spring-security

Externalizing Spring Security configuration?

I have a web application that works with several different configurations of Spring Security already. However, these difference configuration are all setup within my applicationContext configuration file. Therefore, in order to tweak these at a customer site, these would have to be modified INSIDE the WAR file. If customers manually m...

Spring security cannot redirect to the wanted page

I am using spring security framework integrated with Struts2, Spring and Hibernate. <David:http auto-config="true" access-denied-page="/accessDenied.html"> <!-- Don`t set any role restriction on login.jsp --> <David:intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" /> <!-- Res...

Auto login after successful registeration

hey all i want to make an auto login after successful registration in spring meaning: i have a protected page which requires login to access them and i want after registration to skip the login page and make an auto login so the user can see that protected page, got me ? i am using spring 3.0 , spring security 3.0.2 how to do so ? ...

How to access User object in grails controller

I'm using spring security, and I need to get the User domain object in a controller. If I call SpringSecurityService.getPrincipal(), I get back an object of type org.codehaus.groovy.grails.plugins.springsecurity.GrailsUser. However, what I'm looking for is the User domain object I've defined in my Config.groovy like so: grails.plugins...

count active users

I'm using spring security 2. 1.may i know how to use securitycontextholder to get total number of active users? 2. can retrieve sessionregistry from securitycontextholder? ...

POST parameters mysteriously eaten after using spring security & an ntlm filter.

I have a custom filter that carries out spring security authentication by checking in a database, and another that checks an NTLM provider. The problem is this: Enter URL http://myapp.com/app/somestuff/stuff Get redirected to http://myapp.com/login.jsp Enter correct login details and authenticate. All forms on both http://myapp.com/...

Spring Security : Bypass login form

Hi, I want to bypass the login form for a Spring webflow (Spring 2.0.5) application under certain scenarios (so the login form is presented for normal users but when the URL is like http://server.com/myspringapp/fakelogin?username=FakeUser&amp;password=FakePassword then the user should not be presented the login form but just authentica...

Spring Security, OAuth and Pre-Authorization

Can anyone provide some information, hints or tutorials that demonstrate how to use Spring Security OAuth with Spring's PreAuthorize feature? Ideally, I would like to link a username used for preauthorization to OAuth credentials. ...

UI Integration sample required of Spring Security Plugin of Grails

Hi All... I have been working with grails application and for security purpose used the spring security core. Now with that they are also providing the UI stuffs of security. So I have installed the plugin from http://grails.org/plugin/spring-security-ui in the project where I have configured spring security core too. Now I have not f...

authorization stringtemplate

it doesn`t working web.xml <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <context-param> <param-name>contextConfigLocation</param-name> <param-value> /WEB-INF/jshop-servlet.xml, /WEB-INF/applicationContext-security.xml </param-value> ...

Spring Security LDAP on Weblogic Server

Hi folks, i'm tring to use ldap for authentication in Weblogic Server but I have this problems always: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name '(inner bean)#8': Unsatisfied dependency expressed through constructor argument with index 0 of type [org.springframework.ldap.core.suppor...

How to display error message in my JSP page using spring security 2.0

Hi I am now using spring security. It works fine. But if login failed, no error message display. I am wondering how can I display error message? I have configured the ResourceBundleMessageSource in my applicationContext.xml <!-- Spring security error message config --> <bean id="messageSource" class="org.springframework.context.sup...

Spring Security 3 - Not granted any authorities

Hi folks, i'm tring to use ldap for authentication on Weblogic Server but I have this problems always: Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffe3f86: RemoteIpAddress: 127.0.0.1; SessionId: WhgyMmQddKLfnFjhTLn5Thl421hWZ8sLV732ctYLSLhQpQLW1JFR!-860386732!1285980317840; Not...

CAS, Spring Security and unprotected pages

Hi all, I'm using Spring Security + CAS in my website and there are some pages present different information in different login status. For example, link: foo.com/index anonymous user - common page layout + login elements authenticated user - customized layout + logout elements Since Spring Security does not support CAS gateway featur...

How to get authentication infomation when using spring security?

At pages I am using tag: security:authorize ifAnyGranted="ROLE_USER,ROLE_ADMIN" ... It works. But at server side: I use SecurityContextHolder.getContext().getAuthentication().isAuthenticated(),it is always true. When I didn't log in, the system take anonymousUser as the log in user. Whow can I avoid this? Thanks ...

How to generate content based on spring-security user rights.

I want to generate some html content based on the user rights of a user who logged in with spring-security. I can't find much about this subject on the internet so far and i'm wondering what would be a good way to implement this. So far i was thinking about making a custom tag, attach it to a controller who links to a class that can gen...

Grails spring security / Acegi. Custom User + Password expired management.

Hi, I'm working on a grails legacy project. A domain class called User exists. It contains password, username, roles, etc. This project uses Spring Security for role management. I would like to add expiration of credentials ( force the User to renew its password). I've modified the User class. Not it implements the UserDetails interf...

Is it possible to secure an included jsp with spring-security?

I got a jsp which imports a jsp file. Is it possible to secure the import with a spring-security configuration? For example i want to use this line of code: <c:import url="jsp/admin/add_user.jsp" /> But if the user is not logged in as admin than this import should not work because of security reasons. I secured the admin folder with ...

Spring Security: Allow page views for all Fully Authenticated users, unless they have a specific role.

I'm using Spring 3.0.3 with Spring Security. So, I have fairly lenient restrictions on an app I'm making. I only want to make sure that a person can log in and be authenticated in order to view the app. I don't want to grant roles to every potential user of this app (could be in the 10s of thousands). So, it's been fine to use: <secur...

Verify ifAnyGranted from a TagLib

Hi everyone, How I can verify that "at least one of the roles is granted" from a TagLib? So, I want to use something like: <sec:ifAnyGranted roles="ROLE_ADMIN,ROLE_SUPERVISOR"> but from the groovy file of my TagLib. I am using Spring Security Core plugin. Thanks in advance! ...