基于JAAS的角色验证与角色导向重定向问题求助

Let's work through your JAAS form authentication problems step by step—most of them boil down to small config/code mismatches and missing role-based navigation logic. Here's how to fix each issue:

Issue 1: No redirect to /index.xhtml?fail=true when entering invalid credentials #

What's causing this? #

This usually happens if your login form doesn't use the standard JAAS parameter names (j_username/j_password) or if JSF's built-in form handling is interfering with Wildfly's authentication redirect. The container relies on exact parameter names to trigger the error page redirect.

How to fix it: #

1. Use the correct form structure—either a plain HTML form, or a JSF form with prependId="false" (to avoid JSF adding a prefix to parameter names):

   <!-- Plain HTML form (recommended for login) -->
   <form action="#{request.contextPath}/j_security_check" method="POST">
       <label>Username:</label>
       <input type="text" name="j_username" required />
       <label>Password:</label>
       <input type="password" name="j_password" required />
       <button type="submit">Login</button>
   </form>
   
   <!-- Or JSF form (if you need JSF features) -->
   <h:form action="#{request.contextPath}/j_security_check" method="POST" prependId="false">
       <h:inputText name="j_username" required="true" />
       <h:inputSecret name="j_password" required="true" />
       <h:commandButton value="Login" type="submit" />
   </h:form>
   

2. Verify your web.xml form-error-page is correctly mapped (your current config looks good, but make sure /index.xhtml can display an error message when fail=true is present—e.g., <h:outputText value="Invalid credentials!" rendered="#{param.fail eq 'true'}" />).

Issue 2: Stuck on j_security_check with invalid credentials error (even with valid login) #

Critical Bug Found! #

Looking at your JAASLoginModule.commit() method, there's a typo in the role name that's breaking authentication:

// Your code (wrong role name)
List<String> roles = Arrays.asList( new String[] {"ADMIN","HR","ACCOUNT","BASIC"});

Your web.xml defines the accounting role as ACCOUNTS (with an 'S'), but you're adding ACCOUNT (missing the 'S') as a role principal. Wildfly checks that authenticated roles exactly match those in your security constraints—this mismatch means the container thinks the user doesn't have permission to access /user/*, so it rejects the login.

Fixes: #

1. Correct the role name in commit():

   List<String> roles = Arrays.asList( new String[] {"ADMIN","HR","ACCOUNTS","BASIC"});
   

2. Ensure your JAASRolePrincipal class correctly implements java.security.Principal—its getName() method must return the exact role name (e.g., "ADMIN", "ACCOUNTS"). Wildfly uses this to map roles to your web.xml security rules.
3. Double-check your isValidUser() method is correctly validating credentials against MySQL (confirm it returns true for valid username/password pairs).

Issue 3: Role-based redirect after successful authentication #

What you need: #

Standard JAAS redirects to the originally requested resource, but you need custom logic to send users to role-specific pages (especially since users can have multiple roles). Here are two reliable approaches:

Option 1: JSF Welcome Page with Role Checks

1. Set a welcome page in web.xml that acts as a post-login landing spot:

   <welcome-file-list>
       <welcome-file>/user/PostLoginRedirect.xhtml</welcome-file>
   </welcome-file-list>
   

2. Create PostLoginRedirect.xhtml with a pre-render event to handle navigation:

   <f:metadata>
       <f:event type="preRenderView" listener="#{postLoginRedirectBean.redirectToRolePage}" />
   </f:metadata>
   

3. Implement the managed bean to check roles and redirect (adjust priority as needed for multi-role users):

   @ManagedBean
   @RequestScoped
   public class PostLoginRedirectBean {
       public void redirectToRolePage() throws IOException {
           ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
           
           // Check roles in order of priority (e.g., ADMIN gets redirected first)
           if (ec.isUserInRole("ADMIN")) {
               ec.redirect(ec.getRequestContextPath() + "/user/AdminDashboard.xhtml");
           } else if (ec.isUserInRole("HR")) {
               ec.redirect(ec.getRequestContextPath() + "/user/HRManagement.xhtml");
           } else if (ec.isUserInRole("ACCOUNTS")) {
               ec.redirect(ec.getRequestContextPath() + "/user/AccountingDashboard.xhtml");
           } else if (ec.isUserInRole("BASIC")) {
               ec.redirect(ec.getRequestContextPath() + "/user/ChangePassword.xhtml");
           } else {
               // Fallback for unrecognized roles
               ec.redirect(ec.getRequestContextPath() + "/index.xhtml?fail=true");
           }
       }
   }
   

Option 2: Servlet Filter for Role-Based Redirects

If you prefer a non-JSF approach, use a filter that runs after authentication:

@WebFilter("/user/*")
public class RoleRedirectFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;
        
        // Only redirect on the first request after login (check for new session)
        if (req.getSession().isNew() && req.getUserPrincipal() != null) {
            if (req.isUserInRole("ADMIN")) {
                res.sendRedirect(req.getContextPath() + "/user/AdminDashboard.xhtml");
                return;
            }
            // Add other role checks here...
            else if (req.isUserInRole("BASIC")) {
                res.sendRedirect(req.getContextPath() + "/user/ChangePassword.xhtml");
            }
        }
        chain.doFilter(request, response);
    }

    // Implement init() and destroy() with empty bodies
    @Override public void init(FilterConfig filterConfig) throws ServletException {}
    @Override public void destroy() {}
}

Final Checks #

• Confirm jboss-web.xml is in WEB-INF and references the exact security domain name from standalone.xml (custom-authentication-security).
• Ensure your JAASLoginModule properly adds both user and role principals to the Subject—Wildfly needs these to establish the security context.
• Disable any JSF navigation rules that might interfere with Wildfly's authentication redirect (e.g., rules targeting /j_security_check).

内容的提问来源于stack exchange，提问作者Namit Khandelwal