I get a 404 error when I try to access a Spring Security protected URL after I have successfully logged in, but do not get the error when I do not protect the URL with Spring Security.
I am using Spring-MVC, Spring Security and Hibernate. I have tried to get what the problem might be, but have totally failed. I need your help guys.
My spring-security.xml file is as:
<http auto-config="true">
<intercept-url pattern="/sec/*" access="ROLE_USER" />
<form-login login-page="/login"
authentication-success-handler-ref="successHandler" authentication-failure-handler-ref="failureHandler"
authentication-failure-url="/login/error" />
<remember-me/>
<logout logout-success-url="/login" />
<access-denied-handler error-page="/403"/>
</http>
The dispatcher-servlet.xml is as:
<mvc:annotation-driven/>
<bean id="tilesConfigurer" class="org.springframework.web.servlet.view.tiles2.TilesConfigurer" p:definitions="/WEB-INF/tiles.xml" />
<bean id="viewResolver" class="org.springframework.web.servlet.view.UrlBasedViewResolver">
<property name="viewClass" value="org.springframework.web.servlet.view.tiles2.TilesView"/>
</bean>
<bean id="messageSource" class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
<property name="basename" value="/WEB-INF/application"/>
<property name="cacheSeconds" value="1"/>
and web.xml is as:
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/dispatcher-servlet.xml,
/WEB-INF/spring-security.xml,
/WEB-INF/applicationContext.xml,
/WEB-INF/spring-db.xml
</param-value>
</context-param>
<filter>
<filter-name>hibernateSessionInViewFilter</filter-name>
<filter-class>org.springframework.orm.hibernate3.support.OpenSessionInViewFilter</filter-class>
<init-param>
<param-name>sessionFactoryBeanName</param-name>
<param-value>sessionFactory</param-value>
</init-param>
<init-param>
<param-name>flushMode</param-name>
<param-value>ALWAYS</param-value>
</init-param>
<init-param>
<param-name>singleSession</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>hibernateSessionInViewFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>dispatcher</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>
org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<welcome-file-list>
<welcome-file>redirect.jsp</welcome-file>
</welcome-file-list>
Note that the Spring Security Authentication works just fine. Its the urls it protects that kind of are no longer being mapped by the dispatcher. Someone please help me solve this. Thank you in advance.
I have got the problem. I had set the wrong role in the database for the user I was trying to log in as. So essentially its a 403 error of which I hadn't mapped the 403 handling page hence throwing the 404 error. Thanx to all those who tried to help.
Related
Here is my setup / context. I have a JAR project that is using spring-boot 1.1.4 which uses Java configuration to load a properties file:
#Configuration
#ComponentScan
#EnableAutoConfiguration
#PropertySource(name="appProps", value="classpath*:application-${spring.profiles.active}.properties")
public class DataJpaApplication {
#Autowired Environment env;
#Bean
//note, this PSPSHC is ours derived from the Spring one with specialized code.
public static org.springframework.context.support.PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
PropertySourcesPlaceHolderConfigurer encryptionPropertySourcesPlaceHolderConfigurer = new PropertySourcesPlaceHolderConfigurer();
encryptionPropertySourcesPlaceHolderConfigurer
.setIgnoreUnresolvablePlaceholders(true);
return encryptionPropertySourcesPlaceHolderConfigurer;
}
}
This jar works fine with unit tests standalone. I then try to incorporate it into a web app (spring mvc web app not using spring-boot) making it a maven dependency and adding it to the context like this:
<beans:bean id="jpaConfigBean"
class="com.somepackage.DataJpaApplication" />
I have a web app unit test that attempt to load the web app's application context and that works fine (including loading the context and property file from the jar). However, when I deploy this web app to a container (tcServer), it fails with the following:
Caused by: java.io.FileNotFoundException: Could not open ServletContext resource [/application-local.properties]
edit
A clarification about the error above. The web app is loading its context and importing the jar file's context. It is this jar project that is loading the application-local.properties via #PropertySource. So, could this be around parent/child context interactions?
