Multiple login pages [Security 3]

[dcmdeivid]

Hi guys,

How can I allow multiple login pages in my app?

• I have two differents paths:
• /administracao // the site administration
• /biblioteca // A library

I need different login pages for each path.

How can I do it? I have no idea. Bellow my configuration:

<security:authentication-manager>
		<security:authentication-provider
			user-service-ref="usuarioBibliotecaHibernateDAO" />
	</security:authentication-manager>

	<security:http auto-config="true">
		<security:intercept-url pattern="/biblioteca/**"
			access="ROLE_USER" />
		<security:intercept-url pattern="/administracao/**"
			access="ROLE_USER" />


<!-- I Need two login pages! -->
		<security:form-login  login-page="/loginBiblioteca.iq"
			always-use-default-target="true" default-target-url="/biblioteca/home.iq"
			login-processing-url="/login" />

		<security:logout logout-url="/biblioteca/logout"
			logout-success-url="/loginBiblioteca.iq" />
	</security:http>

[Rob Winch]

Search the forums for DelegatingAuthenticationEntryPoint

[dcmdeivid]

Hi Robert,

I used your sugestion and works fine!
But I have other problem now.
/administracao/* and /biblioteca/* redirect to mapped login pages.

But my action is setted to the login-processing-url, this work fine for login-page="/loginBiblioteca.iq" which is the first in xml, but for login-page="/loginAdministracao.iq" I got the HTTP 404 error.
If I put in both login-processing-url="/login" my application is redirected to biblioteca default-target-url.

How can I choose between two default-target-url?
I can have two form:login or not?

Below my xml configuration.

Thanks in advance!

<security:http entry-point-ref="entryPoint">
        <security:intercept-url pattern="/biblioteca/**"
            access="ROLE_USER" />
        <security:intercept-url pattern="/administracao/**"
            access="ROLE_USER" />

        <!--  How can I use multiple form-logins? -->
        <security:form-login  login-page="/loginBiblioteca.iq"
            always-use-default-target="true" default-target-url="/biblioteca/home.iq"
            login-processing-url="/login" />
        <security:form-login  login-page="/loginAdministracao.iq"
            always-use-default-target="true" default-target-url="/administracao/home.iq"
            login-processing-url="/loginAdmin" />
            

        <security:logout logout-url="/biblioteca/logout"
            logout-success-url="/loginBiblioteca.iq" />
    </security:http>

    <bean id="entryPoint"
        class="org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint">
        <constructor-arg>
            <map>
                <entry>
                    <key>
                        <bean class="ServicesRequestMatcher" />
                    </key>
                    <bean id="administrationEntryPoint"
                        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
                        <property name="loginFormUrl" value="/loginAdministracao.iq" />
                    </bean>
                </entry>
            </map>
        </constructor-arg>
        <property name="defaultEntryPoint">
            <bean
                class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
                <property name="loginFormUrl" value="/login" />
            </bean>
        </property>
    </bean> 

[Rob Winch]

How can I choose between two default-target-url?

You might consider overriding the AuthenticationSuccessHandler. You could extend the SavedRequestAwareAuthenticationSuccessHandler and override the determineTargetUrl method. Each login page could provide something in the request to specify which target url to go to. For example it might have a hidden input specifying a parameter defaultTarget. For one of the login pages the form would set defaultTarget=1. Then your your AuthenticationSuccessHandler implementation could check if the parameter defaultTarget is 1 and if so use the defaultTargetUrl of /biblioteca/home.iq otherwise use the other default target url.

I can have two form:login or not?

You can do this in Spring Security 3.1 (not GA yet), but not 3.0

[dcmdeivid]

I will create a subdomain is better. And in this subdomain I will run administration application.

Thanks for you help Rob!