Endless loop in web authentication
I am trying to use form based authentication and getting in to this wiered problem of getting into endless loop.
When I try to access any page, it redirects it to login page (which is login.jsp in my case), and than it tries to redirect again and again to login page.
I have pasted my web.xml and Spring bean entries below. Please let me know what I am missing here thats causing this.
Please note that if I do change the url-pattern and use only *.do, it works because login page is .jsp file and filter is not recalled, but then another wiered problem happens, it would not understand j_acegi_security_check, so had to append .do at the end of j_acegi_scurity_check also. So to work with *.do url-pattern, I had to use j_acegi_security_check.do at both places (in bean and login form).
Here are my web.xml entries
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:applicationContext.xml
classpath:security.xml
</param-value>
</context-param>
<context-param>
<param-name>log4jConfigLocation</param-name>
<param-value>/WEB-INF/log4j.xml</param-value>
</context-param>
<filter>
<filter-name>Acegi Filter Chain Proxy</filter-name>
<filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
<init-param>
<param-name>targetClass</param-name>
<param-value>net.sf.acegisecurity.util.FilterChainProxy</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>Acegi Filter Chain Proxy</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>context</servlet-name>
<servlet-class>org.springframework.web.context.ContextLoade rServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
Here are my Spring beans entries
<bean id="filterChainProxy" class="net.sf.acegisecurity.util.FilterChainProxy" >
<property name="filterInvocationDefinitionSource">
<value> CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
PATTERN_TYPE_APACHE_ANT /**=httpSessionContextIntegrationFilter, authenticationProcessingFilter, securityEnforcementFilter
</value>
</property>
</bean>
<bean id="authenticationProcessingFilter"
class="net.sf.acegisecurity.ui.webapp.Authenticati onProcessingFilter">
<property name="filterProcessesUrl">
<value>j_acegi_security_check</value>
</property>
<property name="authenticationFailureUrl">
<value>/login.jsp?failed=true</value>
</property>
<property name="defaultTargetUrl">
<value>/admin/search.display.do</value>
</property>
<property name="authenticationManager">
<ref bean="authenticationManager"/>
</property>
</bean>
<bean id="securityEnforcementFilter"
class="net.sf.acegisecurity.intercept.web.Security EnforcementFilter">
<property name="filterSecurityInterceptor">
<ref local="filterInvocationInterceptor"/>
</property>
<property name="authenticationEntryPoint">
<ref local="authenticationProcessingFilterEntryPoint"/>
</property>
</bean>
<bean id="authenticationProcessingFilterEntryPoint"
class="net.sf.acegisecurity.ui.webapp.Authenticati onProcessingFilterEntryPoint">
<property name="loginFormUrl">
<value>/login.jsp</value>
</property>
<property name="forceHttps">
<value>false</value>
</property>
</bean>
<bean id="filterInvocationInterceptor"
class="net.sf.acegisecurity.intercept.web.FilterSe curityInterceptor">
<property name="authenticationManager">
<ref bean="authenticationManager"/>
</property>
<property name="accessDecisionManager">
<ref local="httpRequestAccessDecisionManager"/>
</property>
<property name="objectDefinitionSource">
<value>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
PATTERN_TYPE_APACHE_ANT
/**=ROLE_ANONYMOUS
</value>
</property>
</bean>
<bean id="httpSessionContextIntegrationFilter" class="net.sf.acegisecurity.context.HttpSessionCon textIntegrationFilter">
<property name="context">
<value>
net.sf.acegisecurity.context.security.SecureContex tImpl
</value>
</property>
</bean>
<bean id="authenticationManager"
class="net.sf.acegisecurity.providers.ProviderMana ger">
<property name="providers">
<list>
<ref bean="jaasAuthenticationProvider"/>
</list>
</property>
</bean>
<bean id="jaasAuthenticationProvider"
class="net.sf.acegisecurity.providers.jaas.JaasAut henticationProvider">
<property name="loginConfig">
<value>classpath:jaas.login.conf</value>
</property>
<property name="loginContextName">
<value>myLoginContext</value>
</property>
<property name="callbackHandlers">
<list>
<bean class="net.sf.acegisecurity.providers.jaas.JaasNam eCallbackHandler"/>
<bean class="net.sf.acegisecurity.providers.jaas.JaasPas swordCallbackHandler"/>
</list>
</property>
<property name="authorityGranters">
<list>
<bean class="gov.vha.edb.ui.util.JaasAuthorityGranter"/>
</list>
</property>
</bean>
<bean id="httpRequestAccessDecisionManager"
class="net.sf.acegisecurity.vote.AffirmativeBased" >
<property name="allowIfAllAbstainDecisions">
<value>false</value>
</property>
<property name="decisionVoters">
<list>
<ref bean="roleVoter"/>
</list>
</property>
</bean>
<bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>
Originally Posted by Luke
