IllegalStateException from call to response.sendRedirect in successfulAuthentication
Hello!
I have upgraded to Security 3.0.2, and ended up with the following issue: when I place a call to response.sendRedirect() from inside the method successfulAuthentication() - in UsernamePasswordAuthenticationFilter - I receive an IllegalStateException and the system redirects to the default successful authentication page.
My requirement is that when user successfully authenticate, I must redirect him to a page according to a certain condition, and if that condition is false, I must redirect him to another page. That used to work before moving to Spring Security 3.0.
Here is relevant part of my applicationContext-Security.xml:
Code:<beans:beans ... > <security:http entry-point-ref="myAuthenticationEntryPoint" auto-config="false"> ... <security:custom-filter position="FORM_LOGIN_FILTER" ref="authenticationProcessingFilter"/> </security:http> <security:authentication-manager alias="authenticationManager"> <security:authentication-provider ref="MyCustomAuthenticationProvider"/> </security:authentication-manager> <beans:bean id="MyCustomAuthenticationProvider" class="br.com.smartnet.vrben.portal.security.CustomAuthenticationProvider"> <beans:property name="locator"> <beans:bean class="br.com.smartnet.vrben.portal.locator.ServiceLocator" /> </beans:property> </beans:bean> <beans:bean id="myAuthenticationEntryPoint" class="br.com.smartnet.vrben.portal.security.CustomAuthenticationEntryPoint" > <beans:property name="loginFormUrl" value="/index.html" /> <beans:property name="forceHttps" value="false" /> </beans:bean> <beans:bean id="authenticationProcessingFilter" class="br.com.smartnet.vrben.portal.security.CustomAuthenticationProcessingFilter"> <beans:property name="authenticationManager" ref="authenticationManager" /> <beans:property name="authenticationFailureHandler" ref="failureHandler" /> <beans:property name="authenticationSuccessHandler" ref="successHandler" /> <beans:property name="sessionAuthenticationStrategy" ref="sessionFixationProtectionStrategy"/> <beans:property name="filterProcessesUrl" value="/j_spring_security_check" /> <beans:property name="locator"> <beans:bean class="br.com.smartnet.vrben.portal.locator.ServiceLocator" /> </beans:property> </beans:bean> <beans:bean id="successHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler" > <beans:property name="defaultTargetUrl" value="/index.html" /> </beans:bean> <beans:bean id="failureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler" > <beans:property name="defaultFailureUrl" value="/index.html?authfailed=true" /> </beans:bean> <beans:bean id="sessionFixationProtectionStrategy" class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"> <beans:property name="migrateSessionAttributes" value="true" /> </beans:bean> </beans:beans>
Here is the relevant part of my CustomAuthenticationProcessingFilter, which extends UsernamePasswordAuthenticationFilter:
And here is the log of the error thrown:Code:@Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) throws IOException, ServletException { logger.info("login successful: " + authResult.getDetails()); super.successfulAuthentication(request, response, authResult); // if user is a member of ROLE_PATROCINADOR, redirects them // to the sponsor's page if(isUserPatrocinador(request)) { logger.info("redirecting to the patrocinador's page: " + request.getContextPath() + PATROCINADOR_VIEW); response.sendRedirect(response.encodeRedirectURL(request.getContextPath() + PATROCINADOR_VIEW)); } else { Usuario usuario = recuperarUsuarioLogado(); if( usuario != null ){ try { List<Programa> programas = locator.getProgramaInterface().selecionarProgramasdoBeneficiario(usuario.getChave()); String redirectUrl = request.getContextPath(); if( programas.size() == 1 ){ //if size == 1 redirect to another URL Programa programa = programas.iterator().next(); String codPrograma = programa.getCodigoPrograma(); redirectUrl = redirectUrl + PROGRAMA_VIEW + "?idPrograma=" + codPrograma; } else { redirectUrl = redirectUrl + MEUS_PROGRAMAS_VIEW; } String encodedUrl = response.encodeRedirectURL( redirectUrl ); response.sendRedirect( encodedUrl ); ==> HERE IS WHERE THE PROBLEM HAPPENS } catch (Exception e) { logger.error("Erro ao tentar realizar o redirecionamento do usuario autenticado." + e.getMessage(), e); logger.error("Causa: " + e.getCause().getMessage() + " - Redirecionando para a página principal."); response.sendRedirect(response.encodeRedirectURL(request.getContextPath() + MAIN_VIEW)); } } } }
Appreciate any help. Thanks IN ADVANCE!!!Code:[07/04/10 19:47:53:172 BRT] 00000025 SystemOut O 19:47:53,172 INFO CustomAuthenticationProcessingFilter,WebContainer : 3:41 - login successful: org.springframework.security.web.authentication.WebAuthenticationDetails@fffe3f86: RemoteIpAddress: 127.0.0.1; SessionId: gUraxa6NbqE2z3JxEe6qF6V [07/04/10 19:47:53:188 BRT] 00000025 SystemOut O 19:47:53,188 INFO ERROR CustomAuthenticationProcessingFilter,WebContainer : 3:80 - Error while trying to redirect authenticated user: null java.lang.IllegalStateException at com.ibm.ws.webcontainer.webapp.WebAppDispatcherContext.sendRedirectWithStatusCode(WebAppDispatcherContext.java:484) at com.ibm.ws.webcontainer.webapp.WebAppDispatcherContext.sendRedirect(WebAppDispatcherContext.java:441) at com.ibm.ws.webcontainer.srt.SRTServletResponse.sendRedirect(SRTServletResponse.java:1036) at javax.servlet.http.HttpServletResponseWrapper.sendRedirect(HttpServletResponseWrapper.java:170) at org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper.sendRedirect(SaveContextOnUpdateOrErrorResponseWrapper.java:74) at br.com.xxx.yyy.portal.security.CustomAuthenticationProcessingFilter.successfulAuthentication(CustomAuthenticationProcessingFilter.java:75) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:219) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:109) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:149) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167) at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:190) at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:130) at com.ibm.ws.webcontainer.filter.WebAppFilterChain._doFilter(WebAppFilterChain.java:87) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:834) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:744) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:697) at com.ibm.ws.wswebcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:118) at com.ibm.ws.webcontainer.extension.DefaultExtensionProcessor.invokeFilters(DefaultExtensionProcessor.java:818) at com.ibm.ws.webcontainer.extension.DefaultExtensionProcessor.handleRequest(DefaultExtensionProcessor.java:768) at com.ibm.ws.wswebcontainer.extension.DefaultExtensionProcessor.handleRequest(DefaultExtensionProcessor.java:113) at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:3440) at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:267) at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:815) at com.ibm.ws.wswebcontainer.WebContainer.handleRequest(WebContainer.java:1461) at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:118) at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:458) at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewInformation(HttpInboundLink.java:387) at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:267) at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.sendToDiscriminators(NewConnectionInitialReadCallback.java:214) at ...
Anyone
Originally Posted by Luke Taylor
