Databases
StackOverflow2013
Postsdbo
POSpring security blocking all requests
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSpring security blocking all requests
    text
    copied!<p>I'm in the process of trying to setup database user authentication with Spring 3. Now using the Spring included login form thing:</p> <pre><code>&lt;form action="&lt;c:url value="/j_spring_security_check" /&gt;" method="POST"&gt; &lt;fieldset&gt; &lt;input name="j_username" type="text" placeholder="name" autofocus="autofocus" /&gt;&lt;br/&gt; &lt;input name="j_password" type="password" placeholder="password" /&gt;&lt;br/&gt; &lt;input type="submit" value="Login" /&gt; &lt;/fieldset&gt; &lt;/form&gt; </code></pre> <p>According to the logs (logging from my userService class that implements Spring UserDetailsService interface) this is resulting in a user being fetched from the database and roles assigned (using UserDetails.toString to view in logs).</p> <p>When I hit an application URL I get sent to the login page correctly. I log in and regardless of URL I get redirected to my accessDenied page. Am I doing something wrong in my security config setup?</p> <p>My security config follows: (Removed refs to schema etc so I was allowed to post - they got picked up as URLs!) </p> <pre><code> &lt;global-method-security pre-post-annotations="enabled"&gt;&lt;/global-method-security&gt; &lt;http auto-config="true" create-session="ifRequired" use-expressions="true" access-denied-page="/accessDenied"&gt; &lt;logout invalidate-session="true" logout-success-url="/loggedOut" /&gt; &lt;anonymous/&gt; &lt;form-login login-page="/login" authentication-failure-url="/login"/&gt; &lt;intercept-url pattern="/reports/**" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/routes" method="GET" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/data/routes" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/routes" method="POST" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/routes" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/route/**" method="GET" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/data/route/**" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/route/**" method="POST" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/route/**" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/patrolsummaries" method="GET" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/data/patrolsummaries" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/patrolsummaries" method="POST" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/patrolsummaries" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/patrolsummary/**" method="GET" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/data/patrolsummary/**" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/patrolsummary/**" method="POST" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/patrolsummary/**" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/guards" method="GET" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/data/guards" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/guards" method="POST" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/guards" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/guard/**" method="GET" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/data/guard/**" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/guard/**" method="POST" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/data/guard/**" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/include/js/pages/admin/**" access="hasRole('ROLE_ADMIN')" /&gt; &lt;intercept-url pattern="/include/js/pages/all.js" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/include/js/pages/**" access="hasRole('ROLE_REPORTS')" /&gt; &lt;intercept-url pattern="/include/js/**" access="hasRole('ROLE_ANONYMOUS')" /&gt; &lt;intercept-url pattern="/public/**" filters="none"/&gt; &lt;intercept-url pattern="/login" filters="none"/&gt; &lt;intercept-url pattern="/loggedOut" filters="none"/&gt; &lt;intercept-url pattern="/include/css/**" filters="none"/&gt; &lt;intercept-url pattern="/include/img/**" filters="none"/&gt; &lt;intercept-url pattern="/include/**" access="hasRole('ROLE_REPORTS')" /&gt; &lt;/http&gt; &lt;beans:import resource="hibernate-context.xml" /&gt; &lt;context:component-scan base-package="uk.co.romar.guardian.services" /&gt; &lt;beans:bean id="userService" class="uk.co.romar.guardian.services.UserServiceImpl" /&gt; &lt;beans:bean id="pwdEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" /&gt; &lt;!-- &lt;beans:bean id="saltSource" class="??"/&gt; --&gt; &lt;authentication-manager alias="authenticationManager"&gt; &lt;authentication-provider user-service-ref="userService"&gt; &lt;/authentication-provider&gt; &lt;/authentication-manager&gt; &lt;/beans:beans&gt; </code></pre>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload