Security taglibs in jsp Tiles pages

[bartoszn]

Hi,

In my web app deployed on jboss 6 I use Spring 3 and Tiles 2.2.1.
I'd like to add some spring -security(2.0.4) features.
What I want to know is there any constraints on using spring-security tags in jsp tiles pages?

Up to now each attempt of adding security:authorize tag, to secure menu links, ends with exception (org.apache.tiles.util.TilesIOException: JSPException including path '/WEB-INF/common/menu.jsp') or tag is not interpreted at all.

[pmularien]

No, provided you know how to set things up properly, they work fine. I have written an app exactly like this in the past.

[vw729]

I use Spring MVC with JSP front end, Spring Security 3.0 and Tiles for a project. I haven't note any issues on Tiles and SS tags.

[bartoszn]

Ok, so it probably my mistake.
Can you give me some tips and explain where did I go wrong?
As i said before I use:

• spring 3.0.2
• tiles 2.2.1
• spring-security 2.0.4
• and jboss6

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
         http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
            /WEB-INF/applicationContext-security.xml
        </param-value>
	</context-param>

	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<servlet>
		<servlet-name>pintweb</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>

	<servlet-mapping>
		<servlet-name>pintweb</servlet-name>
		<url-pattern>*.htm</url-pattern>
	</servlet-mapping>

	<welcome-file-list>
		<welcome-file>
      index.jsp
    </welcome-file>
	</welcome-file-list>
	<jsp-config>
		<taglib>
			<taglib-uri>/spring-form</taglib-uri>
			<taglib-location>/WEB-INF/tld/spring-form.tld</taglib-location>
		</taglib>
		<taglib>
			<taglib-uri>/spring</taglib-uri>
			<taglib-location>/WEB-INF/tld/spring.tld</taglib-location>
		</taglib>
		<taglib>
			<taglib-uri>/security</taglib-uri>
			<taglib-location>/WEB-INF/tld/security.tld</taglib-location>
		</taglib>
	</jsp-config>
</web-app>

spring-mvc config file: pint-servlet.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mvc="http://www.springframework.org/schema/mvc"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd">

	<!-- Configures the @Controller programming model -->
	<mvc:annotation-driven />
	<context:component-scan base-package="pl.bniemczyk.pint.controller"
		annotation-config="true" use-default-filters="true" />
	
<bean id="tilesConfigurer" class="org.springframework.web.servlet.view.tiles2.TilesConfigurer">
		<property name="definitions">
			<list>
				<value>/WEB-INF/tiles-def.xml</value>
			</list>
		</property>
	</bean>
	<bean id="viewResolver"
		class="org.springframework.web.servlet.view.UrlBasedViewResolver">
		<property name="viewClass"
			value="org.springframework.web.servlet.view.tiles2.TilesView"></property>
	</bean>

</beans>

tiles-def.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE tiles-definitions PUBLIC
       "-//Apache Software Foundation//DTD Tiles Configuration 2.1//EN"
       "http://tiles.apache.org/dtds/tiles-config_2_1.dtd">
<tiles-definitions>
	<definition name="base.layout" template="/WEB-INF/common/layout.jsp">
		<put-attribute name="header" value="/WEB-INF/common/page-header.jsp" />
		<put-attribute name="content" value="${content}" />
		<put-attribute name="footer" value="/WEB-INF/common/page-footer.jsp" />
		<put-attribute name="info" value="/WEB-INF/common/general.jsp" />
		<put-attribute name="menu" value="/WEB-INF/common/menu.jsp" />
	</definition>

	<definition name="hello" extends="base.layout">
		<put-attribute name="content" value="/WEB-INF/jsp/hello.jsp" />
	</definition>

	<definition name="nomenu.layout" template="/WEB-INF/common/layout-no-menu.jsp">
		<put-attribute name="header" value="/WEB-INF/common/page-header.jsp" />
		<put-attribute name="content" value="${content}" />
		<put-attribute name="footer" value="/WEB-INF/common/page-footer.jsp" />
	</definition>
	
	<definition name="login" extends="nomenu.layout">
		<put-attribute name="content" value="/WEB-INF/jsp/login.jsp" />
	</definition>

</tiles-definitions>

tiles layout: layout.jsp

<%@ page contentType="text/html; charset=utf-8" language="java"%>
<%@taglib uri="http://tiles.apache.org/tags-tiles" prefix="tiles" %>

<html>
	<head>
		<%@ include file="/WEB-INF/common/define-meta.jsp"%>
		<%@ include file="/WEB-INF/common/define-page.jsp"%>
	</head>

	<body>

		<table border='0' width='100%' height='100%' cellpadding='0'
			cellspacing='0'>
			<thead>
				<tr>
					<td height="1">
						<tiles:insertAttribute name="header" />
						<tiles:insertAttribute name="menu" />
						<tiles:insertAttribute name="info" />
                    </td>
				</tr>
			</thead>
			<tfoot>
				<tr valign="top">
					<td height="1">
						<tiles:insertAttribute name="footer"  />
					</td>
				</tr>
			</tfoot>
			<tbody>
				<tr align='left' valign='top'>
					<td class="page-offset">
						<tiles:insertAttribute name="content" />
					</td>
				</tr>
			</tbody>
		</table>

	</body>

</html>

menu.jsp

<%@taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
<div id="menu">
	<ul>
		<li>
			<a href="">One</a>
			<ul class="one">
				<security:authorize ifAnyGranted="ROLE_ADMIN">
					<li>
						<a href="">one-one</a>
					</li>
				
				</security:authorize>
				
				<li>
					<a href="">one-two</a>
				</li>
				<li>
					<a href="">one-three</a>
				</li>
				<li>
					<a href="">one-four</a>
				</li>
				<li>
					<a href="">one-five</a>
				</li>
			</ul>
		</li>
	</ul>
</div>

When I put SS taglib definition in menu.jsp and after daploy it and enter the page exception is being thrown.

org.apache.tiles.util.TilesIOException: JSPException including path '/WEB-INF/common/menu.jsp'.
org.apache.tiles.servlet.context.ServletUtil.wrapServletException(ServletUtil.java:241)
(....)
root cause

java.lang.NullPointerException
	org.apache.jasper.compiler.Parser.parseBody(Parser.java:1590)
	org.apache.jasper.compiler.Parser.parseOptionalBody(Parser.java:972)

But when I put SS taglib def in another place (e.g layout.jsp) tag is not interpreted.

I will be grateful for your help.

[vw729]

Ok, so it probably my mistake.
Can you give me some tips and explain where did I go wrong?

I will be grateful for your help.

I use Spring 3 + Spring Security 3 + Tiles 2.x. The SS 3 is quite different from SS 2.x. with the code you presented, I can't tell the cause of the null pointer exception.

[bartoszn]

The SS 3 is quite different from SS 2.x. with the code you presented,

At this stage I can upgrade app to SS 3.x. Do you have any tutorial example?

[pmularien]

That error stack trace looks like some kind of Jasper/JspC error and not related to the taglib. Have you been able to isolate what causes it?