Question

I just started to read on Spring Security 3.1 and I would like to know how I can enforce user to authenticate through my login page before accessing any pages on my system. On a tutorial I see the following code

<http use-e xpressions="true">
    <intercept-url pattern="/index.jsp" access="permitAll" />
    <intercept-url pattern="/secure/extreme/**" access="hasRole('supervisor')" />
    <intercept-url pattern="/secure/**" access="isAuthenticated()" />
    <intercept-url pattern="/listAccounts.html" access="isAuthenticated()" />
    <intercept-url pattern="/post.html" access="hasAnyRole('supervisor','teller')" />
    <intercept-url pattern="/**" access="denyAll" />
    <form-login />
</http>

From the above configuration I can see that I have to maintain the list of url pattern. Is there a way to simplify this that every user has to login through “/login” before can access any other page ?

EDIT:

I have edited my configuration as below and its working as I expected

<http auto-config="true" use-expressions="true">
    <intercept-url pattern="/login" access="permitAll" />
    <intercept-url pattern="/loginfailed" access="permitAll" />
    <intercept-url pattern="/logout" access="permitAll" />
    <form-login login-page="/login" default-target-url="/welcome"
        authentication-failure-url="/loginfailed" />
    <logout logout-success-url="/login" />
    <intercept-url pattern="/**" access="isAuthenticated()" />
</http>

Answer 1

The url rules are inspected in order, top to bottom. The first one that matches is the one that is used.

In this example, the last line

<intercept-url pattern="/**" access="denyAll" />

Is the “catch all” rule. It applies to all requests (“/**”) that didn’t match any of the rules above it.

In it’s current form, it denies access to everyone, regardless. If you change it to

<intercept-url pattern="/**" access="isAuthenticated()" />

instead, it will required authentication to all pages unless otherwise specified, which will cause spring security to redirect unauthenticated users to the login process.