Basic Authentication in Glassfish

I am having trouble getting BASIC authentication to work with Glassfish. I am developing an application and I need to be prompted for a username and password. I have gotten the application to prompt me for a password when I attempt to access the application, but after entering the correct login information, I get HTTP Status 403 - Access to the requested resource has been denied.

I have gone into the Glassfish Admin Console and created a few sample users in the file realm and enabled the Security Manager.

Next, in my web.xml file, I have added the following:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Secure Application</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>User</role-name>
    </auth-constraint>
</security-constraint>

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>file</realm-name>
</login-config>开发者_如何学Go

<security-role>
    <role-name>User</role-name>
</security-role>

I'm not exactly sure what to do next. I have searched for several hours with no luck. The authentication works because if I enter incorrect login information, it prompts again, but after successfully authenticating, I get the access denied message shown above.

If it helps, I am running Glassfish Open Source 3.0.1 and using Netbeans 6.9 for development.

---

I'm not sure if defaults apply but you may need to create sun-web.xml and set a mapping for role "User":

<sun-web-app error-url="">
  ... 
  <security-role-mapping>
    <role-name>User</role-name>
    <group-name>filerealm-group-name</group-name>
  </security-role-mapping>
  ...
</sun-web-app>

---

Seems the Glassfish documentation at http://download.oracle.com/javaee/6/tutorial/doc/bnbxj.html is incorrect.

If the role names used in an application are not the same as the group names defined on the server, use the runtime deployment descriptor to specify the mapping. The following example demonstrates how to do this mapping in the glassfish-web.xml file, which is the file used for web applications

In which case you need to create a WEB-INF/glassfish-web-app.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
<glassfish-web-app>
    <security-role-mapping>
        <role-name>User</role-name>
        <group-name>User</group-name>
    </security-role-mapping>
</glassfish-web-app>