title: Glassfish 3 security - Form based authentication using a JDBC Realm
body: <p>I  want to understand form based security and JDBC realms with glassfishV3, so i decided to create a little app that just allows to sign in and out, i followed the instructions from this <a href="https://rads.stackoverflow.com/amzn/click/com/1847199380" rel="noreferrer" rel="nofollow noreferrer">book</a> to do so. </p>
  
  <p>I understand how the hold thing works, but something is wrong and i cant get it to work properly.</p>
  
  <p><strong>What i did first was create a little database with JPA annotations:</strong></p>
  
  <pre><code>@Entity
  @Table(name="USERS")
  public class User implements Serializable {
  
      private static final long serialVersionUID = -1244856316278032177L;
      @Id
      @GeneratedValue
      @Column(nullable = false)
      private Long id;
      @Column(nullable = false)
      private String email;
      @Column(nullable = false)
      private String password;
      @OneToMany(mappedBy = "user")
      private List&lt;Group&gt; groups;
      //GET &amp; SET METHODS...
  
  }
  </code></pre>
  
  <p><strong>Here the other table that holds the roles for each user</strong></p>
  
  <pre><code>@Entity
  @Table(name="GROUPS")
  public class Group implements Serializable {
  
      private static final long serialVersionUID = -7274308564659753174L;
      @Id
      @GeneratedValue
      @Column(nullable = false)
      private Long id;
      @Column(nullable = false)
      private String groupName;
      @ManyToOne
      @JoinColumn(name = "USERS_ID", nullable = false)
      private User user;
      //GET &amp; SET METHODS...
      }
  </code></pre>
  
  <p><strong>When the DB was ready i added some data manually</strong></p>
  
  <p><img src="https://i.stack.imgur.com/zHZqW.png" alt="enter image description here"></p>
  
  <p><strong>The next step was to configure a security realm.</strong></p>
  
  <p><img src="https://i.stack.imgur.com/dPgEY.png" alt="enter image description here"></p>
  
  <p><strong>Then added the security configuration to my web.xml file</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
      version="3.0"&gt;
  
      &lt;display-name&gt;CHAPTER x 12 Container Managed Authentication and
          Authorization&lt;/display-name&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.xhtml&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.xhtml&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;VISITOR PERMISIONS&lt;/web-resource-name&gt;           
              &lt;url-pattern&gt;/index.xhtml&lt;/url-pattern&gt;         
              &lt;url-pattern&gt;/visitorpanel.xhtml&lt;/url-pattern&gt;
              &lt;http-method&gt;GET&lt;/http-method&gt;
              &lt;http-method&gt;POST&lt;/http-method&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;visitors&lt;/role-name&gt;
              &lt;role-name&gt;users&lt;/role-name&gt;
              &lt;role-name&gt;administrators&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;USERS PERMISIONS&lt;/web-resource-name&gt;         
              &lt;url-pattern&gt;/userpanel.xhtml&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/index.xhtml&lt;/url-pattern&gt;         
              &lt;url-pattern&gt;/visitorpanel.xhtml&lt;/url-pattern&gt;
              &lt;http-method&gt;GET&lt;/http-method&gt;
              &lt;http-method&gt;POST&lt;/http-method&gt;         
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;           
              &lt;role-name&gt;users&lt;/role-name&gt;
              &lt;role-name&gt;administrators&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;ADMIN PERMISIONS&lt;/web-resource-name&gt;             
              &lt;url-pattern&gt;/adminpanel.xhtml&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/userpanel.xhtml&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/index.xhtml&lt;/url-pattern&gt;         
              &lt;url-pattern&gt;/visitorpanel.xhtml&lt;/url-pattern&gt;          
              &lt;http-method&gt;GET&lt;/http-method&gt;
              &lt;http-method&gt;POST&lt;/http-method&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;           
              &lt;role-name&gt;administrators&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;login-config&gt;
          &lt;auth-method&gt;FORM&lt;/auth-method&gt;
          &lt;realm-name&gt;DBRealm&lt;/realm-name&gt;
          &lt;form-login-config&gt;
              &lt;form-login-page&gt;/index.xhtml&lt;/form-login-page&gt;
              &lt;form-error-page&gt;/error.xhtml&lt;/form-error-page&gt;
          &lt;/form-login-config&gt;
      &lt;/login-config&gt;
  
