How to integrate Spring Security and GWT?

Question

I'm trying to integrate Spring Security and GWT. I'm also using gwt-incubator-security. I configured everything as it was described on their wiki pages. I managed to get security working by using intercept-url, but I can't get it working using annotations. Any ideas about what the problem is?

P.S. I'm using Spring 2.5.6, Spring Security 2.0.5 and gwt-incubator-security 1.0.1. Any useful links and comments are welcome.

Here are my config files

applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<global-method-security secured-annotations="enabled"
 jsr250-annotations="disabled" />
<http auto-config="true">
 <!-- <intercept-url pattern="/**/*.rpc" access="ROLE_USER" /> -->
 <intercept-url pattern="/gwt/**" access="ROLE_USER" />
 <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
</http>
<authentication-provider>
 <user-service>
  <user name="rod" password="koala"
   authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
  <user name="dianne" password="emu" authorities="ROLE_USER,ROLE_TELLER" />
  <user name="scott" password="wombat" authorities="ROLE_USER" />
  <user name="peter" password="opal" authorities="ROLE_USER" />
 </user-service>
</authentication-provider>
<beans:bean id="greetService" class="com.ct.test.server.GreetingServiceImpl" />

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app>
<!-- Default page to serve -->
<welcome-file-list>
 <welcome-file>Spring_test.html</welcome-file>
</welcome-file-list>
<!--  Spring related configuration  -->
<listener>
 <listener-class>
  org.springframework.web.context.ContextLoaderListener
 </listener-class>
</listener>
<!-- Initialise the Spring MVC DispatcherServlet -->
<servlet>
 <servlet-name>spring</servlet-name>
 <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
 <load-on-startup>1</load-on-startup>
</servlet>
<!-- Map the DispatcherServlet to only intercept RPC requests -->
<servlet-mapping>
 <servlet-name>spring</servlet-name>
 <url-pattern>/spring_test/greet.rpc</url-pattern>
 <!--
  <url-pattern>/org.example.gwtwisdom.GwtWisdom/services/*</url-pattern>
 -->
</servlet-mapping>
<servlet>
 <servlet-name>greetServlet</servlet-name>
 <servlet-class>com.ct.test.server.GreetingServiceImpl</servlet-class>
</servlet>
<servlet-mapping>
 <servlet-name>greetServlet</servlet-name>
 <url-pattern>/spring_test/greet.rpc</url-pattern>
</servlet-mapping>
<!-- Spring security -->
<filter>
 <filter-name>springSecurityFilterChain</filter-name>
 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
 <filter-name>springSecurityFilterChain</filter-name>
 <url-pattern>/*</url-pattern>
</filter-mapping>

spring-servlet.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- The application context definition for the DispatcherServlet -->
<bean id="urlMapping" class="com.gwtincubator.security.server.GWTSecuredHandler">
 <property name="mappings">
  <map>
   <entry key="/spring_test/greet.rpc" value-ref="greetService" />
  </map>
 </property>
</bean>

Here is my sample project that i tried to integrate with Spring Security: http://www.filedropper.com/springtest_1

Answer 1

It seems that you are missing namespace configuration in your applicationContext.xml.

It should look like this:

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:sec="http://www.springframework.org/schema/security"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"&gt;