Tomcat 7 container managed security and SSL dont work together + jsf 2.1

Question

I'm using JDBCRealm for Tomcat 7 user auth and SSL for https but I can not figure out how to combine them. My goal is to make all the page secure by SSL and possible to view only by a certain role. I'm using JSF 2.1. Here is my code in web.xml

<security-role>
    <description/>
    <role-name>employee</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>administrator</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>boss</role-name>
</security-role>

<security-constraint>
    <display-name>ConstraintPrac</display-name>
    <web-resource-collection>
        <web-resource-name>panelprac</web-resource-name>
        <url-pattern>panele/pracownik/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>employee</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

They seem to work separately but what i need is a combined way. Now Tomcat is not redirecting to the port 8443 (https) and You can access any page just by typing it in the browser. I used this page for SSL http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html and this one for JDBCRealm http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html. I want my program to allow access certain pages only to certain roles and at the same time do everything on HTTPS. Please help me with this one. I don't know where I've made the mistake. I don't receive any errors.

RESOLVED

The problem was deeper than I thought. Tomcat 7 doesn't support custom form user authentication therefore security roles presented above didn't work. To solve this I had to create a Filter class to protect unauthorized entry's to pages.

I will leave this topic in case someone has the same problem (if the admin finds this topic irrelevant feel free to delete it)

Tomcat 7 doesn't support custom form user authentication? This can't be the case. The problem must be in the way how you login the user. This is in custom form based authentication supposed to take place by `j_security_check` or `HttpServletRequest#login()`. See also http://stackoverflow.com/questions/2206911/best-way-for-user-authentication-on-javaee-6-using-jsf-2-0/2207147#2207147 — BalusC, Dec 15 '11 at 14:37
I used the code that You have posted in update 2 (HttpServletRequest#login()). Logging worked fine but You could still type the adress of the site and see it. Im using JDBCRealm. — Rafał Rowiński, Dec 15 '11 at 14:54

Tomcat 7 container managed security and SSL dont work together + jsf 2.1

0 Answers0