Spring Security 2 not working with WebSphere?
Recently SpringSource was engaged with my company and helped us to create a PoC to demonstrate how Spring Security can address many of our strategic security needs. (And to give them a plug- they are great to work with.) Ordinarily, our development, test, and production environments are WebSphere 6 or 6.1, but to accelerate development of the PoC, we used Tomcat. The time has come for me to port this over to WAS 6.1 and I'm encountering some odd behavior. I am hoping someone can shed some light on this.
Fundamentally, we are using the basic steps outlined in countless "What's new in Spring Security 2?" articles, with some slight modifications.
In web.xml, the following filter is defined and mapped:
Code:
<filter>
<filter-name>_filterChainProxy</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>_filterChainProxy</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
And in my application context, I have the following:
Code:
<?xml version="1.0" encoding="UTF-8"?>
<bean:beans xmlns="http://www.springframework.org/schema/security"
xmlns:bean="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-2.0.xsd">
<http auto-config="true">
<intercept-url pattern="/employees**" access="ROLE_EMPLOYEE"/>
<intercept-url pattern="/employeeAwards**" access="ROLE_EMPLOYEE"/>
<intercept-url pattern="/admin/**" access="ROLE_ADMINISTRATOR"/>
<intercept-url pattern="/**" access="ROLE_ANONYMOUS,ROLE_EMPLOYEE"/>
<form-login login-page="/login" authentication-failure-url="/login?login_error=1" />
<logout logout-success-url="/login"/>
</http>
<bean:bean id="loggerListener" class="org.springframework.security.event.authentication.LoggerListener"/>
</bean:beans>
Now, my understanding may be flawed (hard to know because this next part seems poorly documented), but shouldn't the filter chain that's created by <http auto-config="true"> support login by responding to to POSTs to http://{server}:{port}/{context root}/j_spring_security_check?
This is working just fine in Tomcat, but in WebSphere 6.1, I get the following error when attempting to login:
Code:
Error 404: SRVE0190E: File not found: /j_spring_security_check
Unfortunately, I see no clues in the logs as to what may have gone wrong.
To be clear, I haven't done anything but port this from Tomcat to WebSphere, all else has remained unchanged save for downgrading from servlet spec 2.4 to 2.5, but I believe Spring Security filters are 2.3 filters anyway, so I do not see how that should matter.
One further note on version: when I started seeing this problem we were using a nightly snapshot of Spring Security 2 from some point in February. In trying to correct the issue, I have upgraded to RC1 and am still experiencing the same behavior.
Can anyone shed any light on this? Have I perhaps uncovered some bizarre incompatibility with WebSphere?
Thanks krancour (security fix)
The instructions and links worked for our cluster and j_security session issue. Our version is 6.1.0.15 and it worked. Thanks for the followup.