NOTE: No where does the code prepend a slash.
Here is how I am bootstrapping the spring config in the web app:
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath*:**/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
I have checked the following types of things:
Confirmed the maven generated manifest has a classpath entry for the jar file in the war file.
Changing the web.xml to use /WEB-INF/servlet-context.xml (standard path) instead
Deploy this web app in JBoss instead of tc
move the application-*.property file to another folder and refer to that folder
copy the *.property file to the web app project
confirmed the WTP deployment assembly in fact references maven
opened up the generated war file and confirmed the jar file has the file in the expected location.
and several other things with no success.
I don't see the issue. Please help figure out where the bug/misconfiguration is. Also, let me know if there is further configuration or files you need to see to help debug this issue.
Thanks in advance,
Scott
edit
complete web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
<context-param>
<param-name>log4jConfigLocation</param-name>
<param-value>log4j.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- commented out for debugging...trying to reduce the complexity to get to root cause
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath*:**/*Context.xml,
classpath*:**/*-context.xml
</param-value>
</context-param> -->
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath*:**/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter>
<filter-name>springOpenEntityManagerInViewFilter</filter-name>
<filter-class>org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>springOpenEntityManagerInViewFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>
org.springframework.security.web.session.HttpSessionEventPublisher
</listener-class>
</listener>
<error-page>
<error-code>404</error-code>
<location>/WEB-INF/views/404.jsp</location>
</error-page>
<error-page>
<error-code>500</error-code>
<location>/WEB-INF/views/500.jsp</location>
</error-page>
<error-page>
<location>/WEB-INF/views/500.jsp</location>
</error-page>
</web-app>
complete (obfuscated) servlet-context.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/mvc"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:jdbc="http://www.springframework.org/schema/jdbc"
xmlns:jpa="http://www.springframework.org/schema/data/jpa" xmlns:p="http://www.springframework.org/schema/p"
xmlns:util="http://www.springframework.org/schema/util" xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:cache="http://www.springframework.org/schema/cache" xmlns:task="http://www.springframework.org/schema/task"
xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
http://www.springframework.org/schema/cache http://www.springframework.org/schema/cache/spring-cache.xsd
http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task.xsd">
<beans:bean id="jpaConfigBean"
class="com.somepackage.DataJpaApplication" />
<!-- DispatcherServlet Context: defines this servlet's request-processing
infrastructure -->
<context:annotation-config />
<context:component-scan base-package="com.somepackage.*" />
<!-- Needed for transaction methods in controllers -->
<tx:annotation-driven />
<beans:bean id="ehCacheManager"
class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"
p:shared="true" />
<beans:bean id="cacheManager"
class="org.springframework.cache.ehcache.EhCacheCacheManager"
p:cacheManager-ref="ehCacheManager" />
<cache:annotation-driven cache-manager="cacheManager" />
<task:scheduled-tasks>
<task:scheduled ref="runScheduler" method="run" cron="0 0 3 * * *" />
<task:scheduled ref="runScheduler" method="run"
initial-delay="0" fixed-rate="#{ T(java.lang.Long).MAX_VALUE }" />
</task:scheduled-tasks>
<!-- Enables the Spring MVC #Controller programming model -->
<annotation-driven conversion-service="conversionService" />
<!-- Handles HTTP GET requests for /resources/** by efficiently serving
up static resources in the ${webappRoot}/resources directory -->
<resources mapping="/resources/**" location="/resources/" />
<!-- Resolves views selected for rendering by #Controllers to .jsp resources
in the /WEB-INF/views directory -->
<beans:bean
class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<beans:property name="prefix" value="/WEB-INF/views/" />
<beans:property name="suffix" value=".jsp" />
</beans:bean>
<beans:bean id="validator"
class="org.springframework.validation.beanvalidation.LocalValidatorFactoryBean" />
<beans:bean class="org.springframework.web.servlet.view.BeanNameViewResolver" />
<beans:bean id="contentNegotiationManager"
class="org.springframework.web.accept.ContentNegotiationManagerFactoryBean">
<beans:property name="favorPathExtension" value="true" />
<beans:property name="favorParameter" value="false" />
<beans:property name="ignoreAcceptHeader" value="false" />
<beans:property name="mediaTypes">
<beans:value>
html=text/html
json=application/json
xml=application/xml
</beans:value>
</beans:property>
</beans:bean>
</beans:beans>
Not sure there is anything relevant in these files besides what I highlighted above, but added per request and for clarity.
