Form authentication for not authorised user

Question

i'm implementing a form based authentication for my web application.

i created some users in the JDBCrealm on TomEE server and allow only particular users to access the protected jsf pages.

Now authentication works perfectly and if there is a username password mismatch it is redirected to the error page.

the problem i'm facing here is, if i try to login with the user already available in the JDBCrealm who is not authorised to access the protected the page im getting 403 error.

When I come back and try again get to protected pages i can't again login. Is it because information about my login is remembered in session and I have to invalidate session?

Even if I don't login ?

EDIT:

i ask about at forum: http://openejb.979440.n4.nabble.com/Bug-in-security-TomEE-td4665009.html

and i think its the best answer for my question

Answer 1

instead of trying to implement this yourself take a look to something like spring security, it provides most of the options you will need and if you need to extend it is easy as well