Java EE declarative security, Cannot load group for JDBC realm user

Question

It is my first post here. I would have two questions with regard to declarative Java EE security: (1) file-based authentication and (2) DB-based authentication. I enclosed t

Answer 1

From the first glance I would spot on your table column names.

From my own experience I memorized that the user column in the user table needs to have exactly the same name as the user column in the USER_GROUPS table. The matching is done by column names.

So your USER_GROUPS table needs a column USERNAME that matches the user names from the TBLUSERS table.

Note that you have to change your table relations for this.

There can be a dozen of other reasons but you can give it a try.

This is my local configuration:

CREATE TABLE `user` (
  `LOGIN` varchar(32) NOT NULL,
  `password` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`LOGIN`)
)

CREATE TABLE `group` (
  `IDGROUP` int(11) NOT NULL AUTO_INCREMENT,
  `name` varchar(45) DEFAULT NULL,
  PRIMARY KEY (`IDGROUP`)
)

CREATE TABLE `group_has_user` (
  `IDGROUP` int(11) NOT NULL,
  `LOGIN` varchar(32) NOT NULL,
  PRIMARY KEY (`IDGROUP`,`LOGIN`),
  KEY `fk_group_has_user_user1` (`LOGIN`),
  CONSTRAINT `fk_group_has_user_user1` FOREIGN KEY (`LOGIN`) 
     REFERENCES `user` (`LOGIN`) 
     ON DELETE NO ACTION ON UPDATE NO ACTION,
  CONSTRAINT `fk_group_has_user_group1` FOREIGN KEY (`IDGROUP`) 
     REFERENCES `group` (`IDGROUP`) 
     ON DELETE NO ACTION ON UPDATE NO ACTION
)

with the following settings in GF admin console:

Here is my security-role mapping from sun-web.xml (now glassfish-web.xml):

<security-role-mapping>
    <role-name>user</role-name>
    <group-name>1</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>sponsor</role-name>
    <group-name>2</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>admin</role-name>
  <group-name>3</group-name>
</security-role-mapping>

And I have defined the following security-roles in web.xml directly below login-config:

<security-role>
   <description/>
   <role-name>user</role-name>
</security-role>
<security-role>
   <description/>
   <role-name>sponsor</role-name>
</security-role>
<security-role>
   <description/>
   <role-name>admin</role-name>
</security-role>