      &lt;security-role&gt;
      &lt;role-name&gt;visitors&lt;/role-name&gt;
      &lt;/security-role&gt;
  
      &lt;security-role&gt;
      &lt;role-name&gt;users&lt;/role-name&gt;
      &lt;/security-role&gt;
  
      &lt;security-role&gt;
      &lt;role-name&gt;administrators&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>My objectives here were:</p>
  
  <ul>
  <li><p>administrators can see all pages</p></li>
  <li><p>visitors can see only index.xhtml and visitorpanel.xhtml</p></li>
  <li><p>users can see index.xhtml,visitorpanel.xhtml and userpanel.xhtml</p></li>
  </ul>
  
  <p>I think the configuration is correct.</p>
  
  <p><strong>Finally the last step was to create the login form in the index.xhtml page:</strong></p>
  
  <pre><code>&lt;form method="post" action="j_security_check" name="loginForm"&gt;
  
          &lt;h:outputLabel id="userNameLabel" for="j_username" value="Enter your em@il:"/&gt;
          &lt;h:inputText id="j_username" autocomplete="off" /&gt;
          &lt;br/&gt;
          &lt;h:outputLabel id="passwordLabel" for="j_password" value="Enter your em@il password:"/&gt;
          &lt;h:inputSecret id="j_password" autocomplete="off"/&gt;
          &lt;br/&gt;
          &lt;h:commandButton type="submit" value="Login"/&gt;
          &lt;h:commandButton type="reset" value="Clear"/&gt;
    &lt;/form&gt;
  </code></pre>
  
  <p>The program builds fine, but i have the following problems:</p>
  
  <p>1- When i try to login as user or as administrator(visitors don't need to login), i get redirected to the error.xhtml page and in the console i see an exception:</p>
  
  <blockquote>
    <p>SEVERE: SEC1112: Cannot validate user [admin@gmail.com] for JDBC
    realm. WARNING: Web login failed: Login failed:
    javax.security.auth.login.LoginException: Security Exception WARNING:
    PWC4011: Unable to set request character encoding to UTF-8 from
    context
    /CHAPTER_12_x_Container_Managed_Authentication_and_Authorization,
    because request parameters have already been read, or
    ServletRequest.getReader() has already been called</p>
  </blockquote>
  
  <p>2- When i try to navigate to some of the pages via the URL, nothing happens. I think that is ok, but when i try to visit visitorpanel.xhtml, it should let me, because there is no need to be logged in to see it. 
  Do i need to remove that page from the security configuration if a want every body to see it? </p>
  
  <p>3- Also i am curious why i cant use the tag h:form instead of just form, when i implement the login?</p>
  
  <p>Ill really appreciate some help, ive been a few hours reading the first chapters of the book and trying to implement, my own example but i got stuck. I think i am close to the solution.</p>
  
  <p><strong>Update</strong></p>
  
  <p>I changed the Default principal to be the visitors user name. But it still don't work</p>
  
  <p><img src="https://i.stack.imgur.com/he7kJ.png" alt="enter image description here"></p>
  
  <p>And i also added some more options to my Realm configuration</p>
  
  <p><img src="https://i.stack.imgur.com/m3BVk.png" alt="enter image description here"></p>
  
