java - tomcat jdbc realm - j_security not redirecting -

<realm classname="org.apache.catalina.realm.jdbcrealm"        drivername="com.mysql.jdbc.driver"        connectionurl="jdbc:mysql://localhost/db"        connectionname="user"        connectionpassword="password"        allrolesmode="authonly"        digest="sha"         usertable="app"         usernamecol="login"         usercredcol="login"        userroletable="login"         rolenamecol="group"/>    <login-config>     <auth-method>form</auth-method>     <realm-name>realm</realm-name>     <form-login-config>         <form-login-page>/login.jsp</form-login-page>         <form-error-page>/error.jsp</form-error-page>     </form-login-config> </login-config>  <form action="j_security_check" method="post"> <tr>username:<td><input type="text"     name="j_username" style="width:100px;"></td></tr> <tr> password:<td><input type="text"     name="j_ password " style="width:100px;"></td></tr> <tr>< input type="submit"   name="btnlogin" value="login"></td></tr> </form> 

when deployed,i http status 400 - invalid direct reference form login page

here browser console output..

remote address:::1:8080 request url:http://devserver:8080/testapp/j_security_check request method:post status code:400 bad request request headersview source accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 accept-encoding:gzip,deflate,sdch accept-language:en-us,en;q=0.8,ta;q=0.6 cache-control:max-age=0 connection:keep-alive content-length:53 content-type:application/x-www-form-urlencoded cookie:jsessionid=be7c932856a7794d9c780531a29fb25f host:localhost:8080 origin:http://devserver:8080 referer:http://devserver:8080/testapp/timeout.jsp user-agent:mozilla/5.0 (windows nt 6.1; wow64) applewebkit/537.36 (khtml, gecko) chrome/35.0.1916.153 safari/537.36 form dataview sourceview url encoded j_username:testuser j_password:testuser btnlogin:login response headersview source connection:close content-length:1054 content-type:text/html;charset=utf-8 date:fri, 27 jun 2014 12:13:00 gmt server:apache-coyote/1.1 

also enabled log realm , j_security_check not redirecting after successfull login

jun 27, 2014 5:42:49 pm org.apache.catalina.authenticator.authenticatorbase invoke fine:  not subject constraint jun 27, 2014 5:43:00 pm org.apache.catalina.authenticator.authenticatorbase invoke fine: security checking request post /testapp/j_security_check jun 27, 2014 5:43:00 pm org.apache.catalina.authenticator.formauthenticator authenticate fine: authenticating username 'testuser' jun 27, 2014 5:43:00 pm org.apache.catalina.authenticator.formauthenticator authenticate fine: authentication of 'testuser' successful jun 27, 2014 5:43:00 pm org.apache.catalina.authenticator.formauthenticator authenticate fine: redirecting original 'null' jun 27, 2014 5:43:00 pm org.apache.catalina.authenticator.authenticatorbase invoke fine:  failed authenticate() test ??/ testapp/j_security_check 

authentication in tomcat works challenge. if try access protected resources, tomcat redirect login page. once authenticated, redirect initial page requested. if access directly login page there no initial request hence error: http status 400 - invalid direct reference form login page

in case, either try acces protected resource first or add landingpage attribute authenticator want (see documentation)

edit: landingpage attribute available since tomcat7.

for exemple, in context.xml file :

<context> <valve classname="org.apache.catalina.authenticator.formauthenticator" landingpage="connected.jsp"/> <realm classname="org.apache.catalina.realm.jdbcrealm"    drivername="com.mysql.jdbc.driver"    connectionurl="jdbc:mysql://localhost/db"    connectionname="user"    connectionpassword="password"    allrolesmode="authonly"    digest="sha"     usertable="app"     usernamecol="login"     usercredcol="login"    userroletable="login"     rolenamecol="group"/> </context>