Spring security 3 and Url Rewrite

[hallisson]

The filter uses WebApplicationContext, becouse of that you have to put the ContextLoaderListener:

	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

And dont forget the contextConfigLocation:

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>/WEB-INF/spring/*.xml </param-value>
	</context-param>

That´s all

[buginside]

It works! Thank you very much.

Bug.

[bennyn]

I also have some problems to get Spring Security work with Spring 3 and Tuckey 3.0.4.

Here is my: web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext.xml
            /WEB-INF/applicationContext-security.xml
        </param-value>
    </context-param>
    <!-- Begin of Spring Security -->
    <filter>
      <filter-name>springSecurityFilterChain</filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- End of Spring Security -->
	<!-- Tuckey -->
	<filter>
		<filter-name>UrlRewriteFilter</filter-name>
		<filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>UrlRewriteFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<!-- End of Tuckey -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
	<!-- Dispatcher Servlet -->
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
		<url-pattern>/app/*</url-pattern>
    </servlet-mapping>
	<!-- End of Dispatcher Servlet -->
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <welcome-file-list>
        <welcome-file>redirect.jsp</welcome-file>
    </welcome-file-list>
</web-app>

And my applicationContext-security.xml:

...
<http access-denied-page="/accessDenied.jsp">
	<intercept-url pattern="/erstellen.html" access="ROLE_USER" />
	<intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
	<http-basic />
	<form-login login-page='/login.html' authentication-failure-url="/login.html?error=1" />
	<logout />
</http>
...

For Request-Mapping I use: DefaultAnnotationHandlerMapping

<bean class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping" />

My urlrewrite.xml is:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE urlrewrite PUBLIC "-//tuckey.org//DTD UrlRewrite 3.2//EN"
        "http://tuckey.org/res/dtds/urlrewrite3.2.dtd">
<urlrewrite default-match-type="wildcard">
	<rule>
		<from>/**</from>
		<to>/app/$1</to>
	</rule>
	<outbound-rule>
		<from>/app/**</from>
		<to>/$1</to>
	</outbound-rule>
</urlrewrite>

And my Controller has the following code in it:

@RequestMapping(value="/app/mypage.html/{code}", method=RequestMethod.GET)
public ModelAndView showErrors(@ModelAttribute("user") User user, @PathVariable("code") String errorMessage)
{
	ModelAndView mv = new ModelAndView("mypage");
	return mv;
}

If I want to open http://localhost:8080/project/mypage.html I'm getting:

HTTP Status 405 - Request method 'GET' not supported

And if I want to open http://localhost:8080/project/ I get:

HTTP Status 404

Can anybody help?

Greetings

Benny

[__dev18]

I also have some problems to get Spring Security work with Spring 3 and Tuckey 3.0.4.

You should have your Tuckey Urlrewrite Filter before Spring Security Filter in web.xml, because otherwise it cannot work. Also version 3.2 is stable version of Tuckey, why cannot you use it? And then you should add following to your Spring Security filter:

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern> 
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>ERROR</dispatcher>
    </filter-mapping>

And also mapping @RequestMapping(value="/app/mypage.html/{code} is wrong, unless you don't want your controller real url to be app/app/mypage.html/.

[eggsy84]

Hi there,

As suggested your URL mappings on the controller seem incorrect.

You should replace

@RequestMapping(value="/app/mypage.html/{code}", method=RequestMethod.GET)
public ModelAndView showErrors(@ModelAttribute("user") User user, @PathVariable("code") String errorMessage)
{
	ModelAndView mv = new ModelAndView("mypage");
	return mv;
}

With

@RequestMapping(value="/app/{code}/mypage.html", method=RequestMethod.GET)
public ModelAndView showErrors(@ModelAttribute("user") User user, @PathVariable("code") String errorMessage)
{
	ModelAndView mv = new ModelAndView("mypage");
	return mv;
}

Then you can hit the URL like so (assuming you have Tuckey setup):

http://localhost:8080/app/*/mypage.html

Eggsy

[bennyn]

Hi __dev18 and eggsy84. Thank you very much for your help!
With your advice I have made it.

But there is still a problem.
My application context path is /ksw and is deployed to http://localhost:8080/ksw

In my *.jsp's I have some links which look like:

<script type="text/javascript" src="/ksw/js/script.js"></script>

These links are also not working. But the controllers are doing very well!
Unfortunately http://localhost:8080/ksw/j_spring_security_check ends up in error 404

Maybe it's because I use the following "form action" in "login.jsp"?

