Spring Security 2 not working with WebSphere?
Recently SpringSource was engaged with my company and helped us to create a PoC to demonstrate how Spring Security can address many of our strategic security needs. (And to give them a plug- they are great to work with.) Ordinarily, our development, test, and production environments are WebSphere 6 or 6.1, but to accelerate development of the PoC, we used Tomcat. The time has come for me to port this over to WAS 6.1 and I'm encountering some odd behavior. I am hoping someone can shed some light on this.
Fundamentally, we are using the basic steps outlined in countless "What's new in Spring Security 2?" articles, with some slight modifications.
In web.xml, the following filter is defined and mapped:
And in my application context, I have the following:Code:<filter> <filter-name>_filterChainProxy</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>_filterChainProxy</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
Now, my understanding may be flawed (hard to know because this next part seems poorly documented), but shouldn't the filter chain that's created by <http auto-config="true"> support login by responding to to POSTs to http://{server}:{port}/{context root}/j_spring_security_check?Code:<?xml version="1.0" encoding="UTF-8"?> <bean:beans xmlns="http://www.springframework.org/schema/security" xmlns:bean="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd"> <http auto-config="true"> <intercept-url pattern="/employees**" access="ROLE_EMPLOYEE"/> <intercept-url pattern="/employeeAwards**" access="ROLE_EMPLOYEE"/> <intercept-url pattern="/admin/**" access="ROLE_ADMINISTRATOR"/> <intercept-url pattern="/**" access="ROLE_ANONYMOUS,ROLE_EMPLOYEE"/> <form-login login-page="/login" authentication-failure-url="/login?login_error=1" /> <logout logout-success-url="/login"/> </http> <bean:bean id="loggerListener" class="org.springframework.security.event.authentication.LoggerListener"/> </bean:beans>
This is working just fine in Tomcat, but in WebSphere 6.1, I get the following error when attempting to login:
Unfortunately, I see no clues in the logs as to what may have gone wrong.Code:Error 404: SRVE0190E: File not found: /j_spring_security_check
To be clear, I haven't done anything but port this from Tomcat to WebSphere, all else has remained unchanged save for downgrading from servlet spec 2.4 to 2.5, but I believe Spring Security filters are 2.3 filters anyway, so I do not see how that should matter.
One further note on version: when I started seeing this problem we were using a nightly snapshot of Spring Security 2 from some point in February. In trying to correct the issue, I have upgraded to RC1 and am still experiencing the same behavior.
Can anyone shed any light on this? Have I perhaps uncovered some bizarre incompatibility with WebSphere?
Thanks krancour (security fix)