How do I add in multipart configuration to a spring mvc app which uses controllers with methods annotated with RequestMapping?
Background:
I want to enable csrf protection and so have added the security:csrf tag in my spring config. I have a controller class with a method annotated with RequestMapping used for uploading files. I also followed the caveat instructions around multipart whereby I added the multipart filter above the security filter. When I tried to upload a file after adding the csrf tag I got an exception around a missing getParts() method. A quick google highlighted this was due to using a version of jetty which was based on the servlet 2.5 spec. I upgraded jetty-maven-plugin to 8.1.14.v20131031 and tried uploading again. Resulting in:
org.springframework.web.multipart.MultipartException: Could not parse multipart servlet request; nested exception is java.lang.IllegalStateException: No multipart config for servlet
at org.springframework.web.multipart.support.StandardMultipartHttpServletRequest.<init>(StandardMultipartHttpServletRequest.java:68)
at org.springframework.web.multipart.support.StandardServletMultipartResolver.resolveMultipart(StandardServletMultipartResolver.java:58)
at org.springframework.web.multipart.support.MultipartFilter.doFilterInternal(MultipartFilter.java:110)
Where do I put the multipart configuration for xml setup? All documentation says to add the multipart-config in the servlet tag for the specific servlet in web.xml. There is only a single servlet for my application though. So I added it to that and still I get the same issue.
<servlet>
<servlet-name>SpringDispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet
</servlet-class>
<multipart-config>
<location>/tmp</location>
<max-file-size>20848820</max-file-size>
<max-request-size>418018841</max-request-size>
<file-size-threshold>1048576</file-size-threshold>
</multipart-config>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/servlet-context.xml
</param-value>
</init-param>
<load-on-startup>10</load-on-startup>
</servlet>
I also updated the schema location at the top of web.xml to point at version 3.0 of the servlet spec, sourced from http://www.mkyong.com/web-development/the-web-xml-deployment-descriptor-examples/.
Any help?
Edit: added the following riles for Rob:
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:/spring/webapp.xml</param-value>
</context-param>
<context-param>
<param-name>spring.profiles.default</param-name>
<param-value>OracleDB,common</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher
</listener-class>
</listener>
<servlet>
<servlet-name>SpringDispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet
</servlet-class>
<multipart-config>
<location>/tmp</location>
<max-file-size>20848820</max-file-size>
<max-request-size>418018841</max-request-size>
<file-size-threshold>1048576</file-size-threshold>
</multipart-config>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/servlet-context.xml
</param-value>
</init-param>
<load-on-startup>10</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>SpringDispatcher</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<filter>
<filter-name>MultipartFilter</filter-name>
<filter-class>org.springframework.web.multipart.support.MultipartFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>MultipartFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>sitemesh</filter-name>
<filter-class>com.opensymphony.module.sitemesh.filter.PageFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>sitemesh</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>XSS</filter-name>
<filter-class>com.mycompany.CrossScriptingFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>XSS</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<session-config>
<session-timeout>10</session-timeout>
</session-config>
<resource-ref>
<description>Core Datasource</description>
<res-ref-name>jdbc/coreDataSource</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
<resource-ref>
<description>Location Datasource</description>
<res-ref-name>jdbc/locationDataSource</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
<error-page>
<!-- Missing login -->
<error-code>401</error-code>
<location>/WEB-INF/views/errorPage.jsp</location>
</error-page>
<error-page>
<!-- Forbidden directory listing -->
<error-code>403</error-code>
<location>/WEB-INF/views/errorPage.jsp</location>
