web.xml存在问题

Question

首先，我想为我糟糕的英语道歉。好的，我有个问题。我正在构建一个使用jdbcrealm和web.xml进行安全保护的应用程序。登录是通过web表单完成的。应用程序运行在ApacheTomcat7上，我使用的是Primefaces4.0。在web.xml中，我定义了一些角色和一些安全约束。当我登录到应用程序httpservlet request.login(用户名，密码)做得很好，request.isUserInrole("role")也做得好时，Faces.getExternalContext.redirect将页面重定向到应用了安全约束的正确文件夹，在浏览器中我看到了正确的URL。。。。。但是页面是空白的！！！如果我检查页面来源，我会看到登录页面的页面来源。。。。。我会在下面放一些屏幕截图。请帮帮我…我正在努力解决这个问题两个星期了！

/*

*/这是web.xml

<param-name>primefaces.THEME</param-name>
<param-value>afterdark</param-value>
</context-param>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping> 
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.xhtml</url-pattern>
</servlet-mapping>
<security-role>
<description>Administrator A</description>
<role-name>1</role-name>
</security-role>
<security-constraint>
<display-name>Administrator A</display-name>
<web-resource-collection>
<web-resource-name>Administratorske datoteke</web-resource-name>
<description/>
<url-pattern>/a1/*</url-pattern> --> 
<http-method>GET</http-method>
<http-method>POST</http-method>        
</web-resource-collection>
<auth-constraint>
<description>Administrator A</description>
<role-name>1</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>FORM</auth-method>
<realm-name>JDBCRealm</realm-name>
<form-login-config>
<form-login-page>/prijava.xhtml</form-login-page>
<form-error-page>/pogreska.xhtml</form-error-page>
</form-login-config>
</login-config>
<session-config>
<session-timeout>
30
</session-timeout>
</session-config>
<welcome-file-list>
<welcome-file>prijava.xhtml</welcome-file>
</welcome-file-list>

*这是登录页面(prijava.xhtml)*

<div class="slika_za_prijavu">
<h:outputLink id="loginLink" value="javascript:void(0)" onclick="PF('prozor_za_unos').show()" title="prijava">   
<p:graphicImage value="/slike/prijava.png" /> 
</h:outputLink>
</div>           
<p:growl id="growl" showDetail="true" life="3000" />  
<p:dialog id="prozor_za_prijavu" header="Prijava" widgetVar="prozor_za_unos" resizable="false">  
<h:panelGrid columns="2" cellpadding="5">  
<h:outputLabel for="k_ime" value="Korisničko ime:" />  
<p:inputText value="#{provjera_prijave.k_ime}"   
id="k_ime" required="true" label="korisnicko_ime"   
requiredMessage="Potrebno je upisati korisničko ime!"/>
<h:outputLabel for="zaporka" value="Zaporka:" />  
<h:inputSecret value="#{provjera_prijave.zaporka}"   
id="zaporka" required="true" label="zaporka"
requiredMessage="Potrebno je upisati zaporku!"/>
<f:facet name="footer">  
<p:commandButton id="gumb_za_prijavu" value="Prijavi se" update="growl"   
actionListener="#{provjera_prijave.prijava(actionEvent)}"   
oncomplete="obrada_zahtjeva_za_prijavu(xhr, status, args)"/>  
</f:facet>  
</h:panelGrid>  
</p:dialog>  
</h:form>

这是登录控制器(provjera_prihave)

public void prijava(ActionEvent ActionEvent)抛出IOException｛

FacesMessage poruka = null;
FacesContext fc = FacesContext.getCurrentInstance();
HttpServletRequest zahtjev = (HttpServletRequest) fc.getExternalContext().getRequest();
try {
String pocetna_stranica;            
zahtjev.login(k_ime, zaporka);
HttpSession sesija = zahtjev.getSession();
if (!sesija.isNew()) {
sesija.invalidate();
sesija = zahtjev.getSession();                                
}
if (zahtjev.isUserInRole("1")) {
sesija.setAttribute("trenutni_korisnik",k_ime);
pocetna_stranica = "/a1/pocetna_a1.xhtml";
poruka = new FacesMessage(FacesMessage.SEVERITY_INFO, "Dobro došao", k_ime);
try {
fc.getExternalContext().getFlash().setKeepMessages(true);
fc.getExternalContext().redirect(zahtjev.getContextPath()+pocetna_stranica);
}
catch (IOException ex) {
fc.addMessage(null, new FacesMessage("UPOZORENJE!", "Pogreška u izvođenju programa. Nije moguće preusmjeriti stranicu."));
}
} 
else if (zahtjev.isUserInRole("2")) {

当角色为"1"的用户登录时，这是我浏览器中的url。在此之前，localhost和端口…ERMP是应用程序的克星

"ERMP/a1/pocetna_a1.xhtml">

这是一个空白页面，带有登录页面的页面来源

我希望这个问题可以理解。在web.xml中对web资源进行注释时，一切正常请帮忙！！谢谢

Answer 1

当你想使用tomcat的内置(Realm)身份验证和授权时，有几件事你应该注意。

首先，你的登录表单需要是这样的：

<form action="j_security_check" method="post">
<input type="text" name="j_username" placeholder="Login"/>
<input type="password" name="j_password" placeholder="Password"/>
<input type="submit" value="Sign In" />
</form>

可以使用素数面组件来保留布局。在这种情况下，您将需要执行一些"java脚本"，以便定义JSFh:form组件rednered表单的操作。。。。

<script>
jQuery("#form").submit(function() {
jQuery(this).attr("action", "j_security_check");
jQuery(loginVar.jqId).attr("name", "j_username");
....
});
</script>

第二个细节是，您不需要担心登录控制器中描述的登录部分。一旦将j_username和j_password发送到j_security_check，一切都会正常运行。