Question

I have an application that uses SwitchUserFilter. The switching and exiting works fine in normal cases, but if we give the exit url when the user has not actually switched, the user is logged out (expectedly), but when he tries to login again, the application tries to redirect him to the last page that he tried to access (i.e the switch user url).. where again, the user is found to have not switched, and so an error is thrown, the user is logged off, and so the cycle continues.

The following is my spring configuration file :

<?xml version="1.0" encoding="UTF-8"?>

<!-- - Sample namespace-based configuration - -->

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <global-method-security pre-post-annotations="enabled">
        <!-- AspectJ pointcut expression that locates our "post" method and applies 
            security that way <protect-pointcut expression="execution(* bigbank.*Service.post*(..))" 
            access="ROLE_TELLER"/> -->
    </global-method-security>

    <http use-expressions="true">
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <custom-filter after="FILTER_SECURITY_INTERCEPTOR" ref="switchUserProcessingFilter" />
        <form-login />
        <logout invalidate-session="true" logout-url="/do/logout" />
    </http>
    <!-- Usernames/Passwords are rod/koala dianne/emu scott/wombat peter/opal -->

    <authentication-manager>
        <authentication-provider>
            <user-service id="userService">
                <user name="rod" password="koala" authorities="supervisor, teller, user" />
                <user name="dianne" password="emu" authorities="teller, user" />
                <user name="scott" password="wombat" authorities="user" />
                <user name="peter" password="opal" authorities="user" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

    <beans:bean id="switchUserProcessingFilter"
        class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter">

        <beans:property name="userDetailsService" ref="userService">

        </beans:property>
        <beans:property name="switchUserUrl" value="/switchUser" />
        <beans:property name="exitUserUrl" value="/exitUser" />
        <beans:property name="targetUrl" value="/index.jsp" />
    </beans:bean>

</beans:beans>

Any suggestions as to how can I handle it ?

A practical case could be when I have switched the user, and the session times out. Not knowing that the session has timed out, the user tries to click on the ‘exit user’ url, which then redirects him to the login page, and the above cycle continues.

Answer 1

As mentioned in this thread, I implemented a custom login success handler, mimicking SavedRequestAwareAuthenticationSuccessHandler, which is the default login success handler. It
retrieves the url that we tried to access before being redirected to the login page from the request cache (where it was stored by ExceptionTranslationFilter, on seeing that we weren’t authenticated) and redirects to that url. I simply configured it to go to the root url when it encountered something like ‘exitUser‘