huggy77
Mar 31st, 2012, 03:15 PM
When using a jdbc-user-service i am getting a 403 error after logging in with good credentials. Yet when attempting to log in with bad credentials i am shown my loginfailed page (which is what we want).
i tested the http block in my security-context by using the generic user-service and it worked fine.
Please help me understand what is wrong and how to fix it. Also please explain what clues brought you to your conclusion.
i am including my code.
sql (authority table) :
-- ----------------------------
-- Table structure for `authorities`
-- ----------------------------
DROP TABLE IF EXISTS `authorities`;
CREATE TABLE `authorities` (
`client_email_address` varchar(60) NOT NULL,
`authority` varchar(50) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
customer table
SET FOREIGN_KEY_CHECKS=0;
-- ----------------------------
-- Table structure for `customer`
-- ----------------------------
DROP TABLE IF EXISTS `customer`;
CREATE TABLE `customer` (
`client_id` int(7) unsigned NOT NULL AUTO_INCREMENT,
`client_name_first` varchar(40) NOT NULL,
`client_name_last` varchar(40) NOT NULL,
`client_name_middle_initial` char(1) DEFAULT NULL,
`client_phone_home` varchar(14) DEFAULT NULL,
`client_phone_cell` varchar(14) DEFAULT NULL,
`client_addr_shipping_line_one` varchar(80) NOT NULL,
`client_addr_shipping_line_two` varchar(80) DEFAULT NULL,
`client_addr_shipping_city` varchar(30) NOT NULL,
`client_addr_shipping_state` char(2) NOT NULL,
`client_addr_shipping_zip` char(5) NOT NULL,
`client_addr_shipping_country_code` char(2) NOT NULL DEFAULT 'US',
`client_addr_billing_line_one` varchar(80) NOT NULL,
`client_addr_billing_line_two` varchar(80) DEFAULT NULL,
`client_addr_billing_city` varchar(30) NOT NULL,
`client_addr_billing_state` char(2) NOT NULL,
`client_addr_billing_zip` char(5) NOT NULL,
`client_addr_billing_country_code` char(2) NOT NULL DEFAULT 'US',
`client_status_code` smallint(1) unsigned NOT NULL DEFAULT '0',
`client_date_created` date NOT NULL,
`client_email_address` varchar(60) NOT NULL,
`client_password` varchar(16) NOT NULL,
`enabled` tinyint(1) NOT NULL,
PRIMARY KEY (`client_id`,`client_email_address`),
UNIQUE KEY `idx_clientEmail` (`client_email_address`) USING BTREE
) ENGINE=InnoDB AUTO_INCREMENT=9 DEFAULT CHARSET=latin1;
my security context is
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<http auto-config="true">
<intercept-url pattern="/members/*" access="ROLE_ADMIN" />
<form-login login-page="/login.xhtml" authentication-failure-url="/loginfailed.xhtml" />
</http>
<authentication-manager>
<authentication-provider>
<jdbc-user-service data-source-ref="mysqlDataSource"
users-by-username-query="
select client_email_address, client_password, enabled
from customer where client_email_address=?"
authorities-by-username-query="
select au.authority, c.client_email_address
from customer c, authorities au
where au.client_email_address = c.client_email_address and c.client_email_address =?"
/>
</authentication-provider>
</authentication-manager>
<!-- ================ OLD WAY ==================================================
<authentication-manager>
<authentication-provider>
<user-service>
<user name="rexryan" password="jets" authorities="ROLE_ADMIN" />
<user name="djeter" password="17684514" authorities="ROLE_ADMIN" />
</user-service>
</authentication-provider>
</authentication-manager>
-->
</beans:beans>
my authentication bean
package security;
import java.io.IOException;
import javax.enterprise.context.RequestScoped;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.inject.Named;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
@Named
@RequestScoped
public class AuthenticationBean {
public String doLogin() throws IOException, ServletException{
ExternalContext context = FacesContext.getCurrentInstance().getExternalConte xt();
RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_check");
dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
FacesContext.getCurrentInstance().responseComplete ();
return null;
}
public String doLogout() {
FacesContext.getCurrentInstance().getExternalConte xt().invalidateSession();
return "/logout.xhtml";
}
}
i will attach my shortened log file below...
i tested the http block in my security-context by using the generic user-service and it worked fine.
