Databases
StackOverflow2013
Postsdbo
POSpring Security Configuration Leads to Perpetual Authentication Request
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSpring Security Configuration Leads to Perpetual Authentication Request
    text
    copied!<p>I have configured my web application with the following config file:</p> <pre><code> &lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt; &lt;security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" /&gt; &lt;!-- Filter chain; this is referred to from the web.xml file. Each filter is defined and configured as a bean later on. --&gt; &lt;!-- Note: anonumousProcessingFilter removed. --&gt; &lt;bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"&gt; &lt;security:filter-chain-map path-type="ant"&gt; &lt;security:filter-chain pattern="/**" filters="securityContextPersistenceFilter, basicAuthenticationFilter, exceptionTranslationFilter, filterSecurityInterceptor" /&gt; &lt;/security:filter-chain-map&gt; &lt;/bean&gt; &lt;!-- This filter is responsible for session management, or rather the lack thereof. --&gt; &lt;bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"&gt; &lt;property name="securityContextRepository"&gt; &lt;bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"&gt; &lt;property name="allowSessionCreation" value="false" /&gt; &lt;/bean&gt; &lt;/property&gt; &lt;/bean&gt; &lt;!-- Basic authentication filter. --&gt; &lt;bean id="basicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter"&gt; &lt;property name="authenticationManager" ref="authenticationManager" /&gt; &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint" /&gt; &lt;/bean&gt; &lt;!-- Basic authentication entry point. --&gt; &lt;bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint"&gt; &lt;property name="realmName" value="Ayudo Web Service" /&gt; &lt;/bean&gt; &lt;!-- An anonymous authentication filter, which is chained after the normal authentication mechanisms and automatically adds an AnonymousAuthenticationToken to the SecurityContextHolder if there is no existing Authentication held there. --&gt; &lt;!-- &lt;bean id="anonymousProcessingFilter" class="org.springframework.security.web.authentication.AnonymousProcessingFilter"&gt; &lt;property name="key" value="ayudo" /&gt; &lt;property name="userAttribute" value="anonymousUser, ROLE_ANONYMOUS" /&gt; &lt;/bean&gt; --&gt; &lt;!-- Authentication manager that chains our main authentication provider and anonymous authentication provider. --&gt; &lt;bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"&gt; &lt;property name="providers"&gt; &lt;list&gt; &lt;ref local="daoAuthenticationProvider" /&gt; &lt;ref local="inMemoryAuthenticationProvider" /&gt; &lt;!-- &lt;ref local="anonymousAuthenticationProvider" /&gt; --&gt; &lt;/list&gt; &lt;/property&gt; &lt;/bean&gt; &lt;!-- Main authentication provider; in this case, memory implementation. --&gt; &lt;bean id="inMemoryAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt; &lt;property name="userDetailsService" ref="propertiesUserDetails" /&gt; &lt;/bean&gt; &lt;security:user-service id="propertiesUserDetails" properties="classpath:operators.properties" /&gt; &lt;!-- Main authentication provider. --&gt; &lt;bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt; &lt;property name="userDetailsService" ref="userDetailsService" /&gt; &lt;/bean&gt; &lt;!-- An anonymous authentication provider which is chained into the ProviderManager so that AnonymousAuthenticationTokens are accepted. --&gt; &lt;!-- &lt;bean id="anonymousAuthenticationProvider" class="org.springframework.security.authentication.AnonymousAuthenticationProvider"&gt; &lt;property name="key" value="ayudo" /&gt; &lt;/bean&gt; --&gt; &lt;bean id="userDetailsService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl"&gt; &lt;property name="dataSource" ref="dataSource" /&gt; &lt;/bean&gt; &lt;bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt; &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint" /&gt; &lt;property name="accessDeniedHandler"&gt; &lt;bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl" /&gt; &lt;/property&gt; &lt;/bean&gt; &lt;bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"&gt; &lt;property name="securityMetadataSource"&gt; &lt;security:filter-security-metadata-source use-expressions="true"&gt; &lt;security:intercept-url pattern="/*.html" access="permitAll" /&gt; &lt;security:intercept-url pattern="/version" access="permitAll" /&gt; &lt;security:intercept-url pattern="/users/activate" access="permitAll" /&gt; &lt;security:intercept-url pattern="/**" access="isAuthenticated()" /&gt; &lt;/security:filter-security-metadata-source&gt; &lt;/property&gt; &lt;property name="authenticationManager" ref="authenticationManager" /&gt; &lt;property name="accessDecisionManager" ref="accessDecisionManager" /&gt; &lt;/bean&gt; &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"&gt; &lt;property name="decisionVoters"&gt; &lt;list&gt; &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt; &lt;bean class="org.springframework.security.web.access.expression.WebExpressionVoter" /&gt; &lt;/list&gt; &lt;/property&gt; &lt;/bean&gt; </code></pre> <p></p> <p>As soon as I run my application on tomcat, I get a request for username/password basic authentication dialog. Even when I try to access: localhost:8080/myapp/version, which is explicitly set to permitAll, I get the authentication request dialog. Help!</p> <p>Thank, Sammy</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload