Spring Security Tag Lib Not working as expected

[Gouki]

Hi all,

I'm using Spring Security 2.0.4 and have been trying to adapt the spring security ldap sample tutorial to my own project.

My problem is that when using

<security:authentication property="principal.username" />

it comes up empty! I don't get any exceptions or errors, nothing is simply displayed. I know the user has been authenticated because the rest of the application logic works as expected.

My security application context looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:util="http://www.springframework.org/schema/util"
  xmlns:security="http://www.springframework.org/schema/security"
  xsi:schemaLocation="http://www.springframework.org/schema/beans 
                           http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                           http://www.springframework.org/schema/util 
                           http://www.springframework.org/schema/util/spring-util-2.5.xsd
                           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">

  <security:http access-denied-page="/pages/denied.htm">
    <security:form-login login-page="/pages/welcome.htm"
      authentication-failure-url="/pages/welcome.htm?login_error=true" />
    <security:intercept-url pattern="/pages/welcome.htm*" filters="none"/>
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
    <security:logout/>
  </security:http>

   <!-- Simple namespace-based configuration -->

    <security:ldap-server ldif="classpath:users.ldif" port="33389"/>
    
    <security:ldap-authentication-provider 
        group-search-filter="member={0}" 
        group-search-base="ou=groups"
        user-search-base="ou=people"
        user-search-filter="uid={0}"
    />

    <!-- Traditional Bean version of the same configuration -->
    
    <!-- This bean points at the embedded directory server created by the ldap-server element above  -->
    <bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
        <constructor-arg value="ldap://localhost:33389/dc=springframework,dc=org"/>
    </bean>

    <bean id="secondLdapProvider" class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
        <security:custom-authentication-provider />
        <constructor-arg>
          <bean class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
            <constructor-arg ref="contextSource" />
            <property name="userSearch">
              <bean id="userSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
                <constructor-arg index="0" value="ou=people"/>
                <constructor-arg index="1" value="(uid={0})"/>
                <constructor-arg index="2" ref="contextSource" />
              </bean>       
            </property>
          </bean>
        </constructor-arg>
        <constructor-arg>
          <bean class="org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator">
            <constructor-arg ref="contextSource" />
            <constructor-arg value="ou=groups" />
            <property name="groupSearchFilter" value="(member={0})"/>
            <property name="rolePrefix" value="ROLE_"/>
            <property name="searchSubtree" value="true"/>
            <property name="convertToUpperCase" value="true"/>
          </bean>
        </constructor-arg>
    </bean>

  <security:global-method-security secured-annotations="enabled" />

</beans>

I'm running this example on an Apache server but I also get the same problem when using authentication from a textfile:

<security:authentication-provider>
    <security:user-service properties="/WEB-INF/users.properties" />
</security:authentication-provider>

<security:authorize> tag seems to not work either...

I have included the Spring Security tag lib like so:

<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>

Any help is highly appreciated!

[Gouki]

Ok for those of you who might experience the same problem, here is a solution:
The problem was that I did not have a separate login page. Ideally I wanted to have the login form on the welcome page but this somehow confused Spring Security, returning null for the Authentication object. After specifying a separate login page the problem disappeared.

[Marten Deinum]

Well that wasn't really your issue.

The problem lies in your configuration..

You first set your login page to '/pages/welcome.htm' and next you specify that page to have no filters.

<security:intercept-url pattern="/pages/welcome.htm*" filters="none"/>

No filters applied, no Authentication object in your request, so nothing to access nor to display.

[Gouki]

Ok, thanks for the info Marten! I'll try with the old setup but without the filter attribute.