[Solved]UserName becoming empty before searching in Spring security 3.1 : Please Help
Hello Friends,
Merry Xmas.
Few years ago I have developed and implemented Flex-Spring-Mybatis-Firebird application with
old spring. Now I am developing a new project and decided to use Spring 3.1 release. I have copied
config files from old application and tuned them to Spring 3.1. Since its a early stage of project
I am trying to test security only on few jsp pages with inmemory authentication. The security config
and the partial log is as below.
When I try to login with any user name and password the Bad Credentials error is thrown. When I try to
access secured pages it takes me to login page this functionality is as expected. I tried with debug log
and noted that when user is being searched its getting empty string to verify against inmemory list.
Can somebody help me in this situation ?
Thanks and warm regards.
Raja
the security xml file
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schem...curity-3.1.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schem...-beans-3.1.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">
<security:http pattern="/index.jsp" security="none"/>
<security:http pattern="/pngfix.htc" security="none"/>
<security:http pattern="/Tej-EIS.css" security="none"/>
<security:http pattern="/trans.gif" security="none"/>
<security:http pattern="/images/**" security="none"/>
<security:http pattern="/WEB-Plain/**" security="none"/>
<security:http pattern="/TEJSYMB-3.png" security="none"/>
<security:http access-decision-manager-ref="accessDecisionManagerRoleBased"
access-denied-page="/index.jsp?access_denied=1"
>
<security:intercept-url pattern="/spring/messagebroker/**" access="ROLE_ANONYMOUS"/>
<security:intercept-url pattern="/WEB-Flex/**" access="ROLE_AUTHENTICATED"/>
<security:intercept-url pattern="/utility/**" access="ROLE_AUTHENTICATED"/>
<security:intercept-url pattern="/temp/**" access="ROLE_AUTHENTICATED"/>
<security:intercept-url pattern="/reports/**" access="ROLE_AUTHENTICATED"/>
<security:intercept-url pattern="/**" access="ROLE_AUTHENTICATED"/>
<security:form-login login-page="/index.jsp?do_login=1"
default-target-url="/index.jsp?login_success=1"
authentication-failure-url="/index.jsp?login_error=1"
/>
<security:logout logout-success-url="/index.jsp?logged_out=1" invalidate-session="true" />
<security:session-management invalid-session-url="/index.jsp?invalid_session=1"
session-fixation-protection="migrateSession">
<security:concurrency-control
max-sessions="100"
error-if-maximum-exceeded="true"
expired-url="/index.jsp?session_expired=1"
session-registry-ref="sessionRegistry"
/>
</security:session-management>
</security:http>
<bean id="sessionRegistry"
class="org.springframework.security.core.session.S essionRegistryImpl"/>
<alias name="roleHierarchyVoter" alias="customAccessVoter"/>
<alias name="inMemoryuserDetailsService" alias="customUserDetailsService"/>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider>
<securityassword-encoder hash="plaintext" />
<security:user-service id="inMemoryuserDetailsService" >
<security:user name="owner" password="test" authorities="ROLE_OWNER" disabled="false"/>
<security:user name="ceo" password="test" authorities="ROLE_CEO" disabled="false"/>
<security:user name="srmgr" password="test" authorities="ROLE_SR_MGR" disabled="false"/>
<security:user name="mgr" password="test" authorities="ROLE_MGR" disabled="false"/>
<security:user name="opr" password="test" authorities="ROLE_OPR" disabled="false"/>
<security:user name="user" password="test" authorities="ROLE_USER" disabled="false"/>
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
<bean id="roleHierarchy" class="org.springframework.security.access.hierarc hicalroles.RoleHierarchyImpl">
<property name="hierarchy">
<value>
ROLE_OWNER > ROLE_CEO
ROLE_CEO > ROLE_SR_MGR
ROLE_SR_MGR > ROLE_MGR
ROLE_MGR > ROLE_OPR
ROLE_OPR > ROLE_USER
ROLE_USER > ROLE_AUTHENTICATED
ROLE_AUTHENTICATED > ROLE_ANONYMOUS
</value>
</property>
</bean>
<bean id="roleHierarchyVoter" class="org.springframework.security.access.vote.Ro leHierarchyVoter">
<constructor-arg ref="roleHierarchy"/>
</bean>
<bean id="accessDecisionManagerRoleBased"
class="org.springframework.security.access.vote.Un animousBased">
<constructor-arg name="decisionVoters">
<list>
<ref bean="roleHierarchyVoter"/>
</list>
</constructor-arg>
<property name="allowIfAllAbstainDecisions" value="true" />
</bean>
<bean id="accessDecisionManagerCustom"
class="org.springframework.security.access.vote.Un animousBased">
<constructor-arg name="decisionVoters">
<list>
<ref bean="customAccessVoter"/>
</list>
</constructor-arg>
<property name="allowIfAllAbstainDecisions" value="true" />
</bean>
<bean id="authLoggerListener" class="org.springframework.security.authentication .event.LoggerListener"/>
</beans>
The Partial log
09:55:39 355 DEBUG /j_spring_security_check at position 1 of 10 in additional filter chain; firing Filter: 'ConcurrentSessionFilter'
09:55:39 355 DEBUG /j_spring_security_check at position 2 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
09:55:39 355 DEBUG HttpSession returned null object for SPRING_SECURITY_CONTEXT
09:55:39 355 DEBUG No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@ 478dabf1. A new one will be created.
09:55:39 358 DEBUG /j_spring_security_check at position 3 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
09:55:39 358 DEBUG /j_spring_security_check at position 4 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
09:55:39 359 DEBUG Request is to process authentication
09:55:39 359 DEBUG Authentication attempt using org.springframework.security.authentication.dao.Da oAuthenticationProvider
09:55:39 360 DEBUG User '' not found
09:55:39 360 WARN Authentication event AuthenticationFailureBadCredentialsEvent: ; details: org.springframework.security.web.authentication.We bAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: D79E6639229F0FA1CDB8F4A1F8D6E101; exception: Bad credentials
09:55:39 361 DEBUG Authentication request failed: org.springframework.security.authentication.BadCre dentialsException: Bad credentials
09:55:39 361 DEBUG Updated SecurityContextHolder to contain null Authentication
09:55:39 361 DEBUG Delegating to authentication failure handlerorg.springframework.security.web.authentica tion.SimpleUrlAuthenticationFailureHandler@2f1aa58 b
09:55:39 362 DEBUG Redirecting to /index.jsp?login_error=1
09:55:39 363 DEBUG Redirecting to '/Tej-EIS-31/index.jsp?login_error=1'
09:55:39 363 DEBUG SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
Reply With Quote
Originally Posted by swang30
