1

I'm porting a legacy application from JBoss 4.2.3 to JBoss 7 (the web profile version). They used a custom login module and used a valve to capture the login failure reason into j_exception. They did this by putting context.xml into the web-inf directory of the war, with the following contents:

<!-- Add the ExtendedFormAuthenticator to get access to the username/password/exception ->
<Context cookies="true" crossContext="true">
<Valve className="org.jboss.web.tomcat.security.ExtendedFormAuthenticator"
       includePassword="true" ></Valve>
</Context>

The login is working for me, but not that valve. When there's a login exception, the j_exception is still empty and the logic that depends on analyzing why the login was rejected fails. According to this link: http://community.jboss.org/wiki/ExtendedFormAuthenticator, everything looks right. However that link is very old, and it's possible things have changed since then. What's the new way?

1 Answer 1

0

It seems that security valves are now defined directly in jboss-web.xml, like this:

<jboss-web>
<security-domain>mydomain</security-domain>   
<valve>
       <class-name>org.jboss.web.tomcat.security.ExtendedFormAuthenticator</class-name>
       <param>
           <param-name>includePassword</param-name>
           <param-value>true</param-value>
       </param>
    </valve>
</jboss-web>

However, the ExtendedFormAuthenticator class wasn't ported to JBoss 7.0.1. A ticket has been opened for me, so it should be present in JBoss 7.1.0: https://issues.jboss.org/browse/AS7-1963

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.