title: Using HTTP Request.login with JBoss/JAAS
body: <p>I have successfully setup a JBoss security domain, and can authenticate using BASIC authentication (as defined in web.xml). This all works well. I cannot however figure out how to use the http request.login method.</p>
  
  <p>The following security domain (from jboss-web.xml) works for BASIC authentication:</p>
  
  <pre><code>&lt;jboss-web&gt;  
      &lt;context-root&gt;/myapp&lt;/context-root&gt;  
      &lt;security-domain&gt;java:/jaas/myapp-realm&lt;/security-domain&gt;  
  &lt;/jboss-web&gt; 
  </code></pre>
  
  <p>But when I use request.login as follows:</p>
  
  <pre><code>public void login() {
      FacesContext context = FacesContext.getCurrentInstance();
      HttpServletRequest request = (HttpServletRequest) context.getExternalContext().getRequest();
      try {
          request.login(username, password);
      }
      catch (ServletException ex) {
          java.util.logging.Logger.getLogger(UserLogin.class.getName()).log(Level.SEVERE, null, ex);
      }
  }
  </code></pre>
  
  <p>I get the following exception:</p>
  
  <pre><code>javax.servlet.ServletException: Failed to authenticate a principal
  </code></pre>
  
  <p>I know the username/pasword is fine (it worked fine using BASIC auth). I have TRACE level logging on, and it doesn't look like it is even trying to authenticate. What have I missed?</p>
  
  <p>See <a href="http://java-web-development.blogspot.com/2011/07/jee-6-security-part-two-implementation.html" rel="nofollow">http://java-web-development.blogspot.com/2011/07/jee-6-security-part-two-implementation.html</a> if you need more details about my setup/config. I am using JBoss 6.</p>