java - Spring security without spring mvc -
i trying implement spring security without using spring mvc,
below snippets
web.xml
<?xml version="1.0" encoding="utf-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemalocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_5.xsd" id="webapp_id" version="2.5"> <display-name>cxf</display-name> <welcome-file-list> <welcome-file>/web-inf/dcd-html/index.jsp</welcome-file> </welcome-file-list> <init-param> <param-name>javax.ws.rs.core.application</param-name> <param-value>images</param-value> </init-param> <filter> <filter-name>springsecurityfilterchain</filter-name> <filter-class>org.springframework.web.filter.delegatingfilterproxy</filter-class> </filter> <filter-mapping> <filter-name>springsecurityfilterchain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <listener> <listener-class>org.springframework.web.context.contextloaderlistener</listener-class> </listener> <filter> <filter-name>cors</filter-name> <filter-class>com.thetransactioncompany.cors.corsfilter</filter-class> <init-param> <param-name>cors.supportedmethods</param-name> <param-value>get, post, head, put, delete</param-value> </init-param> </filter> <filter-mapping> <filter-name>cors</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <listener> <listener-class> org.springframework.web.context.request.requestcontextlistener </listener-class> </listener> <servlet> <servlet-name>cxf</servlet-name> <description>apache cxf endpoint</description> <servlet-class>org.apache.cxf.transport.servlet.cxfservlet</servlet-class> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>cxf</servlet-name> <url-pattern>/*</url-pattern> </servlet-mapping> <session-config> <session-timeout>60</session-timeout> </session-config> <servlet> <servlet-name>javax.ws.rs.core.application</servlet-name> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>javax.ws.rs.core.application</servlet-name> <url-pattern>/images/*</url-pattern> </servlet-mapping> <servlet> <servlet-name>applicationcontext</servlet-name> <servlet-class>org.springframework.web.servlet.dispatcherservlet</servlet-class> <init-param> <param-name>contextconfiglocation</param-name> <param-value>/web-inf/applicationcontext.xml</param-value> </init-param> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>applicationcontext</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> </web-app> applicationcontext.xml
<?xml version="1.0" encoding="utf-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xmlns:jaxrs="http://cxf.apache.org/jaxrs" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns:jee="http://www.springframework.org/schema/jee" xmlns:lang="http://www.springframework.org/schema/lang" xmlns:p="http://www.springframework.org/schema/p" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:util="http://www.springframework.org/schema/util" xmlns:mail="http://www.springframework.org/schema/integration/mail" xmlns:int="http://www.springframework.org/schema/integration" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://cxf.apache.org/bindings/soap http://cxf.apache.org/schemas/configuration/soap.xsd http://cxf.apache.org/jaxrs http://cxf.apache.org/schemas/jaxrs.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd http://www.springframework.org/schema/lang http://www.springframework.org/schema/lang/spring-lang.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd http://www.springframework.org/schema/integration/mail http://www.springframework.org/schema/tx/spring-tx-3.1.xsd http://www.springframework.org/schema/integration/mail/spring-integration-mail-2.1.xsd"> <context:annotation-config /> <context:component-scan base-package="com.smart.city.*"></context:component-scan> <import resource="/spring/securitycontext.xml" /> </beans> securitycontext.xml
<?xml version="1.0" encoding="utf-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xmlns:security="http://www.springframework.org/schema/security" xmlns:context="http://www.springframework.org/schema/context" xsi:schemalocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> <security:http auto-config="false" use-expressions="true"> <security:intercept-url pattern="/**" access="hasrole('priv_admin')" /> <security:http-basic /> <security:form-login login-page="/login" authentication-failure-handler-ref="loginfailurehandler" authentication-success-handler-ref="loginsuccesshandler" /> <!-- <security:logout logout-success-url="/logout.htm" logout-url="/j_spring_security_logout" invalidate-session="true"/> --> </security:http> <security:authentication-manager> <security:authentication-provider user-service-ref="userdetailsservicetx"> <security:password-encoder ref="custompasswordencoder" /> </security:authentication-provider> </security:authentication-manager> </beans> my problem if use login-page="/login" not getting redirected jsp, , if dont use attribute, can see spring's default log in page.
please assist.
there 2 things wrong configuration:
- you redirecting
/loginhighly doubt there mapping. - you have protected urls hence login page, current solution finish in redirect loop.
first change login-page property /login.jsp redirected login page.
<security:form-login login-page="/login.jsp" authentication-failure-handler-ref="loginfailurehandler" authentication-success-handler-ref="loginsuccesshandler" /> secondly permit access /login.jsp prevent redirect loop.
<security:intercept-url pattern="/login.jsp" access="permitall" /> another suggestion, free of charge, aren't using spring mvc don't need dispatcherservlet, reloads beans , loading application twice.
Comments
Post a Comment