j_security_check in login.jsp

[Wessel, Keith]

Got it. So, if I'm not using container-based auth, this doesn't even matter and, as long as I have a good 404 page, I can just leave that line in login.jsp and let it fail with no harm or risk.

Thanks,
Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, September 11, 2013 4:22 PM
To: Shib Users
Subject: Re: j_security_check in login.jsp

On 9/11/13 5:12 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>I see a lot of discussion of j_security_check in the list archives, but 
>no simple explanation. I've fixed a bug in our login.jsp that was 
>causing it to just throw an exception every time someone hits login.jsp 
>directory (which they shouldn't' be doing in the first place, of 
>course). Now, the portion of login.jsp where actionURL isn't included 
>as a request parameter is getting triggered. It's trying to pass 
>requests to j_security_check which I don't have configured in our 
>web.xml as a valid URL pattern, and thus our 404 page is being triggered.

If you can special case them to a page dealing with the bookmark issue, that's really all you can do. Nothing you do will make direct access work.

>If I understand correctly, j_security_check would just allow me to do 
>container-based authentication to the IDP. I personally see now value 
>in this, but I'd like to know if someone could hel me understand since 
>there must be some point.

No, j_security_check is used when you do that, it doesn't enable it on its own and it will not do anything but throw an error later if you were to somehow try and configure things so it didn't just fail.

>If there is a reason to do it, I don't' see what needs to be added to 
>web.xml to support j_security_check. I see lots out there in terms of 
>general implemention of j_security_check, but it's not specific to Shib.

Nothing will be, that's used by container managed security declared in web.xml, if you set the type to FORM instead of BASIC. It has nothing at all to do with Shibboleth configuration.

Accessing login.jsp directly will always fail. Container security works by forwarding you internally to that page and then back to the original request after posting to j_security_check.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net