Question

For learning purposes I simple Spring-hibernate application. It has one-to-many db associations, where you can add a Warehouse and for each warehouse you can add items. Now I wanted to add spring-security for authentification but when I try to access the site, I get the HTTP ERROR 404.

Here is spring-security par in web.xml:

<context-param>
   <param-name>contextConfigLocation</param-name>
   <param-value>
        /WEB-INF/spring-security.xml
   </param-value>
</context-param>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

Here is spring-security.xml :

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
                    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                    http://www.springframework.org/schema/security 
                    http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <http use-expressions="true">
        <intercept-url pattern="/record/**" access="permitAll" />
        <form-login />
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="admin" password="password" authorities="supervisor, teller, user" />
                <user name="dianne" password="emu" authorities="teller, user" />
                <user name="scott" password="wombat" authorities="user" />
                <user name="peter" password="opal" authorities="user" />
            </user-service>
        </authentication-provider>
    </authentication-manager>
</beans:beans>

If I change the access="permitAll" to `access=”hasRole(‘supervisor’)” When I try to access the application, I am asked to enter the username and password, but when I enter them, I also get the 404 error. Without spring-security the app works fine when I acces “http://localhost:8080/testapp/record/list” …
I used this site to learn about spring security – http://static.springsource.org/spring-security/site/tutorial.html

Here is my MainController:

@Controller
@RequestMapping("/record")
public class MainController {

    protected static Logger logger = Logger.getLogger("controller");

    @Resource(name="warehouseService")
     private WarehouseService warehouseService;

     @Resource(name="itemService")
     private ItemService itemService;

        @RequestMapping(value = "/list", method = RequestMethod.GET)
        public String getRecords(Model model) {
         logger.debug("Received request to show records page");

         // Retrieve all persons
         List<Warehouse> warehouses = warehouseService.getAll();

         // Prepare model object
         List<WarehouseDTO> warehousesDTO = new ArrayList<WarehouseDTO>();

         for (Warehouse warehouse: warehouses) {
          // Create new data transfer object
             WarehouseDTO dto = new WarehouseDTO();

       dto.setId(warehouse.getId());
       dto.setName(warehouse.getName());
       dto.setAddress(warehouse.getAddress());
       dto.setManager(warehouse.getManager());
       dto.setItems(itemService.getAll(warehouse.getId()));

       warehousesDTO.add(dto);
         }

         model.addAttribute("warehouses", warehousesDTO);

      return "records";
     }

Any ideas?

Answer 1

Try specifying a default-target-url in the form-login tag. I’m guessing your authenticating and Spring security is by default routing the request to the root of the application, which is not mapped causing a 404.

<form-login default-target-url="/record/list"/>

if this fails try (not sure how views are mapped):

<form-login default-target-url="/record/list/"/>