Question

I try to secure my struts 2 application with Spring Security 3.0.5.

I declare this in the web.xml :

      <!-- Tiles --> 
  <context-param> 
    <param-name> org.apache.tiles.impl.BasicTilesContainer.DEFINITIONS_CONFIG </param-name> 
    <param-value>/WEB-INF/conf/tiles.xml</param-value> 
  </context-param> 
  <listener> 
    <listener-class>org.apache.struts2.tiles.StrutsTilesListener</listener-class> 
  </listener> 

<!-- Files defining SPRING ApplicationContext -->   
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/conf/spring-security.xml,/WEB-INF/conf/application.xml</param-value>
    </context-param>

    <context-param>
        <param-name>locatorFactorySelector</param-name>
        <param-value>classpath:/model/config/beans.xml</param-value>
    </context-param>
    <context-param>
        <param-name>parentContextKey</param-name>
        <param-value>context</param-value>
    </context-param>

    <!-- Filter for security -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Struts 2 --> 
  <filter> 
    <filter-name>struts2</filter-name> 
    <filter-class>org.apache.struts2.dispatcher.FilterDispatcher</filter-class> 
  </filter> 
  <filter-mapping> 
    <filter-name>struts2</filter-name> 
    <url-pattern>/*</url-pattern> 
  </filter-mapping> 
     <!-- Spring --> 


    <!-- Open session filter - binds a Hibernate Session to the thread for the entire processing of the request  -->
    <filter>
        <filter-name>HibernateFilter</filter-name>
        <filter-class>org.springframework.orm.hibernate3.support.OpenSessionInViewFilter</filter-class>
        <init-param>
              <param-name>sessionFactoryBeanName</param-name> 
              <param-value>hibernateSessionFactory</param-value>
        </init-param>
    </filter>

        <!-- Filter for Character Encoding -->
    <filter>
        <filter-name>CharacterEncodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
    </filter>


    <!-- Mapping for pages to filter -->
    <filter-mapping>
        <filter-name>HibernateFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>CharacterEncodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>


<listener>
   <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
        <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>


  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
  </welcome-file-list>

Then in my struts.xml:

<struts> 
  <!-- internationalisation --> 
  <constant name="struts.custom.i18n.resources" value="messages" /> 
  <!-- intégration Spring --> 
  <constant name="struts.objectFactory.spring.autoWire" value="name" />

  <package name="searchMandate" namespace="/search" extends="struts-default, tiles-default"> 
   <action name="MandateSearchActionInit"  class="web.action.mandate.SearchAction" method="initSearch"> 
      <result name="input" type="tiles">search</result> 
      <result name="success" type="tiles">search</result> 
    </action> 
    </package>
     <package name="userProfile" namespace="/profile" extends="struts-default, tiles-default"> 
        <action name="ChangeProfileInit"  class="web.action.user.ProfileAction" method="loadProfile"> 
           <result name="input" type="tiles">updateProfile</result> 
         </action> 
    </package>
</struts> 

My spring-security.xml :

     <beans:bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
        <filter-chain-map path-type="ant">
            <filter-chain pattern="/**" filters="sif"/>
        </filter-chain-map>
    </beans:bean>

    <http use-expressions="true">
        <intercept-url pattern="/profile*" access="isAuthenticated()" />
        <intercept-url pattern="/search*" access="hasRole('SEARCH')"/>
        <form-login login-page="/login" default-target-url="/welcome"
            authentication-failure-url="/loginfailed" />
        <logout logout-success-url="/logout" />
    </http>



    <authentication-manager>
        <authentication-provider>
            <password-encoder ref="passwordEncoder" />
            <jdbc-user-service data-source-ref="dataSource"

                users-by-username-query="
                    select login,password, isactive 
                    from tuser where LOGIN=?" 

                authorities-by-username-query="
                    select u.login, ur.name from tuser u,tgroup g, trolegroup rg, trole ur 
                    where u.groupid = g.groupid and g.groupid=rg.groupid and rg.roleid=ur.roleid and u.login =?  " 

            />
        </authentication-provider>
    </authentication-manager>

I thought the security were in place reading “INFO 20-10 23:26:55,620 – Creating access control expression attribute ‘hasRole(‘SEARCH’)’ for /search*” as server startup. But when I access search/MandateSearchActionInit url, I go to the action without having been routed to the login page.
Has somebody the key?

Answer 1

In fact the intercept-url patterns were wrong.
For example for the search path the syntax should be :

<intercept-url pattern="/search/**" access="hasRole('SEARCH')"/>

No link with struts2 (spring security secures url and has no matter of what is behind).