添加具有spring security的自定义登录控制器

Question

An app built from the spring petclinic sample app has added spring security with a custom login form.

The app does not have a WebMvcConfiguration.java class as suggested by this tutorial . Instead, it has the following line in mvc-core-config.xml :

<mvc:view-controller path="/login" view-name="login" />

I have done Ctrl-H in eclipse and done a key word search for the term /login in the entire workspace, but no controller is visible. I also looked in the messages-jc sample project referred to in the tutorial link above, but could not find a " /login " controller there either.

How can I add a controller that will perform spring authentication with the standard username and password, but that will also allow me to subsequently add additional code to the authentication process when the login form at the "/login" url is submitted?

Is it as simple as adding the following to SomeOtherController.java :

@RequestMapping(value = "/login", method = RequestMethod.GET)
public String showLoginForm(Model model) {
        //what goes here?       
    return "public/loginform";
}

@RequestMapping(value = "/login", method = RequestMethod.POST)
public String processLoginForm(HttpSession session, @ModelAttribute("user") User user,
        BindingResult result, Model model, final RedirectAttributes redirectAttributes)
{
        //what goes here?
    return "secure/main";
}

Answer 1

In spring-security-core jar, there is an interface UserDetailsService which has a method

UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;

You can implement this interface and create your code your own logic, like

@Service("userDetailsService")
public class UserDetailsServiceImpl implements UserDetailsService {

@Transactional(readOnly = true)
public UserDetails loadUserByUsername(String username) {
    User user = userService.findUserByUsername(username);
    if (user != null) {
        String password = user.getPassword();
        boolean enabled = user.getActive();
        boolean accountNonExpired = user.getActive();
        boolean credentialsNonExpired = user.getActive();
        boolean accountNonLocked = user.getActive();

        Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
        for (Role r : user.getRoles()) {
            authorities.add(new SimpleGrantedAuthority(r.getAuthority()));
        }
        org.springframework.security.core.userdetails.User securedUser = new org.springframework.security.core.userdetails.User(
                username, password, enabled, accountNonExpired,
                credentialsNonExpired, accountNonLocked, authorities);
        return securedUser;
    } else {
        throw new UsernameNotFoundException(
                "Unable to find user with username provided!!");
    }
}

and then create an object of DaoAuthenticationProvider using

<bean id="daoAuthenticationProvider"
    class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsService"></property>
</bean>

Finally, supply this DaoAuthenticationProvider to ProviderManager

<bean class="org.springframework.security.authentication.ProviderManager">
    <constructor-arg>
        <list>
            <ref bean="daoAuthenticationProvider" />
        </list>
    </constructor-arg>
</bean>

<security:authentication-manager>
    <security:authentication-provider
        user-service-ref="userDetailsService">
        <security:password-encoder hash="plaintext"></security:password-encoder>
    </security:authentication-provider>
</security:authentication-manager>

adding web.xml details

<listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:spring-config/spring-*.xml</param-value>
</context-param>


<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
 </filter-mapping>

Answer 2

Your jsp file involving login form should be like this.

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>  
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">  
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>  
<html>  
<head>  
<title>Spring security</title>  
<style>  
.errorblock {  
 color: #ff0000;  
 background-color: #ffEEEE;  
 border: 3px solid #ff0000;  
 padding: 8px;  
 margin: 16px;  
}  
</style>  
</head>  
<body onload='document.f.j_username.focus();'>  
 <h3>Login with Username and Password</h3>  

 <c:if test="${not empty error}">  
  <div class="errorblock">  
   Your login attempt was not successful, try again.  
 Caused :  
   ${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}  
  </div>  
 </c:if>  
 <%-- <c:url value="/j_spring_security_check" var="index.htm" />
 <form name='f' action="${index.htm}" method='POST'>  --%>
 <form name='f' action="<c:url value='j_spring_security_check' />" method='POST'> 
  <table>
   <tr>  
    <td>User:</td>  
    <td><input type='text' name='j_username' value=''>  
    </td>  
   </tr>  
   <tr>  
    <td>Password:</td>  
    <td><input type='password' name='j_password' />  
    </td>  
   </tr>  
   <tr>  
    <td colspan='2'><input name="submit" type="submit"  
     value="submit" />  
    </td>  
   </tr>  
   <tr>  
    <td colspan='2'><input name="reset" type="reset" />  
    </td>  
   </tr>  
  </table>  
 </form>  
</body>  
</html>

Your spring-security.xml file should look like this.

