title: FORM based login not redirecting to stored request
body: <p>Migrating from JBoss EAP 5.2.0 to JBoss EAP 6.1.0. The user is correctly directed to the login.jsp page, but after successful authentication via j_security_check, the redirect to the originally requested Main.jsp page does not happen, the user is stuck on login.jsp.</p>
  
  <p>The logs look like Main.jsp is initially saved as the request but since its redirected to login.jsp, login.jsp is saved over Main.jsp as the new request.</p>
  
  <p>Comparing with a working deployment from JBoss EAP 5.2.0, I noticed the working log contains:</p>
  
  <p>[org.apache.catalina.connector.CoyoteAdapter] (http-0.0.0.0-8443-1:)  Requested cookie session id is ...
  [org.apache.catalina.authenticator.AuthenticatorBase] (http-0.0.0.0-8443-1:) Security checking request GET /myApp/</p>
  
  <p>Here is the JBoss EAP 6.1.0 server output:</p>
  
  <pre><code>Security checking request GET /myApp/
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /Main.jsp --&gt; false
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /Main.jsp --&gt; true
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /Main.jsp --&gt; false
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /Main.jsp --&gt; true
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling hasUserDataPermission()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   User data constraint already satisfied
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling authenticate()
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Save request in session 'Db-s0UWZpAj9Z0g1QBRcDkhe'
  [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/myApp].[jsp]] (http-localhost/127.0.0.1:8443-1)  Disabling the response for futher output
  [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/myApp].[jsp]] (http-localhost/127.0.0.1:8443-1)  The Response is vehiculed using a wrapper: org.apache.catalina.connector.Response
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Failed authenticate() test
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Security checking request GET /myApp/login.jsp
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /login.jsp --&gt; false
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /login.jsp --&gt; true
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /login.jsp --&gt; false
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /login.jsp --&gt; true
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling hasUserDataPermission()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   User data constraint already satisfied
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling authenticate()
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Save request in session 'Db-s0UWZpAj9Z0g1QBRcDkhe'
  [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/myApp].[jsp]] (http-localhost/127.0.0.1:8443-1)  Disabling the response for futher output
  [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/myApp].[jsp]] (http-localhost/127.0.0.1:8443-1)  The Response is vehiculed using a wrapper: org.apache.catalina.connector.Response
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Failed authenticate() test
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Security checking request GET /myApp/images/com_logo.jpg
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /images/com_logo.jpg --&gt; true
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /images/com_logo.jpg --&gt; true
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling hasUserDataPermission()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   User data constraint has no restrictions
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling accessControl()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking roles null
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1) Passing all access
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Successfully passed all security constraints
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Security checking request POST /myApp/j_security_check
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Authenticating username 'admin'
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Authentication of 'admin' was successful
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Redirecting to original '/myApp/login.jsp?accept=true'
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Failed authenticate() test ??/myApp/j_security_check
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Security checking request GET /myApp/login.jsp
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /login.jsp --&gt; false
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /login.jsp --&gt; true
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /login.jsp --&gt; false
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /login.jsp --&gt; true
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling hasUserDataPermission()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   User data constraint already satisfied
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling authenticate()
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Restore request from session 'Db-s0UWZpAj9Z0g1QBRcDkhe'
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Authenticated 'admin' with type 'FORM'
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Proceed to restored request
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling accessControl()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking roles GenericPrincipal[admin(HttpInvoker,AppRole,)]
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1) JBWEB000017: User [admin] has role [AppRole]
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1) Role found:  AppRole
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Successfully passed all security constraints
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1) Security checking request GET /myApp/images/com_logo.jpg
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[sc]' against GET /images/com_logo.jpg --&gt; true
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking constraint 'SecurityConstraint[all]' against GET /images/com_logo.jpg --&gt; true
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling hasUserDataPermission()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   User data constraint has no restrictions
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Calling accessControl()
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1)   Checking roles GenericPrincipal[admin(HttpInvoker,AppRole,)]
  [org.apache.catalina.realm] (http-localhost/127.0.0.1:8443-1) Passing all access
  [org.apache.catalina.authenticator] (http-localhost/127.0.0.1:8443-1)  Successfully passed all security constraints
  </code></pre>
  
  <p>web.xml:</p>
  
  <pre><code>  &lt;security-constraint&gt;
      &lt;display-name&gt;un-protected&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;sc&lt;/web-resource-name&gt;
        &lt;description&gt;My Resources&lt;/description&gt;
        &lt;url-pattern&gt;/login-redirect.html&lt;/url-pattern&gt;
        &lt;url-pattern&gt;/images/app_logo.jpg&lt;/url-pattern&gt;
        &lt;http-method&gt;GET&lt;/http-method&gt;
        &lt;http-method&gt;POST&lt;/http-method&gt;
        &lt;http-method&gt;HEAD&lt;/http-method&gt;
        &lt;http-method&gt;PUT&lt;/http-method&gt;
        &lt;http-method&gt;OPTIONS&lt;/http-method&gt;
        &lt;http-method&gt;TRACE&lt;/http-method&gt;
        &lt;http-method&gt;DELETE&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
    &lt;/security-constraint&gt;
    &lt;security-constraint&gt;
      &lt;display-name&gt;protected&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;all&lt;/web-resource-name&gt;
        &lt;description&gt;all&lt;/description&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
        &lt;http-method&gt;GET&lt;/http-method&gt;
        &lt;http-method&gt;POST&lt;/http-method&gt;
        &lt;http-method&gt;HEAD&lt;/http-method&gt;
        &lt;http-method&gt;PUT&lt;/http-method&gt;
        &lt;http-method&gt;OPTIONS&lt;/http-method&gt;
        &lt;http-method&gt;TRACE&lt;/http-method&gt;
        &lt;http-method&gt;DELETE&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;description&gt;Users authorized to use MyApp.&lt;/description&gt;
        &lt;role-name&gt;MyRole&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
      &lt;user-data-constraint&gt;
        &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
    &lt;/security-constraint&gt;
    &lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;My Realm&lt;/realm-name&gt;
      &lt;form-login-config&gt;
        &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
        &lt;form-error-page&gt;/login.jsp?loginFailed=true&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
    &lt;/login-config&gt;
    &lt;security-role&gt;
      &lt;role-name&gt;MyRole&lt;/role-name&gt;
    &lt;/security-role&gt;
  </code></pre>
  
  <p>I also noticed the following on the server log:</p>
  
  <pre><code>DEBUG [org.jboss.security] (http-localhost/127.0.0.1:8443-1) PBOX000287: Failed to open properties file from URL: java.net.MalformedURLException: no protocol: /opt/web/jboss/jboss-eap-6.2/standalone/configuration/my-app-users.properties
  </code></pre>
  
  <p>I was able to get it to redirect, but not quite sure why it works differently between JBoss 5 and 6 EAP. My login initially prompts the user with a notification form, that the user must accept to go to the login form (both contained in login.jsp). The notification form contains:</p>
  
  <pre><code>&lt;form action="login.jsp"&gt;
      &lt;input type="hidden" name="accept" value="true"/&gt;
      &lt;div align="center"&gt;&lt;input type="submit" value="Accept"&gt;&lt;/div&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>Changing the action to "/[my_apps_base_url>]/" gets it working.</p>