j_security_check in login.jsp

[Cantor, Scott]

On 9/11/13 5:12 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>I see a lot of discussion of j_security_check in the list archives, but
>no simple explanation. I've fixed a bug in our login.jsp that was causing
>it to just throw an exception every time someone hits login.jsp directory
>(which they shouldn't' be doing in the first place, of course). Now, the
>portion of login.jsp where actionURL isn't included as a request
>parameter is getting triggered. It's trying to pass requests to
>j_security_check which I don't have configured in our web.xml as a valid
>URL pattern, and thus our 404 page is being triggered.

If you can special case them to a page dealing with the bookmark issue,
that's really all you can do. Nothing you do will make direct access work.

>If I understand correctly, j_security_check would just allow me to do
>container-based authentication to the IDP. I personally see now value in
>this, but I'd like to know if someone could hel me understand since there
>must be some point.

No, j_security_check is used when you do that, it doesn't enable it on its
own and it will not do anything but throw an error later if you were to
somehow try and configure things so it didn't just fail.

>If there is a reason to do it, I don't' see what needs to be added to
>web.xml to support j_security_check. I see lots out there in terms of
>general implemention of j_security_check, but it's not specific to Shib.

Nothing will be, that's used by container managed security declared in
web.xml, if you set the type to FORM instead of BASIC. It has nothing at
all to do with Shibboleth configuration.

Accessing login.jsp directly will always fail. Container security works by
forwarding you internally to that page and then back to the original
request after posting to j_security_check.

-- Scott