These lines concern me:
2005-03-14 09:59:16,918 DEBUG [net.sf.acegisecurity.ui.AbstractProcessingFilter] - <Authentication success: net.sf.acegisecurity.providers.UsernamePasswordAut henticationToken@36d2b3: Username: com.bluestoneworks.security.UserDet@42e9fb; Password: [PROTECTED]; Authenticated: false; Details: 127.0.0.1; Granted Authorities: ROLE_USER>
2005-03-14 09:59:16,918 DEBUG [net.sf.acegisecurity.ui.AbstractProcessingFilter] - <Redirecting to target URL from HTTP Session (or default): /fleet/app>
2005-03-14 09:59:16,919 DEBUG [net.sf.acegisecurity.context.HttpSessionContextInt egrationFilter] - <Context stored to HttpSession: 'net.sf.acegisecurity.context.security.SecureConte xtImpl@955d1c: Null authentication'>
If you check the code for AbstractProcessingFilter, you can see the issue:
Code:
protected void successfulAuthentication(HttpServletRequest request,
HttpServletResponse response, Authentication authResult)
throws IOException {
if (logger.isDebugEnabled()) {
logger.debug("Authentication success: " + authResult.toString());
}
SecureContext sc = SecureContextUtils.getSecureContext();
sc.setAuthentication(authResult);
if (logger.isDebugEnabled()) {
logger.debug(
"Updated ContextHolder to contain the following Authentication: '"
+ authResult + "'");
}
String targetUrl = (String) request.getSession().getAttribute(ACEGI_SECURITY_TARGET_URL_KEY);
request.getSession().removeAttribute(ACEGI_SECURITY_TARGET_URL_KEY);
if (alwaysUseDefaultTargetUrl == true) {
targetUrl = null;
}
if (targetUrl == null) {
targetUrl = request.getContextPath() + defaultTargetUrl;
}
if (logger.isDebugEnabled()) {
logger.debug(
"Redirecting to target URL from HTTP Session (or default): "
+ targetUrl);
}
As shown, the "updated ContextHolder to contain the following Authentication" log message never happened. Equally odd is the ContextHolder is definitely contain a non-null SecureContextImpl, as proven by the final log message.
Can you check your classpath doesn't contain any old Acegi Security JARs. If there aren't any, try building from Acegi Security CVS and inserting some more logging around the two lines which should be setting the Authentication into the ContextHolder (SecureContext sc = .... and sc.setAuthentication(authResult)).
upgrading 0.8.0 Null authentication SecureContextImpl
Originally Posted by pg