<form action="<c:url value='j_spring_security_check'/>" method="POST">

My configuration is the following now:

web.xml

...
<!-- Tuckey's URL Rewrite Filter -->
<filter>
	<filter-name>UrlRewriteFilter</filter-name>
	<filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
</filter>
<filter-mapping>
	<filter-name>UrlRewriteFilter</filter-name>
	<url-pattern>/*</url-pattern>
</filter-mapping>

<!-- Spring Security -->
<filter>
	<filter-name>springSecurityFilterChain</filter-name>
	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
	<filter-name>springSecurityFilterChain</filter-name>
	<url-pattern>/*</url-pattern>
	<dispatcher>REQUEST</dispatcher>
	<dispatcher>FORWARD</dispatcher>
	<dispatcher>INCLUDE</dispatcher>
	<dispatcher>ERROR</dispatcher>	
</filter-mapping>	
...
<!-- Dispatcher Servlet -->
<servlet>
	<servlet-name>dispatcher</servlet-name>
	<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
	<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
	<servlet-name>dispatcher</servlet-name>
	<url-pattern>/app/*</url-pattern>
</servlet-mapping>
...
<welcome-file-list>
	<welcome-file>redirect.jsp</welcome-file>
</welcome-file-list>
...

urlrewrite.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE urlrewrite PUBLIC "-//tuckey.org//DTD UrlRewrite 3.2//EN"
        "http://tuckey.org/res/dtds/urlrewrite3.2.dtd">
<urlrewrite default-match-type="wildcard">
	<rule>
		<from>/**</from>
		<to>/app/$1</to>
	</rule>
	<outbound-rule>
		<from>/app/**</from>
		<to>/$1</to>
	</outbound-rule>
</urlrewrite>

PageController.java

@RequestMapping(value="/page/{code}", method=RequestMethod.GET)
public ModelAndView showErrors(@ModelAttribute("user") User user, @PathVariable("code") String errorMessage)
{
...
}

[__dev18]

Hi __dev18 and eggsy84. Thank you very much for your help!
With your advice I have made it.

But there is still a problem.
My application context path is /ksw and is deployed to http://localhost:8080/ksw

In my *.jsp's I have some links which look like:

<script type="text/javascript" src="/ksw/js/script.js"></script>

These links are also not working. But the controllers are doing very well!
Unfortunately http://localhost:8080/ksw/j_spring_security_check ends up in error 404

Maybe it's because I use the following "form action" in "login.jsp"?

<form action="<c:url value='j_spring_security_check'/>" method="POST">

Hi, you need to add rules to urlrewrite filter xml for Spring Security Servelts. For example in your case you need to allow Spring Security handle url j_spring_security_check.

	<rule>
		<from>/j_spring_security_check**</from>
		<to>/j_spring_security_check$1</to>
	</rule>	
	<rule>
		<from>/logout**</from>
		<to>/logout$1</to>
	</rule>

[bennyn]

Ok, I did this but then my GlassFish v3 application server claims:

WARNING: No mapping found for HTTP request with URI [/ksw/app/j_spring_security_check] in DispatcherServlet with name 'dispatcher'

Here is my login.jsp:

<form action="<c:url value='j_spring_security_check'/>" method="POST">
...
</form>

And some lines from my applicationContext-security.xml:

<http access-denied-page="/accessDenied">
<intercept-url pattern="/app/page" access="ROLE_USER" />
<intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<http-basic />
<form-login login-page="/login" authentication-failure-url="/login/error" />
<logout />
</http>

Maybe you can see an error in it... I'm very new to these things.

[__dev18]

Ok, I did this but then my GlassFish v3 application server claims:


Here is my login.jsp:


And some lines from my applicationContext-security.xml:


Maybe you can see an error in it... I'm very new to these things.

What version of urlrewrite filter you are using now? And these rules must be before app rule.

In version 3.2 you need to add following xml rules:

	<rule>
		<from>/j_spring_security_check**</from>
		<to last="true">/j_spring_security_check$1</to>
	</rule>	
	<rule>
		<from>/logout**</from>
		<to last="true">/logout$1</to>
	</rule>

[bennyn]

I use version 3.2. With your configuration the Login works now!
I had to change the form action url in my login.jsp from:

<form action="<c:url value='j_spring_security_check'/>" method="POST">

To:

<form action="<c:url value='/ksw/j_spring_security_check'/>" method="POST">

The only things which are not working yet is the "Logout" and my JavaScripts and CSS from my JSPs.

Before using REST I always did the logout with the following url: http://localhost:8080/ksw/j_spring_security_logout
But this is not possible anymore. I always get the warning:

No mapping found for HTTP request with URI [/ksw/app/j_spring_security_logout] in DispatcherServlet with name 'dispatcher'

Things which I have linked in my JSPs with:

<script type="text/javascript" src="/ksw/js/prototype.js"></script>

Do also give a warning, e.g.:

No mapping found for HTTP request with URI [/ksw/app/js/prototype.js] in DispatcherServlet with name 'dispatcher'

My urlrewrite.xml is now:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE urlrewrite PUBLIC "-//tuckey.org//DTD UrlRewrite 3.2//EN"
"http://tuckey.org/res/dtds/urlrewrite3.2.dtd">
<urlrewrite default-match-type="wildcard">
<rule>
<from>/**</from>
<to>/app/$1</to>
</rule>
<outbound-rule>
<from>/app/**</from>
<to>/$1</to>
</outbound-rule>
<rule>
<from>/j_spring_security_check**</from>
<to last="true">/j_spring_security_check$1</to>
</rule>
<rule>
<from>/j_spring_security_logout**</from>
<to last="true">/j_spring_security_logout$1</to>
</rule>
</urlrewrite>

P.S. If we get the things work, then I will write an entry in my blog so that nobody else pulls his/her hair out.