problem when using own datasource

[anand1975]

Hi Friends

Could any one help



Who ever the user and password the application is authenticating.

All the users and passwords are stored in the database

My SecurityContext.xml file

[code]

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN/EN" "http://www.springframework.org/dtd/spring-beans.dtd" >

<beans>

	<bean id="placeholderConfig"
		class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
		<property name="location">
			<value>WEB-INF/config/jdbc.properties</value>
		</property>
	</bean>
 

      <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
            <property name="userDetailsService">
                  <ref local="jdbcDaoImpl" />
            </property>
			<!--<property name="userCache">
			  <bean id="userCache" class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
			  		<property name="cache">
			  			<bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
			  				<property name="cacheManager" ref="cacheManager"/>
			  				<property name="cacheName" value="userCache"/>
			  			</bean>
			  		</property>
			  </bean>
  			</property>-->
      </bean>
      <!--<bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />-->
      <bean id="jdbcDaoImpl" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl">
    	<property name="dataSource">
    		<ref local="dataSource"/>
    	</property>
    	<property name="usersByUsernameQuery">
        <value>
        select LoginNAME as username, 
               PASSWORD,
               status as ENABLED 
          from APP_USERS
         where LoginNAME=? 
        </value>
    </property>
    <property name="authoritiesByUsernameQuery">
        <value>
        select LOGINNAME as username,
               ROLENAME as authority 
          from APP_USERS,
               APP_ROLES,
               USERNROLES 
         where USERNROLES.USERID=APP_USERS.USERID 
           and USERNROLES.ROLEID=APP_ROLES.ROLEID 
           and APP_USERS.LOGINNAME =?
        </value>
    </property>
    	
	  </bean>
	  	<bean id="dataSource"
		class="org.apache.commons.dbcp.BasicDataSource">
		<property name="driverClassName">
			<value>${db.driverClassName}</value>
		</property>
		<property name="url">
			<value>${db.url}</value>
		</property>
		<property name="username">
			<value>${db.username}</value>
		</property>
		<property name="password">
			<value>${db.password}</value>
		</property>
	 </bean>
      
 
 

      <bean id="authenticationManager"

            class="org.acegisecurity.providers.ProviderManager">

            <property name="providers">

                  <list>

                        <ref bean="daoAuthenticationProvider" />

                  </list>

            </property>

      </bean>

 

   <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">

      <property name="authenticationManager" ref="authenticationManager"/>

      <property name="authenticationFailureUrl"><value>/acegilogin.jsp?login_error=1</value></property>

      <property name="defaultTargetUrl"><value>/</value></property>

      <property name="filterProcessesUrl"><value>/j_acegi_security_check</value></property>

   </bean>

 

 

      <bean id="roleVoter" class="org.acegisecurity.vote.RoleVoter" />

 

   <bean id="accessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased">

   		<property name="allowIfAllAbstainDecisions" value="false" />  
  		<property name="decisionVoters">    
  			<bean class="org.acegisecurity.vote.RoleVoter" >
  				<property name="rolePrefix">
					<value>ROLE_</value>
				</property>
  			</bean>  
  		</property>
   </bean>

   

      <bean id="securityEnforcementFilter"

            class="org.acegisecurity.intercept.web.SecurityEnforcementFilter">

            <property name="filterSecurityInterceptor">

                  <ref bean="filterInvocationInterceptor" />

            </property>

            <property name="authenticationEntryPoint">

                  <ref bean="authenticationEntryPoint" />

            </property>

      </bean>

 

      <bean id="httpSessionIntegrationFilter"

            class="org.acegisecurity.context.HttpSessionContextIntegrationFilter">

            <property name="context">

                  <value>

                        org.acegisecurity.context.SecurityContextImpl

                  </value>

            </property>

      </bean>

 

      <bean id="authenticationEntryPoint"

            class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">

            <property name="loginFormUrl">

                  <value>../pages/acegilogin.jsp</value>

            </property>

            <property name="forceHttps"><value>false</value></property>

      </bean>

 

      <bean id="filterInvocationInterceptor"

            class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">

            <property name="authenticationManager">

                  <ref bean="authenticationManager" />

            </property>

            <property name="accessDecisionManager">

                  <ref bean="accessDecisionManager" />

            </property>

            <property name="objectDefinitionSource">

                  <value>

                        CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON

                        PATTERN_TYPE_APACHE_ANT 

                        /app/**=ROLE_Anonymous,ROLE_Admin
                        /app/appcontroller/**=ROLE_Admin

                        
                  </value>

            </property>

      </bean>

 

      <bean id="filterChainProxy"

            class="org.acegisecurity.util.FilterChainProxy">

            <property name="filterInvocationDefinitionSource">

                  <value>

                        CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON

                        PATTERN_TYPE_APACHE_ANT

                        /**=httpSessionIntegrationFilter,authenticationProcessingFilter,securityEnforcementFilter

                  </value>

            </property>

      </bean>

 

</beans>

[/code]

my web.xml:

[CODE]

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.3" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_3.xsd">
	<display-name>App</display-name>
	<listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	</listener>

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
			/WEB-INF/applicationContext.xml,
			/WEB-INF/dataAccesContext.xml,
			/WEB-INF/securityContext.xml
		</param-value>
	</context-param>

	<!--
		- Key of the system property that should specify the root directory of this
		- web app. Applied by WebAppRootListener or Log4jConfigListener.
	-->
	<context-param>
		<param-name>webAppRootKey</param-name>
		<param-value>App.root</param-value>
	</context-param>

	<!--
		- Location of the Log4J config file, for initialization and refresh checks.
		- Applied by Log4jConfigListener.
	-->
	<context-param>
		<param-name>log4jConfigLocation</param-name>
		<param-value>/WEB-INF/config/log4j.properties</param-value>
	</context-param>
	<!-- Leave the listener commented-out if using JBoss -->

	<listener>
		<listener-class>
			org.springframework.web.util.Log4jConfigListener
		</listener-class>
	</listener>
	<servlet>
		<servlet-name>App</servlet-name>
		<servlet-class>
			org.springframework.web.servlet.DispatcherServlet
		</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>

	<servlet-mapping>
		<servlet-name>App</servlet-name>
		<url-pattern>/appcontroller/*</url-pattern>
		
	</servlet-mapping>
	<filter>

            <filter-name>Acegi Filter Chain Proxy</filter-name>

            <filter-class>

                  org.acegisecurity.util.FilterToBeanProxy

            </filter-class>

            <init-param>

                  <param-name>targetClass</param-name>

                  <param-value>

                        org.acegisecurity.util.FilterChainProxy

                  </param-value>

            </init-param>

      </filter>

 

      <filter-mapping>

            <filter-name>Acegi Filter Chain Proxy</filter-name>

            <url-pattern>/*</url-pattern>

      </filter-mapping>



</web-app>

[/CODE]

Plz help me

[karldmoore]

Are you saying it's always authenticating regardless of if the username and password are actually correct?

[anand1975]

Are you saying it's always authenticating regardless of if the username and password are actually correct?

Yes it's right. The application is authenticating even if the user is not in the DataBase