  <p>But when i try to login i still see an exception that says:</p>
  
  <blockquote>
    <p>SEVERE: SEC1112: Cannot validate user [admin@gmail.com] for JDBC
    realm. WARNING: Web login failed: Login failed:
    javax.security.auth.login.LoginException: Security Exception WARNING:
    PWC4011: Unable to set request character encoding to UTF-8 from
    context
    /CHAPTER_12_x_Container_Managed_Authentication_and_Authorization,
    because request parameters have already been read, or
    ServletRequest.getReader() has already been called</p>
  </blockquote>
  
  <p>I still don't know what is missing.</p>
  
  <p>-Could it be that the table name should not be upper case?</p>
  
  <p>-Could it be that the columns names should not be upper case?</p>
  
  <p>-Could it be that the tables are created wrong?</p>
  
  <p>-Could it be that i cant use PASSWORD as a column name, because it makes some kind of conflict?</p>
  
  <p>I really don't understand why that exception. I pinged the database from the admin panel, and all seem to be correct.</p>
  
  <p>Can someone help me figuring this one out? </p>
  
  <p><strong>Update 2</strong></p>
  
  <p>I changed the 'javax.enterprise.system.core.security' logging option to level FINE, to have more information when exceptions occur, this was the result when i tried to login:</p>
  
