{"id":16842,"date":"2013-05-15T10:00:33","date_gmt":"2013-05-15T07:00:33","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/?p=16842"},"modified":"2013-09-04T00:13:01","modified_gmt":"2013-09-03T21:13:01","slug":"spring-security-login","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2013\/05\/spring-security-login.html","title":{"rendered":"Spring Security Login"},"content":{"rendered":"

1. Introduction<\/h2>\n

This article is going to focus on Login with Spring Security<\/strong>. We\u2019re going to built on top of the simple previous Spring MVC example<\/a>, as that\u2019s a necessary part of setting up the web application along with the login mechanism.<\/p>\n

2. The Maven Dependencies<\/h2>\n

To add Maven dependencies to the project, please see the Spring Security with Maven article<\/a>. Both standard spring-security-web<\/em> and spring-security-config<\/em> will be required.<\/p>\n

3. The web.xml<\/em><\/h2>\n

The Spring Security configuration in the web.xml<\/em> is simple \u2013 only an additional filter added to the standard Spring MVC web.xml<\/em>:\u00a0<\/em><\/p>\n

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<web-app xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\r\n   xmlns=\"http:\/\/java.sun.com\/xml\/ns\/javaee\" \r\n   xmlns:web=\"http:\/\/java.sun.com\/xml\/ns\/javaee\/web-app_3_0.xsd\"\r\n   xsi:schemaLocation=\"\r\n      http:\/\/java.sun.com\/xml\/ns\/javaee \r\n      http:\/\/java.sun.com\/xml\/ns\/javaee\/web-app_3_0.xsd\" \r\n   id=\"WebApp_ID\" version=\"3.0\">\r\n\r\n   <display-name>Spring Secured Application<\/display-name>\r\n\r\n   <!-- Spring MVC -->\r\n   <servlet>\r\n      <servlet-name>mvc<\/servlet-name>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <servlet-class>org.springframework.web.servlet.DispatcherServlet<\/servlet-class>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <load-on-startup>1<\/load-on-startup>\r\n\u00a0\u00a0 <\/servlet>\r\n\u00a0\u00a0 <servlet-mapping>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <servlet-name>mvc<\/servlet-name>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <url-pattern>\/<\/url-pattern>\r\n\u00a0\u00a0 <\/servlet-mapping>\r\n\r\n   <context-param>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <param-name>contextClass<\/param-name>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <param-value>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 org.springframework.web.context.support.AnnotationConfigWebApplicationContext\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <\/param-value>\r\n\u00a0\u00a0 <\/context-param>\r\n\u00a0\u00a0 <context-param>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <param-name>contextConfigLocation<\/param-name>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <param-value>org.baeldung.spring.web.config<\/param-value>\r\n\u00a0\u00a0 <\/context-param>\r\n\u00a0\u00a0 <listener>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <listener-class>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 org.springframework.web.context.ContextLoaderListener\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 <\/listener-class>\r\n\u00a0\u00a0 <\/listener>\r\n\r\n   <!-- Spring Security -->\r\n   <filter>\r\n      <filter-name>springSecurityFilterChain<\/filter-name>\r\n      <filter-class>org.springframework.web.filter.DelegatingFilterProxy<\/filter-class>\r\n   <\/filter>\r\n   <filter-mapping>\r\n      <filter-name>springSecurityFilterChain<\/filter-name>\r\n      <url-pattern>\/*<\/url-pattern>\r\n   <\/filter-mapping>\r\n\r\n<\/web-app><\/pre>\n
The filter \u2013 DelegatingFilterProxy<\/em> \u2013 simply delegates to a Spring managed bean \u2013 the FilterChainProxy<\/em> \u2013 which itself is able to benefit from full Spring bean lifecycle management and such.<\/p>\n
2. The Spring Security configuration<\/h2>\n
The Spring configuration is mostly written in Java, but Spring Security configuration doesn\u2019t yet support full Java and still needs to be XML for the most part. There is an ongoing effort to add Java based configuration for Spring Security<\/a>, but this is not yet mature.
 
<\/div> <\/div><\/p>\n
The overall project is using Java configuration, so the XML configuration file needs to be imported via a Java @Configuration<\/em> class:<\/p>\n
@Configuration\r\n@ImportResource({ \"classpath:webSecurityConfig.xml\" })\r\npublic class SecSecurityConfig {\r\n   public SecSecurityConfig() {\r\n      super();\r\n   }\r\n}<\/pre>\n
The Spring Security XML Configuration \u2013 webSecurityConfig.xml<\/em>:<\/p>\n
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<beans:beans xmlns=\"http:\/\/www.springframework.org\/schema\/security\" \r\n  xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\r\n  xmlns:beans=\"http:\/\/www.springframework.org\/schema\/beans\"\r\n  xsi:schemaLocation=\"\r\n      http:\/\/www.springframework.org\/schema\/security \r\n      http:\/\/www.springframework.org\/schema\/security\/spring-security-3.1.xsd\r\n      http:\/\/www.springframework.org\/schema\/beans \r\n      http:\/\/www.springframework.org\/schema\/beans\/spring-beans-3.2.xsd\">\r\n\r\n   <http use-expressions=\"true\">\r\n      <intercept-url pattern=\"\/login*\" access=\"isAnonymous()\" \/>\r\n      <intercept-url pattern=\"\/**\" access=\"isAuthenticated()\"\/>\r\n\r\n      <form-login \r\n         login-page='\/login.html' \r\n         default-target-url=\"\/homepage.html\" \r\n         authentication-failure-url=\"\/login.html?error=true\" \/>\r\n\r\n      <logout logout-success-url=\"\/login.html\" \/>\r\n\r\n   <\/http>\r\n   <authentication-manager>\r\n      <authentication-provider>\r\n         <user-service>\r\n            <user name=\"user1\" password=\"user1Pass\" authorities=\"ROLE_USER\" \/>\r\n         <\/user-service>\r\n      <\/authentication-provider>\r\n   <\/authentication-manager>\r\n<\/beans:beans><\/pre>\n
2.1. <intercept-url><\/em><\/h4>\n
We are allowing anonymous access on \/login<\/em> so that users can authenticate. We are also securing everything else.<\/p>\n
Note that the order of the <intercept-url><\/em><\/strong> element is significant \u2013 the more specific rules need to come first, followed by the more general ones.<\/p>\n
2.2. <form-login><\/em><\/h4>\n