Here's the situation:




I'm running Orion 1.5.2 on Win2K. I have an application that I'm trying to secure using form-based authentication that's behaving quite strangely, and I've pretty much exhausted all my options regarding what could be wrong here.




I've made the appropriate entries in my web.xml file (see below), and have placed my login.jsp and login-error.jsp pages one level above the secured folder (called application-folder) like this:




index.jsp


login.jsp


login-error.jsp


application-folder


      main.jsp


      search.jsp


WEB-INF
      web.xml




Here's my web.xml file:

			

			<?xml version="1.0" encoding="UTF-8"?>
			

			

			

			oxsys
			

			/WEB-INF/oxsys.tld
			

			

			

			

			Index.jsp
			

			

			

			

			1
			

			

			

			

			FORM
			

			Example Form-Based Authentication Area
			

			

			/login.jsp
			

			/login-error.jsp
			

			

			

			

			

			no description
			

			administrator
			

			

			

			no description
			

			medium_clearance
			

			

			

			no description
			

			minimal_clearance
			

			

			

			

			

			myapplication
			

			no description
			

			/application-folder/
			

			

			DELETE
			

			GET
			

			POST
			

			PUT
			

			

			no description
			

			minimal_clearance
			

			

			

			no description
			

			NONE
			

			

			

			

		

The index.jsp file contains a link that directs users to /application-folder/main.jsp. Since everything under /application-folder/ is secured (see web.xml), it redirects the users to the /login.jsp page.




This page looks like this:

			

			

			

			

			

			
				

				

				

				

				

				

				

				

				

				

				

				

				

				

				

					

						

							
Username:
							

								
							
						
						

							
Password:
							

								
							
						
						

							

								
							
							

								
							
						
					
				
				

			
			

			

			

		

7 out 10 times, things will go smoothly, and after authentication the j_security_check servlet redirects me to /application-folder/main.jsp. However the rest of the time I get a 404 Not Found error with the explanation: "Resource /servlet/j_security_check not found on this server".




I also notice that on occasion, after successful authentication, the url shown in the address bar isn't http://localhost/application-folder/main.jsp, but http://localhost/servlet/j_security_check. Whenever this happens, none of the links in my application work any longer because instead of directing users to files located under /application-folder/ they instead send users to /servlet/. IOW, if I have a link in main.jsp that points to search.jsp, it should find the file called /application-folder/search.jsp... but instead it tries to serve up the file called /servlet/search.jsp, which doesn't exist.




I'm quite puzzled as to what may be wrong with my setup, and would really appreciate if someone could provide me with some useful hints.




Thanks in advance.




Harry.    <<Less