  <blockquote>
    <p>FINE: Intercept Entry: 
        intercept: SOAP
        defaultServerID: null
        defaultClientID:  null FINE: ID Entry: 
        module class: com.sun.xml.wss.provider.ClientSecurityAuthModule
        id: XWS_ClientProvider
        type: client
        request policy: javax.security.auth.message.MessagePolicy@e95a72
        response policy: javax.security.auth.message.MessagePolicy@310a6d
        options: {signature.key.alias=s1as, debug=false, dynamic.username.password=false, encryption.key.alias=s1as} FINE: ID
    Entry: 
        module class: com.sun.xml.wss.provider.ClientSecurityAuthModule
        id: ClientProvider
        type: client
        request policy: javax.security.auth.message.MessagePolicy@1829770
        response policy: javax.security.auth.message.MessagePolicy@a4461e
        options: {signature.key.alias=s1as, debug=false, dynamic.username.password=false, encryption.key.alias=s1as,
    security.config=C:\jeeAplicationServer\glassfishv3\glassfish\domains\domain1/config/wss-server-config-1.0.xml}
    FINE: ID Entry: 
        module class: com.sun.xml.wss.provider.ServerSecurityAuthModule
        id: XWS_ServerProvider
        type: server
        request policy: javax.security.auth.message.MessagePolicy@f79c86
        response policy: javax.security.auth.message.MessagePolicy@454bf7
        options: {signature.key.alias=s1as, debug=false, encryption.key.alias=s1as} FINE: ID Entry: 
        module class: com.sun.xml.wss.provider.ServerSecurityAuthModule
        id: ServerProvider
        type: server
        request policy: javax.security.auth.message.MessagePolicy@17e85e4
        response policy: javax.security.auth.message.MessagePolicy@1887906
        options: {signature.key.alias=s1as, debug=false, encryption.key.alias=s1as,
    security.config=C:\jeeAplicationServer\glassfishv3\glassfish\domains\domain1/config/wss-server-config-1.0.xml}
    FINE: [Web-Security] Setting Policy Context ID: old = null ctxID =
    CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
    FINE: [Web-Security] hasUserDataPermission perm:
    (javax.security.jacc.WebUserDataPermission /j_security_check POST)
    FINE: [Web-Security] hasUserDataPermission isGranted: true FINE:
    Logging in user [admin@gmail.com] into realm: DBRealm using JAAS
    module: jdbcRealm FINE: Login module initialized: class
    com.sun.enterprise.security.auth.login.JDBCLoginModule SEVERE:
    SEC1112: Cannot validate user [admin@gmail.com] for JDBC realm. FINE:
    Cannot validate user javax.security.auth.login.LoginException: Unable
    to connect to datasource jdbc/security for database user user.    at
    com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm.getConnection(JDBCRealm.java:550)
      at
    com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm.isUserValid(JDBCRealm.java:393)
      at
    com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm.authenticate(JDBCRealm.java:311)
      at
    com.sun.enterprise.security.auth.login.JDBCLoginModule.authenticate(JDBCLoginModule.java:72)
      at
    com.sun.enterprise.security.auth.login.PasswordLoginModule.authenticateUser(PasswordLoginModule.java:90)
      at
    com.sun.appserv.security.AppservPasswordLoginModule.login(AppservPasswordLoginModule.java:141)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  at
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)     at
    javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
      at
    javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
      at
    javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
      at java.security.AccessController.doPrivileged(Native Method)   at
    javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
      at
    javax.security.auth.login.LoginContext.login(LoginContext.java:579)
      at
    com.sun.enterprise.security.auth.login.LoginContextDriver.doPasswordLogin(LoginContextDriver.java:341)
      at
    com.sun.enterprise.security.auth.login.LoginContextDriver.login(LoginContextDriver.java:199)
      at
    com.sun.enterprise.security.auth.login.LoginContextDriver.login(LoginContextDriver.java:152)
      at
    com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:479)
      at
    com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:418)
      at
    org.apache.catalina.authenticator.FormAuthenticator.authenticate(FormAuthenticator.java:264)
      at
    org.apache.catalina.authenticator.AuthenticatorBase.processSecurityCheck(AuthenticatorBase.java:1015)
      at
    org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:614)
      at
    org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:615)
      at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:97)   at
    com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:85)
      at
    org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:185)
      at
    org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:325)
      at
    org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:226)
      at
    com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:165)
      at
    com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:791)
      at
    com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:693)
      at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:954)
      at
    com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:170)
      at
    com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:135)
      at
    com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:102)
      at
    com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:88)
      at
    com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
      at
    com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
      at
    com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
      at com.sun.grizzly.ContextTask.run(ContextTask.java:69)     at
    com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:330)
      at
    com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:309)
      at java.lang.Thread.run(Thread.java:662) Caused by:
    javax.naming.NamingException: Lookup failed for 'jdbc/security' in
    SerialContext  [Root exception is javax.naming.NameNotFoundException:
    security not found]   at
    com.sun.enterprise.naming.impl.SerialContext.lookup(SerialContext.java:442)
      at javax.naming.InitialContext.lookup(InitialContext.java:392)  at
    javax.naming.InitialContext.lookup(InitialContext.java:392)   at
    com.sun.enterprise.connectors.service.ConnectorResourceAdminServiceImpl.lookup(ConnectorResourceAdminServiceImpl.java:203)
      at
    com.sun.enterprise.connectors.ConnectorRuntime.lookupNonTxResource(ConnectorRuntime.java:440)
      at
    com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm.getConnection(JDBCRealm.java:538)
      ... 44 more Caused by: javax.naming.NameNotFoundException: security
    not found     at
    com.sun.enterprise.naming.impl.TransientContext.doLookup(TransientContext.java:197)
      at
    com.sun.enterprise.naming.impl.TransientContext.lookup(TransientContext.java:168)
      at
    com.sun.enterprise.naming.impl.TransientContext.lookup(TransientContext.java:172)
      at
    com.sun.enterprise.naming.impl.SerialContextProviderImpl.lookup(SerialContextProviderImpl.java:58)
      at
    com.sun.enterprise.naming.impl.LocalSerialContextProviderImpl.lookup(LocalSerialContextProviderImpl.java:101)
      at
    com.sun.enterprise.naming.impl.SerialContext.lookup(SerialContext.java:430)
      ... 49 more</p>
    
    <p>FINE: JAAS authentication aborted. WARNING: Web login failed: Login
    failed: javax.security.auth.login.LoginException: Security Exception
    FINE: [Web-Security] Policy Context ID was:
    CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
    FINE: [Web-Security] hasUserDataPermission perm:
    (javax.security.jacc.WebUserDataPermission /error.xhtml GET) FINE:
    [Web-Security] hasUserDataPermission isGranted: true</p>
  </blockquote>
  
