管理员请求的春季安全配置错误

Question

I'm trying to configure my Spring application to have a pretty basic security system with Spring security. I would like to have resources to be served without security filters, standard pages to be filtered checking if the user has the role "User" and /admin/ pages to be served checking if the role is "Admin".

What I have is:

springSecurityFilterChain org.springframework.web.filter.DelegatingFilterProxy

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

in the web.xml, while the spring-security.xml is:

<security:http security="none" pattern="/resources/**"/>
<security:http auto-config="true" use-expressions="true" >
    <security:intercept-url pattern="/admin/**" access="hasRole('Admin')" />
    <security:logout logout-success-url="/welcome" logout-url="/logout" />
    <security:form-login login-page="/FormLogin"
        default-target-url="/welcome"
        username-parameter="username"
        password-parameter="hashPwd" 
        authentication-failure-url="/login?error"
        />
</security:http>

<security:authentication-manager>
   <security:authentication-provider user-service-ref="controlloUtente">
     <security:password-encoder hash="bcrypt" />  
  </security:authentication-provider>
</security:authentication-manager>


<beans:bean id="controlloUtente"
    class="org.fabrizio.fantacalcio.utility.SpringSecurityServiceImpl">
</beans:bean>

Then I configured this class:

package org.fabrizio.fantacalcio.utility;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

import org.fabrizio.fantacalcio.model.beans.Utente;
import org.fabrizio.fantacalcio.model.dao.UtenteDaoImpl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
@Transactional
public class SpringSecurityServiceImpl implements UserDetailsService{

    @Autowired
    private UtenteDaoImpl utenteDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Utente utente = utenteDao.getUtenteByUsername(username);
        if(utente == null){
            throw new UsernameNotFoundException("L'utente inserito non è stato trovato");
        }
        return convertUtente(utente);
    }

    private UserDetails convertUtente(Utente utente) {
        UserDetails ud = new User(utente.getUsername(), utente.getHashPwd(), true, true, true, true, getRoles(utente));
        return ud;
    }

    private Collection<? extends GrantedAuthority> getRoles(Utente utente) {
        GrantedAuthority auth = new SimpleGrantedAuthority(utente.getRuolo().getNome());
        List<GrantedAuthority> listaAuth = new ArrayList<GrantedAuthority>();
        listaAuth.add(auth);
        return listaAuth;
    }

}

and the following one:

package org.fabrizio.fantacalcio.utility;

import org.springframework.beans.BeansException;
import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.core.PriorityOrdered;
import org.springframework.security.access.annotation.Jsr250MethodSecurityMetadataSource;
import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
import org.springframework.stereotype.Component;

@Component
public class DefaultRolesPrefixPostProcessor implements BeanPostProcessor, PriorityOrdered {

    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName)
            throws BeansException {
        if(bean instanceof Jsr250MethodSecurityMetadataSource) {
            ((Jsr250MethodSecurityMetadataSource) bean).setDefaultRolePrefix("");
        }
        if(bean instanceof DefaultMethodSecurityExpressionHandler) {
            ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix("");
        }
//        if(bean instanceof DefaultWebSecurityExpressionHandler) {
//            ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix("");
//        }
        return bean;
    }

    @Override
    public Object postProcessBeforeInitialization(Object bean, String beanName)
            throws BeansException {
        return bean;
    }

    @Override
    public int getOrder() {
        return PriorityOrdered.HIGHEST_PRECEDENCE;
    }
}

But nothing works. My formLogin doesn't use spring forms but a classic form.

When I'm logged in and I try to get a pge like /admin/testpage , I get redirected to FormLogin page, even if I have admin role, and this is the debug output:

22/06/2015 10:03:04 - DEBUG - (AntPathRequestMatcher.java:141) - Request '/admin/formregistrazione' matched by universal pattern '/**'
22/06/2015 10:03:04 - DEBUG - (HttpSessionRequestCache.java:43) - DefaultSavedRequest added to Session: DefaultSavedRequest[http://localhost:8080/Fantacalcio/admin/FormRegistrazione]
22/06/2015 10:03:04 - DEBUG - (ExceptionTranslationFilter.java:202) - Calling Authentication entry point.
22/06/2015 10:03:04 - DEBUG - (DefaultRedirectStrategy.java:39) - Redirecting to 'http://localhost:8080/Fantacalcio/FormLogin'
22/06/2015 10:03:04 - DEBUG - (HttpSessionSecurityContextRepository.java:337) - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.

