Question

How can I validate password with confirm password in login.jsp and only if equal, then redirect to success.jsp which displays Welcome #{beans.username}.

Answer 1

Just implement a Validator the usual way. Validation should surely not be done in the action method as others suggest/imply. If validation fails, then by default the action method just won’t be invoked and the same page will just be redisplayed with validation errors. You can pass the password field as <f:attribute> of the confirm password field so that the validator can get hold of its value for test.

Here’s a kickoff example of the view:

<h:inputSecret id="password" binding="#{passwordComponent}" value="#{bean.password}" required="true" />
<h:message for="password" />

<h:inputSecret id="confirm" required="#{not empty password.value}">
    <f:validator validatorId="confirmPasswordValidator" />
    <f:attribute name="passwordComponent" value="#{passwordComponent}" />
</h:inputText>
<h:message for="confirm" />

and the validator:

@FacesValidator("confirmPasswordValidator")
public class ConfirmPasswordValidator implements Validator {

    @Override
    public void validate(FacesContext context, UIComponent component, Object value) throws ValidatorException {
        UIInput passwordComponent = (UIInput) component.getAttributes().get("passwordComponent");
        String password = (String) passwordComponent.getValue();
        String confirmPassword = (String) value;

        if (confirmPassword != null && !confirmPassword.equals(password)) {
            throw new ValidatorException(new FacesMessage(
                FacesMessage.SEVERITY_ERROR, "Confirm password is not the same as password", null));
        }
    }

}

The message will appear in <h:message for="confirm">.

Note that you only need to have the password as a property in the backing bean, not the confirm password.

private String password;

// Getter+setter.

In the action method you can just return the navigation case outcome the usual way:

public String login() {
    User user = userService.find(username, password); 

    if (user != null) {
        FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("user", user);
        return "success?faces-redirect=true";
    } else {
        FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(
            FacesMessage.SEVERITY_WARN, "Unknown login, please try again.", null));
        return null;
    }
}

Since JSF 2.0 there’s no need for verbose navigation cases in faces-config.xml anymore as the other answer suggest.

---

Unrelated to the concrete problem, why are you still sticking to the legacy JSP view technology? This has been deprecated since JSF 2.0 in favor of Facelets. Please consider migrating JSP to Facelets. Then you’ll be able to use among others the new JSF 2.0 <f:ajax> awesomeness and strong Facelets templating capabilities.