  <p><strong>Update 3</strong></p>
  
  <p>Maybe there is something wron with the connection pool.
  This is how my connection pool looks like:</p>
  
  <p><img src="https://i.stack.imgur.com/D8iwH.png" alt="enter image description here"></p>
  
  <p><img src="https://i.stack.imgur.com/vKZYB.png" alt="enter image description here"></p>
  
  <p><img src="https://i.stack.imgur.com/kFJ3b.png" alt="enter image description here"></p>
  
  <p>I don't have much properties, maybe something is missing?</p>
  
  <p>Also now i created a JDBC resource, that looks like this:</p>
  
  <p><img src="https://i.stack.imgur.com/TZyfP.png" alt="enter image description here"></p>
  
  <p>(The JNDI name in the Realm, was changed to jdbc/studydb)</p>
  
  <p>My persistence.xml looks like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;persistence version="2.0" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_2_0.xsd"&gt;
      &lt;persistence-unit name="CHAPTER x 12 Container Managed Authentication and Authorization"&gt;
          &lt;jta-data-source&gt;jdbc/studydb&lt;/jta-data-source&gt;     
          &lt;class&gt;entities.User&lt;/class&gt;
          &lt;class&gt;entities.Group&lt;/class&gt;
      &lt;/persistence-unit&gt;
  &lt;/persistence&gt;
  </code></pre>
  
  <p>I think i made some progress, now the exception i see is:</p>
  
  <pre><code>&gt; SEVERE: jdbcrealm.invaliduserreason
  &gt;      FINE: Cannot validate user
  &gt;      java.sql.SQLSyntaxErrorException: Schema 'ADMIN' does not exist
  &gt;       at org.apache.derby.client.am.SQLExceptionFactory40.getSQLException(Unknown
  &gt; Source)
  &gt;      ....
  &gt;      
  &gt;      Caused by: org.apache.derby.client.am.SqlException: Schema 'ADMIN' does not exist
  &gt;       at org.apache.derby.client.am.Statement.completeSqlca(Unknown Source)
  &gt;      ...
  &gt;      FINE: JAAS authentication aborted.
  &gt;      WARNING: Web login failed: Login failed: javax.security.auth.login.LoginException: Security Exception
  &gt;      FINE: [Web-Security] Policy Context ID was: CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
  &gt;      FINE: [Web-Security] hasUserDataPermission perm: (javax.security.jacc.WebUserDataPermission /error.xhtml GET)
  &gt;      FINE: [Web-Security] hasUserDataPermission isGranted: true
  &gt;      WARNING: PWC4011: Unable to set request character encoding to UTF-8 from context 
  &gt; /CHAPTER_12_x_Container_Managed_Authentication_and_Authorization, 
  &gt; because request parameters have already been read, or 
  &gt; ServletRequest.getReader() has already been called
  </code></pre>
  
  <p><strong>Update 4</strong></p>
  
  <p>I changed the database, it was wrongly organized so i made some changes in my entities:</p>
  
  <pre><code>@Entity
      @Table(name="USERS", schema="ADMIN")
      public class User implements Serializable {
  
          private static final long serialVersionUID = -1244856316278032177L;
          @Id 
          @Column(nullable = false)
          private String userid;  
  
          @Column(nullable = false)
          private String password;
  
          @ManyToOne
          @JoinTable(name="USER_GROUP",schema="ADMIN", joinColumns = @JoinColumn(name="userid", referencedColumnName="userid"), inverseJoinColumns=@JoinColumn(name="groupid", referencedColumnName= "groupid") )
          private Group group;
          //GET &amp; SET METHODS
  </code></pre>
  
  <hr>
  
  <p>@Entity
  @Table(name="GROUPS", schema="ADMIN")
  public class Group implements Serializable {</p>
  
  <pre><code>private static final long serialVersionUID = -7274308564659753174L;
  @Id
  @Column(nullable = false)
  private String groupid;
  
