Error 404 Etat /test2/spring_security_login

[blured75]

Hi,

I'm trying to securise my standard web app with spring security 3. I've got : Error 404 Etat /test2/spring_security_login when I go to a secured resource (http://localhost:8080/test2/secure-l...orm/index.html)

I don't understand why. Do you see something not good in my appliContext.xml or web.xml ?

applicationContext.xml :

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <debug />

    <global-method-security pre-post-annotations="enabled" />

    <http pattern="/secure-login-form/**" use-expressions="true">
        <intercept-url pattern="/secure-login-form/**" access="isAuthenticated()" />	
	<form-login />
    </http>


    <!--
    Usernames/Passwords are
        rod/koala
        dianne/emu
        scott/wombat
        peter/opal
    -->
    <beans:bean id="encoder" class="org.springframework.security.crypto.password.StandardPasswordEncoder"/>

    <authentication-manager>
        <authentication-provider>
            <password-encoder ref="encoder"/>
            <user-service>
                <user name="rod" password="4efe081594ce25ee4efd9f7067f7f678a347bccf2de201f3adf2a3eb544850b465b4e51cdc3fcdde" authorities="supervisor, user, teller" />
                <user name="dianne" password="957ea522524a41cbfb649a3e293d56268f840fd5b661b499b07858bc020d6d223f912e3ab303b00f" authorities="user,teller" />
                <user name="scott" password="fb1f9e48058d30dc21c35ab4cf895e2a80f2f03fac549b51be637196dfb6b2b7276a89c65e38b7a1" authorities="user" />
                <user name="peter" password="e175750688deee19d7179d444bfaf92129f4eea8b4503d83eb8f92a7dd9cda5fbae73638c913e420" authorities="user" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

web.xml :

<?xml version="1.0" encoding="UTF-8"?>
<!--
  - Tutorial web application
  -
  -->

<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

    <display-name>Spring Security Tutorial Application</display-name>

    <!--
      - Location of the XML file that defines the root application context
      - Applied by ContextLoaderListener.
      -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext-security.xml
        </param-value>
    </context-param>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!--
      - Loads the root application context of this web app at startup.
    -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <!--
      - Publishes events for session creation and destruction through the application
      - context. Optional unless concurrent session control is being used.
      -->
    <listener>
      <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    </listener>

  <!--
    - Provides core MVC application controller. See bank-servlet.xml.
    -->
    

     <welcome-file-list>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>

</web-app>

In the log I've got the following :

18:03:27.746 [http-bio-8080-exec-12] DEBUG o.s.s.w.s.HttpSessionRequestCache - DefaultSavedRequest added to Session: DefaultSavedRequest[http://localhost:8080/t
est2/secure-login-form/index.html]
18:03:27.746 [http-bio-8080-exec-12] DEBUG o.s.s.w.a.ExceptionTranslationFilter - Calling Authentication entry point.
18:03:27.747 [http-bio-8080-exec-12] DEBUG o.s.s.web.DefaultRedirectStrategy - Redirecting to 'http://localhost:8080/test2/spring_security_login'
18:03:27.748 [http-bio-8080-exec-12] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will no
t be stored in HttpSession.
18:03:27.749 [http-bio-8080-exec-12] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
18:03:27.752 [http-bio-8080-exec-13] DEBUG o.s.s.web.util.AntPathRequestMatcher - Checking match of request : '/spring_security_login'; against '/secure-login-f
orm/**'
18:03:27.753 [http-bio-8080-exec-13] INFO  Spring Security Debugger -

************************************************************

Request received for '/spring_security_login':

org.apache.catalina.connector.RequestFacade@1227efc

servletPath:/spring_security_login
pathInfo:null

Security filter chain: no match


************************************************************


18:03:27.757 [http-bio-8080-exec-13] DEBUG o.s.s.web.util.AntPathRequestMatcher - Checking match of request : '/spring_security_login'; against '/secure-login-f
orm/**'
18:03:27.758 [http-bio-8080-exec-13] DEBUG o.s.security.web.FilterChainProxy - /spring_security_login has no matching filters

[Rob Winch]

The issue is that Security will only be applied if it matches the pattern specified in your http element (i.e. pattern="/secure-login-form/**" ). This means that /j_spring_security_check never gets processed by Spring Security. To fix it remove the pattern from the <http> element or add form-login@login-processing-url to look like /secure-login-form/j_spring_security_check and ensure your form submits to the new URL