</error-page>
<error-page>
<!-- Missing resource -->
<error-code>404</error-code>
<location>/WEB-INF/views/errorPageNotFound.jsp</location>
</error-page>
<error-page>
<!-- Uncaught exception -->
<error-code>500</error-code>
<location>/WEB-INF/views/errorPage.jsp</location>
</error-page>
<error-page>
<!-- Unsupported servlet method -->
<error-code>503</error-code>
<location>/WEB-INF/views/errorPage.jsp</location>
</error-page>
</web-app>
servlet-context.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mvc="http://www.springframework.org/schema/mvc"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:util="http://www.springframework.org/schema/util" xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.2.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd">
<mvc:annotation-driven />
<mvc:resources mapping="/resources/**" location="/resources/" />
<mvc:resources mapping="/images/**" location="file:${fileSystemStore.fileSystemStorageLocation}"/>
<context:component-scan base-package="com.mycompany.console.*" />
<mvc:interceptors>
<bean class="com.mycompany.security.ChangePasswordInterceptor" />
</mvc:interceptors>
<security:global-method-security
secured-annotations="enabled" jsr250-annotations="enabled"
pre-post-annotations="enabled" proxy-target-class="true" />
<bean id="viewResolver"
class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="viewClass"
value="org.springframework.web.servlet.view.JstlView" />
<property name="prefix" value="/WEB-INF/views/" />
<property name="suffix" value=".jsp" />
<property name="contentType" value="text/html;charset=UTF-8" />
</bean>
<bean id="filterMultipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
<property name="maxUploadSize" value="100000000"/>
</bean>
<bean id="messageSource"
class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
<property name="basenames">
<list>
<value>classpath:language</value>
<value>classpath:language_additions</value>
<value>classpath:formats</value>
</list>
</property>
<property name="defaultEncoding" value="UTF-8" />
</bean>
<bean id="localeResolver" class="com.mycompany.locale.SessionLocaleResolver"/>
</beans>
I believe you are having issues related to SPR-11373. Specifically, the servlet specification is not clear on what should happen when performing multipart resolution within a Filter.
Have you tried using commons-fileupload instead? This is likely your best option. First add the following dependency:
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
<version>1.2.2</version>
</dependency>
Next ensure you have the following bean definition in your root application context.
<bean id="filterMultipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
<property name="maxUploadSize" value="100000000"/>
</bean>
You can find a complete working example with both commons-upload (prefer this solution) and using tomcat using allowCasualMultipartParsing on SEC-2471
I'm currently writing a Spring MVC application, secured by Spring Security. For the login a basic form authentication is used and since I didn't added further configuration the credentials are POSTed to http://www.localhost:8080/myWebApp/j_spring_security_check.
So far so good, but now I've introduced a second servlet (CometD), which shall not be affected by Spring nor Spring Security. For this, I tried to change the servlet-mappings to map Spring and Spring Security against /app, respectively /app/*, and the other Servlet against cometd/*. My web.xml looks as follows:
<!-- Spring security -->
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/app/*</url-pattern>
</filter-mapping>
<!-- Spring MVC -->
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/app</url-pattern>
</servlet-mapping>
<!-- CometD -->
<servlet>
<servlet-name>cometd</servlet-name>
<servlet-class>org.cometd.server.CometdServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>cometd</servlet-name>
<url-pattern>/cometd/*</url-pattern>
</servlet-mapping>
The problem with this is that after this changes I'm be able to login any more. The server is not able to find any request mapping and the client tells me
NetworkError: 404 Not Found - http://localhost:8080/myWebApp/app/j_spring_security_check.
What's wrong with this mappings? How can I configure Spring and Spring Security to only handle requests for specific mappings and not for / and /* as described in the documentation?
Thanks a lot in advance!
