OK - have got a basic solution, I'm not saying its the best, but looks like it will do the job.
Its based on a blog post by Sanjiv Jivan
http://www.jroller.com/sjivan/entry/ajax%5Fbased%5Flogin%5Fusing%5Faceci
EDIT: Having just read the comments on that post it looks like there may be another way to do it, also the post is 3+ years old, so wouldn't be surprised if there's better solutions out there, maybe using new features in Spring or J2EE. But I'm going to stick with this for now.
He's done a very good job of documenting it there, so I'll just comment here that I've got a basic example going by starting with copying Spring Security sample app., then adding the ServletFilter as described by Sanjiv.
As he was using an earlier version of Acegi Security (now called Spring Security) there were one or two changes required:
The url pattern is now "/j_spring_security_check" (not "/j_acegi_security_check"), and I found I had to add an input named "ajax" to get the isAjaxRequest method to return true - guessing I missed something in the javascript for that.
Had to change one line in the filter to check for "login_error" instead of "login_error=1", guessing that's something thats changed in newer versions of SpringSecurity. I.E.:
if (redirectURL.indexOf("login_error") == -1) {
Also as I'm using jquery not prototype I created a basic html page with javascript to test using jquery.
Its rough and ready at the moment, the status that gets displayed is just "url:/msgbrd/" or "error:Bad credentials", but can tidy that up easily enough.
In case it helps here's my example index.html:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
<script type="text/javascript" src="jquery-1.3.2.js"></script>
<script type="text/javascript" src="jquery.form.js"></script>
<script type="text/javascript">
var loginOptions = {
beforeSubmit: postingLogin, // pre-submit callback
success: showResponse, // post-submit callback
type: 'post',
url: '/msgbrd/j_spring_security_check' ,
clearForm: true
};
$(document).ready(function(){
$('#loginForm').ajaxForm( loginOptions );
});
function postingLogin() {
console.log("Login posting: ");
}
function doneLogin() {
console.log("Login posted ");
}
function showResponse(responseText, statusText) {
$("#statusMessage").empty();
$("#statusMessage").append( responseText);
}
</script>
</head>
<body>
<h1>msgbrd</h1>
<div>
<form id="loginForm" action="" method="POST">
<p><label for="username"> User Name: </label> <input id="username"
type="text" name="j_username" class="loginText"></p>
<p><input id="ajax" name="ajax" value="ajax"></input></p>
<p><label for="password"> Password: </label> <input id="password"
type="password" name="j_password" class="loginText"
onkeydown="loginOnEnter(event);"></p>
<p><label for="remember_me"> <input id="remember_me"
type="checkbox" name="_acegi_security_remember_me">Remember Me</label>
</p>
<p><input type="submit" value="Go"></input></p>
<p id="statusMessage"></p>
</form>
</div>
</body>
</html>