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="http://www.springframework.org/schema/beans"  
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
xmlns:security="http://www.springframework.org/schema/security"  
xmlns:p="http://www.springframework.org/schema/p"   
xsi:schemaLocation="http://www.springframework.org/schema/beans  
                    http://www.springframework.org/schema/beans/spring-beans.xsd  
                    http://www.springframework.org/schema/security  
                    http://www.springframework.org/schema/security/spring-security.xsd">

 <security:http auto-config="true" >  
 <security:intercept-url pattern="/index*" access="ROLE_USER" />  
 <security:form-login login-page="/login.htm" default-target-url="/index.htm"  
  authentication-failure-url="/loginerror.htm" />  
 <security:logout logout-success-url="/logout.htm" />
 <!-- <security:csrf disabled="true"/> -->  
 </security:http>  

<security:authentication-manager>  
<security:authentication-provider>  
<!-- <security:user-service>  
<security:user name="syed" password="1111" authorities="ROLE_USER" />  
</security:user-service> -->  
<security:jdbc-user-service data-source-ref="dataSource"    
users-by-username-query="select username, password, active from users where username=?"   
authorities-by-username-query="select us.username, ur.authority from users us, user_roles ur   
where us.user_id = ur.user_id and us.username =?  "   
/>  
</security:authentication-provider>  
</security:authentication-manager>
</beans>

Inside the configuration element, you can restrict access to particular URLs with one or more elements. Each element specifies a URL pattern and a set of access attributes required to access the URLs. Remember that you must always include a wildcard at the end of a URL pattern. Failing to do so will make the URL pattern unable to match a URL that has request parameters.

 <security:http auto-config="true" >  
 <security:intercept-url pattern="/index*" access="ROLE_USER" />
 <security:intercept-url pattern="/Transit*" access="ROLE_USER" />
 <security:form-login login-page="/login.htm" default-target-url="/index.htm"  
  authentication-failure-url="/loginerror.htm" />  
 <security:logout logout-success-url="/logout.htm" />
 </security:http>

When ever we are going to describe a url without any security, Then we should remove the particular url from the above lines of code under security configured xml file. for example if we dont need any security for index page then the above coding should look like this.

<security:http auto-config="true" >  
     <security:intercept-url pattern="/Transit*" access="ROLE_USER" />
     <security:form-login login-page="/login.htm" default-target-url="/index.htm"  
      authentication-failure-url="/loginerror.htm" />  
     <security:logout logout-success-url="/logout.htm" />
     </security:http>

Answer 3

For this purpose you can use your own CustomAuthenticationProvider by implementing AuthenticationProvider from org.​springframework.​security.​authentication and override public Authentication authenticate(Authentication authentication) method.

code example is given below

public class CustomAuthenticationProvider implements AuthenticationProvider {

@Override
public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {
    String username = authentication.getName();
    String password = (String) authentication.getCredentials();
    List<GrantedAuthority> grantedAuths = new ArrayList<>();


       //validate and do your additionl logic and set the role type after your validation. in this code i am simply adding admin role type
        grantedAuths.add(new SimpleGrantedAuthority("ROLE_ADMIN" ));



    return new UsernamePasswordAuthenticationToken(username, password, grantedAuths);
}

@Override
public boolean supports(Class<?> arg0) {
    return true;
}

} 

so default login handler ie /login(POST) will be handled by this.