ansaurus

Question

Spring Security: Cannot access target page even after successful login

Answer 1

A:

Here is the applicationContext-security.xml file (forced to post this as an answer to my own question as my posts kept getting truncated - how else can you make long posts??)

<?xml version="1.0" encoding="UTF-8"?>

    <!--
     - Sample namespace-based configuration - - $Id: applicationContext-security.xml 3911 2009-09-29 16:18:01Z ltaylor $
    -->

<beans:beans xmlns="http://www.springframework.org/schema/security" 
       xmlns:beans="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
                  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                  http://www.springframework.org/schema/security 
                     http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;

    <global-method-security pre-post-annotations="enabled">
     <!--
      AspectJ pointcut expression that locates our "post" method and applies security that way <protect-pointcut
      expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>
     -->
    </global-method-security>

    <http auto-config="true">
     <intercept-url pattern="/member/**" access="ROLE_TELLER" />
     <intercept-url pattern="/login.htm" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https"/>
     <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />

     <form-login login-page="/login.htm"/>

        <session-management>
            <concurrency-control max-sessions="1" error-if-maximum-exceeded="false" />
        </session-management>

     <!-- Required for development environments -->
        <port-mappings>
          <port-mapping http="8080" https="8443"/>
        </port-mappings>
    </http>

    <!--
     Usernames/Passwords are rod/koala dianne/emu scott/wombat peter/opal
    -->
    <authentication-manager>
     <authentication-provider>
      <password-encoder hash="md5" />
      <user-service>
       <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
       <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" />
       <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" />
       <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" />
      </user-service>
     </authentication-provider>
    </authentication-manager>

</beans:beans>

chrisjleu 2009-11-28 15:40:53

Answer 2

+1 A:

The key here is that the session is lost after the successful login:

14:30:28,218 DEBUG HttpSessionSecurityContextRepository:133 - No HttpSession currently exists
14:30:28,218 DEBUG HttpSessionSecurityContextRepository:91 - No SecurityContext was available from the HttpSession: null. A new one will be created.

The anonymous user is created by defult because there is no security context.

Can you try the same but without the https restriction? or do it all in https. Just to see if it works.

rodrigoap 2009-11-29 13:20:26

Yes this is the problem. I've tried what you suggested and it works with HTTPS completely disabled or with it enabled for every page. The question now is how do I have it only work for the login page since this is the only part I would like to be secure?

chrisjleu 2009-11-30 05:35:58

ansaurus

tags:

views:

answers:

Spring Security: Cannot access target page even after successful login

related questions