Best,
René
Leave your springSecurityFilterChain mapped to /. Change your security config:
<http use-expressions="true">
<intercept-url pattern="/cometd/**" access="permitAll" />
<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
</http>
How do I ensure that a call is being made to the OAuth2ProtectedResourceFilter when a request is sent with the oauth_token in the Authorization header?
It always passes through a filter if it is mapped properly
As mentioned, everything that you want to be secured, needs to go through a spring security filter:
Here a sample how a filter is mapped in front of the servlet (the spring MVC DispatcherServlet used for the authorization endpoints)
You could additionally map the same filter to any other servlet, for example to a jersey servlet you have configured.
In /WEB-INF/web.xml you need a filter-mapping like:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<servlet-name>spring-dispatcher</servlet-name>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
<servlet>
<servlet-name>spring-dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring-mvc-dispatcher-servlet.xml</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>spring-dispatcher</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
To ensure every call to '/*', or whatever pattern, is filtered you use http from the spring security namespace and a filter called OAuth2AuthenticationProcessingFilter, that will watch out for the Bearer Authorization header, you will need something like this in your /WEB-INF/spring-mvc-dispatcher-servlet.xml or where ever your spring security is configured:
<http pattern="/**"
create-session="never"
authentication-manager-ref="userAuthenticationManager"
access-decision-manager-ref="accessDecisionManager"
use-expressions="true">
<anonymous enabled="false" />
<custom-filter ref="oAuth2AuthenticationFilter" position="PRE_AUTH_FILTER" />
<access-denied-handler ref="oAuthAccessDeniedHandler" />
<intercept-url pattern="/**" access="isAuthenticated()" />
</http>
<beans:bean id="oAuth2AuthenticationFilter" class="org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter">
<beans:property name="authenticationManager" ref="userAuthenticationManager"/>
<beans:property name="authenticationEntryPoint" ref="oAuthAuthenticationEntryPoint"/>
</beans:bean>
following situation: I am developing a web application with Spring Roo 1.1 (Apache Tiles & Spring MVC). I want to have an admin section where each entity is reachable via the paths (/admin/users, /admin/roles, ...)
So far everything is working fine. The only problem is, that I want to have a static page on /admin. Since I don't want to create an own controller I've added in webmvc-config.xml:
<mvc:view-controller path="/admin" view-name="admin/index" />
Also in directory WEB-INF/views/admin/views.xml:
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE tiles-definitions PUBLIC "-//Apache Software Foundation//DTD Tiles Configuration 2.1//EN" "http://tiles.apache.org/dtds/tiles-config_2_1.dtd">
<tiles-definitions>
<definition extends="default" name="admin/index">
<put-attribute name="body" value="/WEB-INF/views/admin/index.jspx"/>
</definition>
</tiles-definitions>
I also did not forget to create an index.jspx.
Contents of web.xml:
<display-name>reservation</display-name>
<description>Roo generated reservation application</description>
<!-- Enable escaping of form submission contents -->
<context-param>
<param-name>defaultHtmlEscape</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath*:META-INF/spring/applicationContext*.xml</param-value>
</context-param>
<filter>
<filter-name>CharacterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter>
<filter-name>HttpMethodFilter</filter-name>
<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
</filter>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter>
<filter-name>Spring OpenEntityManagerInViewFilter</filter-name>
<filter-class>org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CharacterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>HttpMethodFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>Spring OpenEntityManagerInViewFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Creates the Spring Container shared by all Servlets and Filters -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- Handles Spring requests -->
<servlet>
<servlet-name>reservation</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/webmvc-config.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>reservation</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>10</session-timeout>
</session-config>
<error-page>
<exception-type>java.lang.Exception</exception-type>
<location>/uncaughtException</location>
</error-page>
<error-page>
<error-code>404</error-code>
<location>/resourceNotFound</location>
</error-page>
Unfortunately when requesting /admin I get a resource not found error.
Can somebody give me a hint on that?
Please make sure that you have <mvc:annotation-driven /> defines in your XML config.