 <form-login-config>=0A>=A0 =A0 =A0
=A0=
<form-login-page>/catalog/dealer_door.jsp</form-login-page>=0A>=A0 =A0 =
=A0 =A0 <form-error-page>/not_auth.html</form-error-page>=0A>=A0 =A0 </fo=
rm-login-config>=0A> </login-config>=0A> =0A> =0A> <resource-ref>=0A>=A0
=
=A0 =A0 <description>=0A>=A0 =A0 =A0 =A0 jdbc/progressive=0A>=A0 =A0 =A0 =
</description>=0A>=A0 =A0 =A0 <res-ref-name>=0A>=A0 =A0 =A0 =A0 jdbc/pro=
gressive=0A>=A0 =A0 =A0 </res-ref-name>=0A>=A0 =A0 =A0 <res-type>=0A>=A0
=
=A0 =A0 =A0 javax.sql.DataSource=0A>=A0 =A0 =A0 </res-type>=0A>=A0 =A0 =
=A0 <res-auth>=0A>=A0 =A0 =A0 =A0 Container=0A>=A0 =A0 =A0 </res-auth>=
=0A>=A0 =A0 =A0 <res-sharing-scope>=0A>=A0 =A0 =A0 =A0 Shareable=0A>=A0 =
=A0 =A0 </res-sharing-scope>=0A> </resource-ref>=0A> =0A> <welcome-file-li=
st>=0A>=A0 =A0 <welcome-file>index.html</welcome-file>=0A> </welcome-file-=
list>=0A>=A0 =A0 </web-app>=0A> =0A> Here's the code from my jsp=0A>
=0A>=
=A0 =A0 =A0 <jsp:useBean id=3D"dlb" scope=3D"session" class=3D"com.dealer.b=
eans.DealerBean"/>=0A> =0A>=A0 =A0 <body bgcolor=3D"#222324" text=3D"#0000=
00">=0A>=A0 =A0 =A0 =A0 <form method=3D"POST" action=3D"<%=3D response.enc=
odeURL("j_security_check") %>">=0A>=A0 =A0 =A0 =A0 =A0 =A0 <p> </p>=
=0A>=A0 =A0 =A0 =A0 =A0 =A0 <div align=3D"center"> </div>=0A>=A0 =A0 =A0
=
=A0 =A0 =A0 <table width=3D"431" border=3D"0" cellspacing=3D"0" cellpaddin=
g=3D"0">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 <tr bgcolor=3D"#FFFFFF"=0A>=A0 =A0=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 <td>=0A> =0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
</td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td>=0A>=A0 =A0 =A0 =A0 =A0 =A0
=
=A0 =A0 =A0 =A0 <table>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <tr>=
=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td width=3D"160"><fon=
t color=3D"009999"><b><font face=3D"Arial, Helvetica, sans-serif">Email=A0
=
=A0 Address:</font></b></font></td>=0A>=A0 =A0 =A0 =A0 =A0 =A0
=A0 =A0 =A0 =
=A0 =A0 =A0 <td width=3D"147">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0 =A0 =A0 <input tabindex=3D"1" type=3D"text" name=3D"j_username=
" value=3D"=0A> <%=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 out.print(dlb.ge=
tEmail() + "\"");=0A> %>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 >=A0 =A0 =
=A0 </td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td width=3D"=
49"> </td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 </tr>=0A>=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <tr bgcolor=3D"#FFFFFF">=A0 =
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=
<td width=3D"160" height=3D"20"><font color=3D"009999"><b><font face=3D"Ar=
ial,=0A>=A0 Helvetica, sans-serif">Password:</font></b></font></td>=0A>=A0
=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td width=3D"147" height=3D"20=
">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <input tabindex=
=3D"2" type=3D"password" name=3D"j_password">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0 =A0 =A0 =A0 </td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 </tr>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <tr bgcolor=3D"#=
FFFFFF">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td width=3D"3=
7"> </td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td
widt=
h=3D"38"> </td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <t=
d width=3D"160"></td>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <=
td width=3D"147">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 <div align=3D"center">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0 =A0 =A0 =A0 <input tabindex=3D"3" type=3D"submit" value=3D"Log=
In">=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 </div=
>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 </td>=0A>=A0 =A0 =A0
=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 <td width=3D"49"> </td>=0A>=A0
=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 </tr>=0A>=A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 </table>=0A>=A0 =A0 =A0 =A0 =A0 =A0 </table>=0A>=A0 =A0 =A0 =A0
=
</form>=0A>=A0 =A0 </body>=0A> =0A> Here's the access log=A0 the entries
a=
t 15;34 are using Firefox,=A0 the ones at 15:42 are Google's browser=0A> =
=0A> =0A> 69.207.4.57 - - [27/Mar/2011:15:34:16 -0700] "GET /Dynacorn/catal=
og/dealerwelcome.jsp HTTP/1.1" 200 1870=0A> 69.207.4.57 - - [27/Mar/2011:15=
:34:27 -0700] "POST /Dynacorn/catalog/authControl.jsp HTTP/1.1" 302 -=0A> 6=
9.207.4.57 - - [27/Mar/2011:15:34:27 -0700] "GET /Dynacorn/catalog/dealer/d=
ealerwelcome.jsp=0A>=A0 HTTP/1.1" 200 1893=0A> 69.207.4.57 - - [27/Mar/2011=
:15:34:30 -0700] "POST /Dynacorn/catalog/dealer/j_security_check HTTP/1.1" =
302 -=0A> 69.207.4.57 - sor@sor.com [27/Mar/2011:15:34:30 -0700] "GET /Dyna=
corn/catalog/dealer/dealerwelcome.jsp HTTP/1.1" 500 2158=0A> 69.207.4.57 - =
- [27/Mar/2011:15:42:14 -0700] "GET /Dynacorn/catalog/dealerwelcome.jsp HTT=
P/1.1" 200 1870=0A> 69.207.4.57 - - [27/Mar/2011:15:42:20 -0700] "POST /Dyn=
acorn/catalog/authControl.jsp HTTP/1.1" 302 -=0A> 69.207.4.57 - - [27/Mar/2=
011:15:42:20 -0700] "GET /Dynacorn/catalog/dealer/dealerwelcome.jsp HTTP/1.=
1" 200 1893=0A> 69.207.4.57 - - [27/Mar/2011:15:42:23 -0700] "POST /Dynacor=
n/catalog/dealer/j_security_check HTTP/1.1" 200 676=0A> there are no more e=
ntries=0A> =0A> =0A> Again, IE & Firefox work fine, Mac, Google and Safari =
don't.=0A> =0A> Thanks for your help,=0A> Dick=0A=0A=0A--------------------=
-------------------------------------------------=0ATo unsubscribe, e-mail:=
users-unsubscribe@tomcat.apache.org=0AFor additional commands, e-mail: use=
rs-help@tomcat.apache.org
|