Sometimes, after login, I get this message:

HTTP Status 403 - Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.

What did I do wrong? I ALWAYS have to use the token? And why the flow never goes into the SpringSecurityServiceImpl class?

Thanks

EDIT: I disabled csrf and it's getting clear now. The problem is in my SpringSecurityServiceImpl the Autowired utenteDao instance is null. I edited the spring-security.xml file like this, hoping Spring understands the @Service annotated class but it doesn't work:

<security:authentication-manager>
       <security:authentication-provider user-service-ref="SpringSecurityServiceImpl">
         <security:password-encoder hash="bcrypt" />  
      </security:authentication-provider>
    </security:authentication-manager>

My UtenteDao class

package org.fabrizio.fantacalcio.model.dao;

import java.util.List;

import org.fabrizio.fantacalcio.model.beans.Utente;
import org.hibernate.criterion.Restrictions;
import org.springframework.stereotype.Repository;

@Repository
public class UtenteDaoImpl extends BaseDaoImpl<Utente> implements UtenteDao{

     public UtenteDaoImpl() {
    System.out.println("test");
    }

    @SuppressWarnings("unchecked")
    public List<Utente> trovaUtentiAttivi(){
        return getSession().createCriteria(Utente.class).add(Restrictions.eq("attivo", true)).list();
    }


    @SuppressWarnings("unchecked")
    public Utente getUtenteFromCredenziali(Utente utente){
        List<Utente> utenteTrovato = getSession().createCriteria(Utente.class)
                .add(Restrictions.eq("username", utente.getUsername()))
                .add(Restrictions.eq("hashPwd", utente.getHashPwd()))
                .list();
        Utente utenteLoggato = utenteTrovato.size() == 0 ? null : utenteTrovato.get(0);
        return utenteLoggato;
    }

    public Boolean usernameExists(String username){
        return getSession().createCriteria(Utente.class)
                .add(Restrictions.eq("username", username))
                .list().size() > 0;
    }

    @SuppressWarnings("unchecked")
    public Utente getUtenteByUsername(String username){
        List<Utente> utenteTrovato = getSession().createCriteria(Utente.class)
                .add(Restrictions.eq("username", username))
                .list();
        Utente utenteLoggato = utenteTrovato.size() == 0 ? null : utenteTrovato.get(0);
        return utenteLoggato;
    }
}

Answer 1

Spring security login and logout forms expect CSRF tokens to be sent in the post request. You can add the token using hidden variable:

 <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>

Add above line in spring security login form. And logout is also need to be a post request method. Every post request to server is gonna check for these tokens which you can set into request header. If you don't want to do this and disable csrf token security. You can disable it using csrf tag in http section of security config. csrf has attribute to disable it.

<http>
    <csrf />
</http>

Read this article to know more.

EDIT:

You have mentioned user-service-ref="SpringSecurityServiceImpl" in security authentication tag but Service class does not have an identifier. Give your service class an identifier, prefer camel case characters.

@Service("springSecurityServiceImpl") // talking about this identifier
@Transactional
public class SpringSecurityServiceImpl implements UserDetailsService {}

And authentication provider bean should be:

<security:authentication-manager>
   <security:authentication-provider user-service-ref="springSecurityServiceImpl">
     <security:password-encoder hash="bcrypt" />  
  </security:authentication-provider>
</security:authentication-manager>

And also check if your DAO class is marked as @Repository component for autowire to work perfectly.

Answer 2

I solved the problem. Searching around I found out that security and servlet have different context, so basically I had to add the <context:component-scan base-package="org.fabrizio.fantacalcio.utility, org.fabrizio.fantacalcio.model.dao" /> on the security-config.xml file too, declaring only the package to scan to make the security work, as it doesn't share the beans declared in the dispatcher config file.