Please help me understand what is wrong and how to fix it. Also please explain what clues brought you to your conclusion.
i am including my code.
sql (authority table) :
-- ----------------------------
-- Table structure for `authorities`
-- ----------------------------
DROP TABLE IF EXISTS `authorities`;
CREATE TABLE `authorities` (
`client_email_address` varchar(60) NOT NULL,
`authority` varchar(50) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
customer table
SET FOREIGN_KEY_CHECKS=0;
-- ----------------------------
-- Table structure for `customer`
-- ----------------------------
DROP TABLE IF EXISTS `customer`;
CREATE TABLE `customer` (
`client_id` int(7) unsigned NOT NULL AUTO_INCREMENT,
`client_name_first` varchar(40) NOT NULL,
`client_name_last` varchar(40) NOT NULL,
`client_name_middle_initial` char(1) DEFAULT NULL,
`client_phone_home` varchar(14) DEFAULT NULL,
`client_phone_cell` varchar(14) DEFAULT NULL,
`client_addr_shipping_line_one` varchar(80) NOT NULL,
`client_addr_shipping_line_two` varchar(80) DEFAULT NULL,
`client_addr_shipping_city` varchar(30) NOT NULL,
`client_addr_shipping_state` char(2) NOT NULL,
`client_addr_shipping_zip` char(5) NOT NULL,
`client_addr_shipping_country_code` char(2) NOT NULL DEFAULT 'US',
`client_addr_billing_line_one` varchar(80) NOT NULL,
`client_addr_billing_line_two` varchar(80) DEFAULT NULL,
`client_addr_billing_city` varchar(30) NOT NULL,
`client_addr_billing_state` char(2) NOT NULL,
`client_addr_billing_zip` char(5) NOT NULL,
`client_addr_billing_country_code` char(2) NOT NULL DEFAULT 'US',
`client_status_code` smallint(1) unsigned NOT NULL DEFAULT '0',
`client_date_created` date NOT NULL,
`client_email_address` varchar(60) NOT NULL,
`client_password` varchar(16) NOT NULL,
`enabled` tinyint(1) NOT NULL,
PRIMARY KEY (`client_id`,`client_email_address`),
UNIQUE KEY `idx_clientEmail` (`client_email_address`) USING BTREE
) ENGINE=InnoDB AUTO_INCREMENT=9 DEFAULT CHARSET=latin1;
my security context is
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<http auto-config="true">
<intercept-url pattern="/members/*" access="ROLE_ADMIN" />
<form-login login-page="/login.xhtml" authentication-failure-url="/loginfailed.xhtml" />
</http>
<authentication-manager>
<authentication-provider>
<jdbc-user-service data-source-ref="mysqlDataSource"
users-by-username-query="
select client_email_address, client_password, enabled
from customer where client_email_address=?"
authorities-by-username-query="
select au.authority, c.client_email_address
from customer c, authorities au
where au.client_email_address = c.client_email_address and c.client_email_address =?"
/>
</authentication-provider>
</authentication-manager>
<!-- ================ OLD WAY ==================================================
<authentication-manager>
<authentication-provider>
<user-service>
<user name="rexryan" password="jets" authorities="ROLE_ADMIN" />
<user name="djeter" password="17684514" authorities="ROLE_ADMIN" />
</user-service>
</authentication-provider>
</authentication-manager>
-->
</beans:beans>
my authentication bean
package security;
import java.io.IOException;
import javax.enterprise.context.RequestScoped;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.inject.Named;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
@Named
@RequestScoped
public class AuthenticationBean {
public String doLogin() throws IOException, ServletException{
ExternalContext context = FacesContext.getCurrentInstance().getExternalConte xt();
RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_check");
dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
FacesContext.getCurrentInstance().responseComplete ();
return null;
}
public String doLogout() {
FacesContext.getCurrentInstance().getExternalConte xt().invalidateSession();
return "/logout.xhtml";
}
}
i will attach my shortened log file below...