Hello,
I seem to be facing the exact same problem. I am however reluctant to use
Code:
<property name="exceptionIfHeaderMissing" value="false" />
My configuration is as below for the application
web.xml
Code:
<!-- 2. Defining Spring Configuration files -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/config/applicationContext.xml
/WEB-INF/config/applicationContext-security.xml
</param-value>
</context-param>
<!-- 3. Defining Spring Security filter -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 4. Defining Struts2 Configuration -->
<filter>
<filter-name>struts2</filter-name>
<filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>struts2</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
applicationContext-security.xml
Code:
<http auto-config='true'>
<!-- URL Pattern's for which Spring Security should not be applied -->
<intercept-url pattern="/css/**" filters="none" />
<intercept-url pattern="/images/**" filters="none" />
<intercept-url pattern="/js/**" filters="none" />
<intercept-url pattern="/struts/**" filters="none" />
<intercept-url pattern="/index.action*" filters="none" />
<intercept-url pattern="/logoutSiteminder.action" filters="none" />
<!-- Defining role based access for different URL Pattern's -->
<intercept-url pattern="/*.action*" access="ROLE_USER" />
<!-- Logout URL -->
<logout logout-success-url="/logoutSiteminder.action" />
<!-- Adding SiteMinder Authentication Filter with Spring Security keyword PRE_AUTH_FILTER -->
<custom-filter position="PRE_AUTH_FILTER" ref="siteminderFilter" />
</http>
<!-- Defining SiteMinder Authentication Filter (SM_USER is fetched from request header) -->
<beans:bean id="siteminderFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
<beans:property name="principalRequestHeader" value="SM_USER"/>
<beans:property name="authenticationManager" ref="authenticationManager" />
</beans:bean>
<!-- Defining Custom Authentication Provider as a preauthAuthProvider -->
<beans:bean id="preauthAuthProvider"
class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
<beans:property name="preAuthenticatedUserDetailsService">
<beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
<beans:property name="userDetailsService" ref="userDetailsService"/>
</beans:bean>
</beans:property>
</beans:bean>
<!-- Providing preauthAuthProvider to Authentication Manager -->
<authentication-manager alias="authenticationManager" >
<authentication-provider ref="preauthAuthProvider"/>
</authentication-manager>
I figured this might be related to
https://jira.springsource.org/browse/SEC-1249
So adding its reference over here.
Everything works fine for me.
- Login screen is displayed.
- Successfull Siteminder Authentication + Spring Authorization is done
- Home page is displayed
- However wherever i have reference for js file like the one below
Code:
/ContextRoot/struts/js/jquery.struts2.js
/ContextRoot/struts/js/jquery.subscribe.js
I am getting the error
Code:
org.springframework.security.web.authentication.preauth.PreAuthenticatedCredentialsNotFoundException: SM_USER header not found in request.
I do not understand why am i getting this error in the first place only for the javascript files at a particular path as mentioned above ?
And why was this not an issue in Spring Security 2.0.5. ?
Please note that i face this issue with or without the below line in my applicationContext-security.xml.
Code:
<intercept-url pattern="/struts/**" filters="none" />
And with and without "an unprotected resource filter /ContextRoot/struts/* to Siteminder"
Help to resolve this would be greatly appreciated.
This is quite on priority for me.
Regards,
Darshan Shroff
shroffdarshan@gmail.com
http://www.linkedin.com/in/darshanshroff
Help needed again - Spring 3.0.x security + SiteMinder Integration
Reply With Quote
Originally Posted by darshan.shroff