  @OneToMany(mappedBy="group")
  private Set&lt;User&gt; users;
  </code></pre>
  
  <p>//GET &amp; SET METHODS</p>
  
  <p>So i had also to edit the DBRealm, now it looks like this:</p>
  
  <p><img src="https://i.stack.imgur.com/Qaw1N.png" alt="enter image description here"></p>
  
  <p>But when i login i get again an exception:</p>
  
  <pre><code>FINE: [Web-Security] Policy Context ID was: CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
  FINE: [Web-Security] hasUserDataPermission perm: (javax.security.jacc.WebUserDataPermission /j_security_check POST)
  FINE: [Web-Security] hasUserDataPermission isGranted: true
  FINE: Logging in user [user@gmail.com] into realm: DBRealm using JAAS module: jdbcRealm
  FINE: Login module initialized: class com.sun.enterprise.security.auth.login.JDBCLoginModule
  SEVERE: SEC1111: Cannot load group for JDBC realm user [user@gmail.com].
  FINE: Cannot load group
  java.sql.SQLSyntaxErrorException: Column 'USERID' is either not in any table in the FROM list or appears within a join specification and is outside the scope of the join specification or appears in a HAVING clause and is not in the GROUP BY list. If this is a CREATE or ALTER TABLE  statement then 'USERID' is not a column in the target table.
  ....
  ....
  Caused by: org.apache.derby.client.am.SqlException: Column 'USERID' is either not in any table in the FROM list or appears within a join specification and is outside the scope of the join specification or appears in a HAVING clause and is not in the GROUP BY list. If this is a CREATE or ALTER TABLE  statement then 'USERID' is not a column in the target table.
      at org.apache.derby.client.am.Statement.completeSqlca(Unknown Source)
  ....
  ....
  FINE: JAAS login complete.
  FINE: JAAS authentication committed.
  FINE: Password login succeeded for : user@gmail.com
  FINE: permission check done to set SecurityContext
  FINE: Set security context as user: user@gmail.com
  FINE: [Web-Security] Policy Context ID was: CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
  FINE: [Web-Security] hasUserDataPermission perm: (javax.security.jacc.WebUserDataPermission  GET)
  FINE: [Web-Security] hasUserDataPermission isGranted: true
  FINE: permission check done to set SecurityContext
  FINE: SecurityContext: setCurrentSecurityContext method called
  
  FINE: [Web-Security] Policy Context ID was: CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
  FINE: [Web-Security] hasUserDataPermission perm: (javax.security.jacc.WebUserDataPermission /adminpanel.xhtml GET)
  FINE: [Web-Security] hasUserDataPermission isGranted: true
  FINE: [Web-Security] Policy Context ID was: CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
  FINE: [Web-Security] Generating a protection domain for Permission check.
  FINE: [Web-Security] Checking with Principal : user@gmail.com
  FINE: [Web-Security] Checking with Principal : visitors
  FINE: [Web-Security] Checking with Principal : users
  FINE: [Web-Security] Checking with Principal : administrators
  FINE: [Web-Security] Codesource with Web URL: file:/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization/CHAPTER_x_12_Container_Managed_Authentication_and_Authorization
  FINE: [Web-Security] Checking Web Permission with Principals : user@gmail.com, visitors, users, administrators
  FINE: [Web-Security] Web Permission = (javax.security.jacc.WebResourcePermission /adminpanel.xhtml GET)
  FINE: [Web-Security] hasResource isGranted: true
  FINE: [Web-Security] hasResource perm: (javax.security.jacc.WebResourcePermission /adminpanel.xhtml GET)
  FINE: SecurityContext: setCurrentSecurityContext method called
  
  WARNING: Resource not found: com/sun/enterprise/v3/admin/adapter/theme/com/sun/webui/jsf/suntheme/images/masthead/masthead_button_over.gif
  </code></pre>